TFGaurd Docs

Introduction

TFGaurd is a comprehensive Terraform security policy checker that helps you identify and fix security vulnerabilities in your Infrastructure-as-Code before deployment. With 112+ Built-in Free Rules (Community Edition) and 1,200+ Enterprise Rules (Secure-Stream), TFGaurd helps your team maintain security best practices and compliance requirements automatically.

Quick Start

Get started with TFGaurd in seconds. Choose the installation method that fits your workflow.

Verify Installation

Once installed, run a local scan to verify the setup. No account or API key is required for basic AWS security checks.

How It Works

TFGaurd analyzes your Terraform HCL configuration through a multi-stage pipeline:

1. Parsing

Your Terraform code is parsed into a structured representation of resource blocks, identifying each resource "type" "name" block and its attributes.

2. Rule Evaluation

Each resource is evaluated against all applicable rules in the Rule Registry. Rules are organized by resource type (e.g., aws_s3_bucket, aws_db_instance).

# Example: This will trigger a violation
resource "aws_s3_bucket" "my_bucket"
{
  bucket = "my-data-bucket"
  acl    = "public-read" # ← CRITICAL: Public access
}

3. Violation Reporting

Any rule that a resource fails generates a violation with details including the resource name, rule violated, severity level, and a remediation recommendation.

4. Results & History

Results are displayed immediately and, for logged-in users, saved to your check history for tracking improvements over time.

Policy Rules

TFGaurd ships with built-in rules covering common AWS security misconfigurations.

Example Rules

Severity Levels

TFGaurd uses a 4-tier severity system to help you prioritize remediation efforts:

Supported Resource Types

TFGaurd currently supports 190+ Cloud Terraform resource types, including:

Custom Rules

Beyond the built-in rules, you can create custom rules tailored to your organization's requirements.

Form-Based Rules

Use the Rules Manager UI to create rules without writing code:

1. 1
   Select a Resource Type (e.g., aws_s3_bucket)
2. 2
   Choose a Condition (equals, not_equals, contains, etc.)
3. 3
   Set the Field and expected Value
4. 4
   Assign a Severity level and save

Code-Based Rules

For advanced scenarios, write rules as Python functions:

def check_resource(resource):
    """Ensure S3 buckets have versioning enabled."""
    versioning = resource.get('versioning', {})
    enabled = versioning.get('enabled', False)

    if not enabled:
        return 'S3 bucket versioning is not enabled'

    return None # None = passed

CI/CD Integration

Integrate TFGaurd into your automated pipelines in seconds. Our Portable CLI is the primary integration point, ensuring your source code never leaves your VPC.

name: TFGaurd Security Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install tfgaurd-engine
      - run: tfgaurd scan ./terraform/ --fail-on CRITICAL
        env:
          TFGAURD_API_KEY: ${{ secrets.TFGAURD_API_KEY }}