Applying SAST to Infrastructure as Code (Without TFSec)

Static analysis isn't just for application source code. Terraform, Pulumi, OpenTofu, and CloudFormation files are code too — and they get misconfigured just as often as a backend service. A public S3 bucket, a security group open to 0.0.0.0/0, or an unencrypted RDS instance are all bugs you can catch before apply ever runs.

TFSec is the tool most people reach for first, but it's not the only option on the OWASP Source Code Analysis Tools list. In this article I'll use Checkov, a free, open-source policy-as-code scanner built by Bridgecrew (now part of Palo Alto Networks), to scan a Terraform project end to end — from a local scan to a GitHub Actions gate that blocks merges on critical misconfigurations.

The same approach works with OpenTofu and Pulumi projects too, since Checkov understands HCL directly and also has native support for Pulumi's rendered plan output and CloudFormation/ARM/Kubernetes manifests.

Why Checkov?

100% open source (Apache 2.0), actively maintained, thousands of built-in policies.