Terraform Configuration Review
Find open ports, public buckets, unencrypted storage and wildcard IAM in your Terraform.
Try before you buy.
- Free preview: the score and every count (findings by severity and category), with the first findings, resources and benchmark controls of the report (up to 10 each).
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Your Terraform
Or drop .tf, .tfvars and plan JSON files, a whole folder or a .zip of the repository here: folders keep their paths, so local modules are followed. Reviewed in your browser; nothing is uploaded.
Review report
Findings
Accepted in code
Benchmark controls
Every control a rule checked in your files. Pass means no finding for the resources checked.
| Control | What it checks | Status | Findings |
|---|
Resources reviewed
| Resource | Location | Findings |
|---|
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the Terraform Configuration Review
Check your own Terraform before you apply it. Paste a file, open several, drop a whole folder or a .zip of the repository, or open the JSON of a plan (terraform show -json plan.out), and every resource is reviewed for the settings that most often expose data or accounts:
- Network exposure: security groups, network security groups and firewall rules open to
0.0.0.0/0or::/0(SSH, RDP, databases, every port), public database endpoints, public IP addresses, Kubernetes API servers reachable from anywhere. - Public access: S3 ACLs and bucket policies for everyone, Block Public Access turned off, public blob containers,
allUserson Cloud Storage, BigQuery and KMS, resource policies withPrincipal "*". - Encryption: unencrypted EBS volumes, RDS and Aurora databases, EFS, caches and search domains, missing KMS rotation, plain HTTP listeners and old TLS versions.
- Logging: CloudTrail settings, VPC and subnet flow logs, S3 and load balancer access logs, EKS audit logs, SQL auditing.
- Identity and access: IAM policies with
"Action": "*"on"Resource": "*", service-wide wildcards, NotAction, iam:PassRole on every role, trust policies anyone can assume (including GitHub Actions OIDC roles without asubcondition), basic Owner and Editor roles. - Secrets in code: credentials in provider blocks, passwords and secret defaults in variables, AWS access key IDs.
The review reads Terraform the way Terraform does: variables take their defaults and your .tfvars values, locals and functions such as jsonencode, merge and format are evaluated, local modules are followed with their arguments, count = 0 resources are skipped and policies written as JSON, heredocs or aws_iam_policy_document data sources are read alike. Each finding names the resource, file and line, says why it matters, gives the documented safer setting with example code and links the CIS Benchmark recommendation and AWS Security Hub control it maps to. There are over 140 checks for AWS, Azure and Google Cloud. Nothing is uploaded: the review runs in your browser.
Without a pass the result is a free preview: the score and every count, with the first findings of the report. The whole report, the benchmark table, copying it and the PDF, Word, Markdown, CSV, JSON and SARIF downloads unlock with a Pro pass.
How to use it
- Paste Terraform code, or press Open files, Open folder or drop files, a folder or a
.zipon the panel. Plans and state work too: runterraform show -json plan.out > plan.jsonand open plan.json. Or press Load example. - If your folder has several variable files (dev.tfvars, prod.tfvars), choose the one to use: terraform.tfvars and *.auto.tfvars in the folder of the root module are always read, as Terraform reads them. Choose the edition of the CIS AWS Foundations Benchmark you follow.
- Press Review configuration. Read the score and the findings, most severe first; filter them by severity and category, open Show the code to see the lines, and use the safer setting and its example to fix each one.
- To accept a finding on purpose, add a comment such as
# mysmartcopilot:ignore:aws-s3-access-loggingon the line above the resource or argument: it is listed as accepted and left out of the score. - With a pass, or once the result is unlocked, copy the report or download it as PDF, Word, Markdown, CSV, JSON or SARIF (for GitHub code scanning); the free preview shows the first findings and locks the copies and downloads.
Examples
resource "aws_security_group" "web" {
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}High · Network exposure · main.tf:2 — Security group opens SSH or RDP to the internet: ingress from 0.0.0.0/0 reaches 22 (SSH). Safer setting: remove 0.0.0.0/0 from port 22; use Session Manager or your VPN range. CIS AWS v5.0.0 5.3 · AWS Security Hub EC2.18, EC2.19, EC2.53
module "assets" {
source = "./modules/static-site"
public = var.public_assets # true in terraform.tfvars
}High · Public access · modules/static-site/main.tf:23 — module.assets.aws_s3_bucket_acl.this: the ACL public-read lets anyone on the internet read the objects.
The module call passes var.public_assets, which terraform.tfvars sets to true, so the ACL inside the module becomes public-read.
data "aws_iam_policy_document" "deploy" {
statement {
actions = ["*"]
resources = ["*"]
}
}
resource "aws_iam_policy" "deploy" {
name = "deploy"
policy = data.aws_iam_policy_document.deploy.json
}Critical · Identity and access — IAM policy allows every action on every resource. AWS Security Hub IAM.1 · CIS AWS v1.4.0 1.16
Common uses
- Check a pull request’s Terraform before it is applied, without installing a scanner.
- Review an inherited or vendor-supplied module for public buckets, open ports and admin roles.
- Prepare for an audit: list the CIS controls your infrastructure code passes and fails.
- Teach a team what each misconfiguration means, with the safer setting next to it.
What the benchmark mapping means
Each rule names the controls it checks, using the vendors’ own published mappings: the CIS AWS Foundations Benchmark (v5.0.0 or v3.0.0) and the AWS Security Hub controls it is mapped to by AWS, the CIS Microsoft Azure Foundations Benchmark v2.0.0 as Azure Policy maps it, and the CIS Google Cloud Platform Foundation Benchmark as Security Command Center maps it. The report lists every control a rule checked, with Pass or Fail for the resources in your files.
A Pass is about the code reviewed. Account-level settings made outside Terraform, organisation policies and resources in modules you did not include are not visible here.
How the score works
The score starts at 100 and loses 30 points for each critical finding (at most 60), 10 for each high (at most 40), 3 for each medium (at most 24) and 1 for each low (at most 10). Grades: A from 90, B from 75, C from 60, D from 40, F below. A critical finding limits the grade to C, and a high finding to B, so a configuration with a public database never looks fine because the rest of it is tidy.
Using the results in CI
- With a pass, download SARIF and upload it with the
github/codeql-action/upload-sarifaction: findings show up as code scanning alerts on the right lines, with their severity. Open the repository’s top folder (its .git folder is noticed, never read) and the file paths in the SARIF are relative to the repository, as code scanning expects. - The CSV download opens in any spreadsheet for triage; the JSON download has every field for scripts.
- Run
terraform plan -out plan.outandterraform show -json plan.outto review exactly what a run will create, with registry modules included.
Limitations
- It reads code, not live accounts: settings changed in the console, defaults of your organisation and what other tools create are not seen.
- Registry and Git modules are not downloaded: open their folders too, or review a plan JSON, which includes every module.
- Values only known after apply (an ARN, a variable without a default) are treated as unknown and never guessed, so a few findings depend on what you pass in at plan time.
- Severities are a guide: a public bucket that serves a website on purpose is fine; accept it with an ignore comment.
Privacy
On this device: nothing is sent
Your files are read and reviewed in your browser. Nothing you paste, open or drop is uploaded, and the page sends no requests about them.
Frequently asked questions
What do I get without a pass?
Without a pass, Terraform Configuration Review shows the score and every count (findings by severity and category), with the first findings, resources and benchmark controls of the report (up to 10 each). Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Is this like tfsec, Trivy or Checkov?
It covers the same ground for the most common misconfigurations, with each rule mapped to the CIS benchmarks and AWS Security Hub controls, and it runs in your browser, so there is nothing to install and nothing leaves your device. Those command-line scanners have more rules and run in pipelines; this review is the quick check, the readable report and the teaching tool.
Which files can I open?
Terraform files (.tf), Terraform JSON (.tf.json), variable files (.tfvars, .tfvars.json), plan or state JSON from terraform show -json, and JSON or template files that file() and templatefile() read. Folders and .zip archives are read with their sub-folders; .terraform and .git folders are skipped.
How do I accept a finding?
Add a comment with mysmartcopilot:ignore: and the rule id (shown on each finding) on the line above the resource or the argument, or at the end of that line: # mysmartcopilot:ignore:aws-s3-access-logging. Several ids can be separated by commas. In .tf.json, put it in a "//" member of the resource. Accepted findings are listed apart and do not count in the score.
Why does a finding say a setting “defaults to false”?
Many arguments are off unless you set them: for example every aws_s3_bucket_public_access_block setting, storage_encrypted of aws_db_instance and enable_key_rotation of aws_kms_key. The review uses the defaults the provider documents, so a missing argument counts as what Terraform would send.
Is my code uploaded?
No. The files are read by your browser and the review runs on your device; MySmartCoPilot never receives them.