---
name: "tfsec-static-security-scanner"
description: "Scan Terraform templates for security vulnerabilities and compliance misconfigurations."
metadata:
  author: "Aqua Security"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "scan terraform with tfsec"
  - "fix tfsec security warnings"
  - "export tfsec sarif report"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# tfsec Static Security Scanner for Terraform Code

Scans infrastructure code with tfsec (Trivy): detecting open security groups (0.0.0.0/0), unencrypted S3 buckets, unrotated KMS keys, insecure IAM policies, and generating SARIF reports for GitHub Code Scanning.

## When to Invoke
Invoke this skill whenever you need to:
- scan terraform with tfsec
- fix tfsec security warnings
- export tfsec sarif report

## Execution SOP & Rules
1. Run scanner locally: tfsec . --concise-output.
2. Review reported security findings (HIGH/CRITICAL) with rule documentation references.
3. Ignore intentional exceptions: #tfsec:ignore:aws-s3-enable-bucket-encryption:reason=public-assets.
4. Export to SARIF: tfsec . --format sarif --out tfsec.sarif for GitHub Security tab integration.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.