Static code analysis tool for terraform [closed]

Question

Is there any static code analysis tool for terraform? I tried tflint. But it doesn't support output of module or attributes of resources. any other suggestion please

Tarango

What are you wanting out of the static analysis? – Verret

blog.christophetd.fr/… – Faradism

Answer 1

Terrascan is another static analysis tool in addition to TFLint. Terrascan is more focused on security checks for AWS resources.

Duke

Answer 2

Checkov is another terraform static analysis tool. Scanning multi-cloud resources for security miss configurations and supports terraform>=0.12

Sandlin

Answer 3

There is also TFsec, which is pretty good.

I'm working on a product that allows you to try a bunch of these scanners pretty easily and help integrate with your CI/CD called Soluble to determine which scanner works best for your environment. Always appreciate feedback.

Boldt

Answer 4

you may also checkout enterprise grade solutions (google you will find them) similar to aquasec solution. I would create a comparison table, pros and cons and then consider the best.

Dishpan