IaC security scanning automatically evaluates Terraform code for misconfigurations, secret leaks, and compliance violations before deployment.
Step‑by‑step with Checkov
1. Install: pip install checkov.
2. Scan a directory: checkov -d ./terraform --output json --quiet.
3. Fail the CI job on severity ≥ high: checkov -d ./terraform --skip-check CKV_AWS_20 --quiet --soft-fail.
4. Export results to SARIF for GitHub Code Scanning: checkov -d ./terraform --output sarif > results.sarif.
5. Integrate as a pre‑commit hook: add to .pre-commit-config.yaml:
- repo: https://github.com/bridgecrewio/checkov
rev: v2.3.0
hooks:
- id: checkov
args: ["-d", ".","--quiet"]Step‑by‑step with tfsec
1. Install the latest binary: curl -sSL https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install.sh | bash.
2. Run a scan: tfsec ./terraform --format json --exclude-checks AWS018.
3. Set a severity threshold in CI: tfsec ./terraform --severity HIGH,CRITICAL --soft-fail.
4. Generate a JUnit report for Jenkins: tfsec ./terraform --format junit > tfsec.xml.
Quick comparison
| Feature | Checkov | tfsec |
|--------------------|----------------------------|----------------------|
| Policy source | Bridgecrew community + custom | Open‑source core + community |
| Output formats | JSON, SARIF, JUnit, CSV | JSON, JUnit, CSV |
| CI integration | pre‑commit, GitHub, GitLab | GitHub Actions, Jenkins |
| Experimental rules| --enable-experimental | none (all enabled) |
| Cloud provider coverage | AWS, Azure, GCP, OCI, K8s | AWS, Azure, GCP, OCI |
Gotcha: Checkov disables experimental policies by default; enable them with --enable-experimental or set CHECKOV_ENABLE_EXPERIMENTAL=1 otherwise critical Kubernetes RBAC misconfigurations will be missed.