<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Terraform Security — API Reference

## Static Analysis Tools

### tfsec

```bash
# Full scan
tfsec . --format json

# Minimum severity
tfsec . --minimum-severity HIGH

# Specific checks
tfsec . --run-check-ids aws-s3-enable-bucket-encryption

# Exclude checks
tfsec . --exclude-check aws-vpc-no-public-ingress

# Custom check directory
tfsec . --custom-check-dir ./custom_checks/
```

### Checkov

```bash
# Directory scan
checkov -d . --output json

# Plan scan
terraform plan -out=tfplan && terraform show -json tfplan > tfplan.json
checkov -f tfplan.json --framework terraform_plan

# Specific checks
checkov -d . --check CKV_AWS_18,CKV_AWS_19

# Skip checks
checkov -d . --skip-check CKV_AWS_20

# Secret scanning
checkov -d . --framework secrets
```

### Trivy

```bash
# Config scan
trivy config . --severity HIGH,CRITICAL --format json

# Specific file
trivy config main.tf

# With custom policy
trivy config . --policy ./policies/
```

## Secret Scanning

```bash
# Gitleaks
gitleaks detect --source . --report-format json --report-path report.json

# TruffleHog
trufflehog filesystem . --json

# git-secrets
git secrets --scan
```

## Terraform CLI

```bash
# Validate configuration
terraform validate

# Plan with detailed exit code (2 = changes needed)
terraform plan -detailed-exitcode

# Show state
terraform state list
terraform state show RESOURCE

# Import existing resource
terraform import RESOURCE_TYPE.NAME RESOURCE_ID

# Check providers
terraform providers
```

## Key Checkov Check IDs (AWS)

| Check ID | Description |
|----------|-------------|
| CKV_AWS_1 | IAM policy not using wildcards |
| CKV_AWS_3 | EBS encrypted |
| CKV_AWS_16 | RDS encrypted |
| CKV_AWS_18 | S3 access logging |
| CKV_AWS_19 | S3 encryption |
| CKV_AWS_21 | S3 versioning |
| CKV_AWS_24 | Security group no 0.0.0.0/0 |
| CKV_AWS_35 | CloudTrail multi-region |
| CKV_AWS_41 | No hardcoded credentials |
| CKV_AWS_88 | EC2 not public |

## Key tfsec Check IDs

| Check ID | Description |
|----------|-------------|
| aws-s3-enable-bucket-encryption | S3 encryption |
| aws-s3-enable-bucket-logging | S3 logging |
| aws-iam-no-policy-wildcards | IAM wildcards |
| aws-vpc-no-public-ingress | VPC public access |
| aws-ec2-no-public-ip | EC2 public IP |
