Can it read a plan file?

Yes — `terraform show -json plan.bin > plan.json`, then pass `plan.json`.

Why didn't it flag X?

Coverage is the rule set in `tfscan.py` (SGs, S3, RDS, IAM, CloudTrail, EBS, Azure NSG/storage, GCP firewall/bucket). Open a request for more rules.

Are CRITICAL findings blocked automatically?

No. The report is advisory; you decide whether to apply.

terraform security misconfig scanner

Answer: 6 CRITICAL, 7 HIGH, 3 MEDIUM across 8 resources in the sample stack.

CRITICAL aws_security_group.web — SSH (22) open to 0.0.0.0/0 (CIS-AWS-4.1/4.2)
CRITICAL aws_s3_bucket.logs — ACL public-read
CRITICAL aws_db_instance.app — publicly_accessible=true
CRITICAL aws_iam_policy.too_open — Action=* on Resource=*
CRITICAL aws_cloudtrail.org — enable_logging=false
CRITICAL azurerm_network_security_rule.rdp — * → port 3389

HIGH — all four S3 Block Public Access flags false; RDS storage_encrypted off; CloudTrail not multi-region; port 80 open to the world

MEDIUM — CloudTrail log validation / KMS missing; EBS volume without encrypted=true

Deliverables: per-resource findings with file:line and CIS-style IDs; optional tf-security.md + JSON.

Next steps: tighten SG/NSG CIDRs, enable BPA + encryption + CloudTrail, replace the wildcard IAM policy, re-scan the plan JSON before apply. Does not run terraform or call any cloud API.

(Real run on bundled examples/bad/main.tf.)

About this skill

Catch the open security group before terraform apply.

Scans .tf files and terraform show -json plan files for AWS/Azure/GCP misconfigs: 0.0.0.0/0 admin ports, public S3 ACLs / BPA off, public/unencrypted RDS, CloudTrail disabled, IAM Action=*, weak Azure storage TLS, GCP firewall 0.0.0.0/0, and more. CIS-style IDs for orientation. No terraform binary, no cloud API.

What's included

SKILL.md, scripts/tfscan.py, bad-example main.tf, references.

terraform security misconfig scanner