Scan Terraform HCL files for security misconfigurations: open security groups, public S3 buckets, and missing encryption.
Paste a Terraform .tf file into the box and this tool parses the HCL and reports resources that match known insecure patterns: security group ingress from 0.0.0.0/0 or ::/0, S3 buckets with public ACLs or disabled public-access blocks, and storage without encryption at rest. Findings name the resource address, the offending line, and a concrete fix, and the file never leaves the browser. What surprises people: the scan reads the full text you pasted, but it evaluates only literal values. Values that arrive through variables, module calls, or data sources are skipped rather than resolved, so a range written as var.admin_cidr passes even when it resolves to the world.
A concrete input and expected output from the current implementation.
Input
resource "aws_s3_bucket" "logs" {
bucket = "app-logs"
acl = "public-read"
}
resource "aws_security_group" "ssh" {
name = "ssh-from-everywhere"
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_db_instance" "main" {
engine = "postgres"
instance_class = "db.t3.micro"
} Expected output
3 findings [CRITICAL] aws_security_group.ssh (line 13) Port 22 (SSH) is open to 0.0.0.0/0. Restrict cidr_blocks to a known range. [HIGH] aws_s3_bucket.logs (line 3) ACL "public-read" grants anonymous read access. Set acl = "private" or remove the argument. [HIGH] aws_db_instance.main (line 17) Encryption at rest is not enabled. Add storage_encrypted = true.
All three findings follow from the file: the ingress block opens SSH to every IPv4 address, the ACL grants anonymous reads, and aws_db_instance without storage_encrypted is created unencrypted by provider default. Nothing else in the file matches a rule, so nothing else is reported.
The text is parsed as HCL before any rule runs, so malformed syntax returns a parse error naming the line instead of a findings list. Each rule targets one resource type and checks arguments for literal values: an ingress block with cidr_blocks = ["0.0.0.0/0"], an ACL equal to public-read, a missing storage_encrypted. Non-literal expressions are skipped, never guessed.
A finding carries the resource address (type.name), the line of the offending argument, a severity, and a suggested fix. Legacy and current spellings of the same problem are both caught: a public-read ACL on aws_s3_bucket and a public access block with block_public_acls = false each produce a finding. When nothing matches, the result is an empty list, not an error.
No. The scan covers a fixed set of patterns in the one file you pasted, using only literal values. Anything decided by variables, modules, data sources, or changes made after apply is outside what it can see. Treat a clean result as one useful check passed, and pair it with plan review or an account-level audit before relying on it.
Because the scan reads only the file you pasted. Encryption configured in a separate aws_s3_bucket_server_side_encryption_configuration block, by an account default, or after apply is invisible to it. The fix it suggests is not to change your setup, but to make encryption explicit in the resource being scanned.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.