# Securing your Terraform IaC with tfsec

Created on 2025-07-16 18:53

Published on 2025-07-17 15:30

**Hello everyone,**

Hope you all are doing well. I'm back with another exciting blog on Securing your terraform IaC with tfsec. In this blog we will learn about -

* ✅ Scanning Terraform projects with tfsec
    
* 🔁 Blocking PRs with GitHub Actions
    

Let's dive in!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245072419/8498dd29-4d3f-4e91-8a3b-61830a675a65.png align="left")

tfsec is an open-source security scanner for Terraform created by Aqua Security. It inspects your code for:

* Misconfigured resources
    
* Insecure defaults
    
* Compliance issues (CIS, PCI, NIST, etc.)
    

And most important of all, it smoothly integrates into local dev workflows **and** CI/CD pipelines.

Let's see how exactly it works!

For the purpose of a brief demonstration, let's intentionally create a Terraform configuration that includes deliberate misconfigurations and insecure default settings, in order to illustrate security pitfalls that can arise from improper infrastructure-as-code practices.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245073533/9249b59a-9b35-4e88-bdcb-1dd3c8cd21ff.png align="left")

main.tf

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245074618/b5fed252-47e0-415f-9294-985d6f56408a.png align="left")

s3 module

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245075633/4eb5c3cf-ac2c-4889-afb1-94db68dfd50c.png align="left")

security group module

Now, let's install tfsec.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245076716/1abe5e78-6293-438a-adff-fee4d9f4bae5.png align="left")

Though I had previously installed it

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245077934/ae4aff52-5f3a-4cb3-b60f-e87e8a1064cb.png align="left")

Now, let's run a scan locally -

Now, Let's write a simple github action to utlize tfsec . for that, create a .github folder and inside that create a workflows folder. After that create tfsec.yaml file.

Let's see how it works when it is triggered.

Now, since we want to enforce this on every Pull Request for Main branch, we will create a branch protection rule.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245079000/a956dc94-5695-443b-819a-a77979514444.jpeg align="left")

Or You can create it on from UI as well.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245080026/c4a0a7f0-6bbb-48f0-aaa3-b24a93522a45.png align="left")

Now we will be able to see it running on every PR, and if it doesn't passes, you won't be able to merge.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245081230/bb435540-18c1-4567-9dcb-6077f14ce4f9.png align="left")

Now, one more feature is to use tfsec-commenter GitHub Action as well. We will see that in next blog.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245082228/22a54357-c08e-4647-865c-1eef9fe9e9ef.png align="left")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245083449/2eeefd85-7a31-4157-b7f0-06c0af0b0931.png align="left")

Screenshot from Official Repo from Aquasecurity. \\

Another way is to use VS Code extension -

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757245084621/444afe5a-dcf5-4c39-a419-91839cf86609.png align="left")

That's it for this blog. See you all soon!

Thanks,

Regards,

Sankalp Sandeep Paranjpe

[https://www.linkedin.com/in/sankalp-s-paranjpe/](https://www.linkedin.com/in/sankalp-s-paranjpe/)