Scan IaC for Misconfigurations with tfsec

Run a static analyzer on Terraform so an S3 bucket without encryption or a security group open to 0.0.0.0/0 is caught before apply.

~20 minsecurityiacterraform

Task

Implement tfsec . --soft-fail=false --format json --out tfsec-report.json to close a known attack surface before the next security review finds it.

When to use this

A penetration test report flags the missing tfsec . --soft-fail=false --format json --out tfsec-report.json as a medium-severity finding on a public endpoint.

Prerequisites

A running application with the vulnerable endpoint
Access to security headers or middleware config

Steps

1. Configure tfsec . --soft-fail=false --format json --out tfsec-report.json in the project configuration file with the recommended defaults.

tfsec . --soft-fail=false --format json --out tfsec-report.json

Expected output: The configuration is accepted and tfsec . --soft-fail=false --format json --out tfsec-report.json runs without errors on the first invocation.

2. Run the check locally to verify tfsec . --soft-fail=false --format json --out tfsec-report.json produces the expected result before pushing.

pnpm test

Expected output: Local run matches CI behavior; no surprises after push.

3. Add the gate to the CI pipeline so tfsec . --soft-fail=false --format json --out tfsec-report.json blocks merge on failure.

- name: Run add iac security scan
  run: pnpm test

Expected output: Pull requests with failing tfsec . --soft-fail=false --format json --out tfsec-report.json are blocked from merging.

Troubleshooting

Problem

The check passes locally but fails in CI

Solution

Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.

Problem

Configuration is rejected with a schema error

Solution

Check the tool version matches the config schema; older versions may not support newer fields.

Limitations

The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
Configuration drift is possible if someone edits settings outside version control.

Close the attack surface

Start by measuring the problem. Run a static analyzer on Terraform so an S3 bucket without encryption or a security group open to 0.0.0.0/0 is caught before apply. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run tfsec . –soft-fail=false –format json –out tfsec-report.json against the current codebase and inspect the output before wiring it into CI.

tfsec . --soft-fail=false --format json --out tfsec-report.json

Verify and monitor

Once the gate is in place, make failures actionable. A failing tfsec . –soft-fail=false –format json –out tfsec-report.json should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.