Terraform Security Scanner

The Terraform Security Scanner is a lightweight, client-side static analysis tool that parses the Terraform configuration you paste and surfaces common infrastructure security risks before they ever reach a cloud account. Instead of waiting for a pipeline gate or a breach, you get immediate, private feedback right in your browser. The scanner focuses on the misconfigurations that appear most often in real AWS Terraform: publicly readable S3 buckets, security groups left open to the entire internet, unencrypted storage volumes, and buckets that are missing versioning. Each finding is rated with a practical severity so you can triage quickly, and the entire report is rendered as clean Markdown you can paste into a pull request or ticket. Because everything runs locally, no configuration, secret, or resource name is ever uploaded, which makes it safe to use even on sensitive code. It is not a replacement for dedicated scanners such as tfsec or Checkov, but it is the fastest possible first pass and a great teaching aid for spotting insecure patterns in your own modules. It is especially useful during code review, before a terraform plan, and as part of a local pre-commit guardrail for engineers who want instant feedback without leaving their editor or waiting on a remote pipeline.

• Public S3 detection - flags buckets with acl set to public-read or public-read-write, plus missing public access blocks.
• Open security groups - flags ingress or egress rules allowing 0.0.0.0/0, with extra emphasis on SSH and broad port ranges.
• Unencrypted EBS - flags aws_ebs_volume blocks where encrypted is not set to true.
• Unencrypted RDS - flags aws_db_instance and aws_rds_cluster where storage_encrypted is missing.
• Missing versioning - flags S3 buckets that omit an enabled versioning block.
• Severity ratings - every finding is graded HIGH, MEDIUM or LOW with a one-line summary.
• Resource-aware - walks parsed resource blocks by type and name for precise addressing.
• Markdown report - produces a copy-pasteable, severity-grouped report.
• Summary counts - a live stats row shows how many HIGH, MEDIUM and LOW findings were found.
• Word-wrap toggle - switch the report between scroll and wrap modes for comfortable reading.
• Private by design - parses text only, never contacts AWS.
• Export options - copy, download or print the results.

1. Open the tool and locate the text area on the left panel.
2. Paste your Terraform - drop in a .tf file or a snippet containing the resources you want to check.
3. Load the sample if you want a quick demonstration of a deliberately insecure configuration.
4. Click Scan to run the heuristic checks against the parsed HCL.
5. Read the report in the preview pane, grouped by HIGH, MEDIUM and LOW severities.
6. Check the summary counts shown above the report to gauge overall risk quickly.
7. Toggle word wrap if the long lines make the report hard to read on a narrow screen.
8. Fix issues in your code using the addressed resource names and messages as a guide.
9. Export the report by copying, downloading a Markdown file, or printing it for a ticket.

Example 1 - public bucket. An aws_s3_bucket with acl = "public-read" is reported as HIGH because anyone on the internet can read the objects. Set the ACL to private and use bucket policies with explicit principals instead. The scanner also inspects the aws_s3_bucket_public_access_block to confirm blocking is enabled.

Example 2 - open SSH. An aws_security_group with ingress from_port = 22 and cidr_blocks = ["0.0.0.0/0"] is HIGH; restrict the CIDR to a bastion or VPN range. The scanner also flags fully open ranges such as 0 to 65535 as high risk.

Example 3 - unencrypted volume. An aws_ebs_volume without encrypted = true is MEDIUM; add encrypted = true and, for compliance, a customer-managed KMS key. Unencrypted RDS instances are reported as HIGH because they protect production data.

• Speed - get a security read-out in seconds, with no install or sign-in.
• Privacy - your configuration never leaves the browser, so secrets and names stay local.
• Clarity - findings are grouped by severity and reference real resource addresses.
• Actionability - each line tells you exactly what to change and why it matters.
• Portability - the Markdown report drops straight into pull requests and audits.
• Learning - repeated use trains you to avoid the same mistakes in future modules.
• Compliance - it provides quick evidence of security checks that helps answer audit and regulatory questions about infrastructure safety.