tfsec

Judgement

What it is

Developer tool

What it does

A static security scanner for Terraform code that flags misconfigurations in AWS, Azure and Google Cloud resources.

Adopt it when

Only when an existing pipeline still calls tfsec; new setups should use Trivy, which absorbed its checks.

Watch out

It is superseded by Trivy and receives little further development.

Ready for

Usable

Runs as

Command line

Built with

Go and HCL

How established

Established: started 7 years ago, latest release v1.28.14.

What the license allows

You can build it into a product you sell, as long as you keep its copyright notice.

Judged on 2026-11-06 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: tfsec → Go → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to tfsec

1. 1
   Terraform hashicorp

   Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.

   Developer tool Production-ready Your team provisions infrastructure across one or more cloud providers and wants it reviewed and versioned as code with the largest provider ecosystem available.

   ★ 50k See repository Go Active, pushed today
   
2. 2
   Trivy aquasecurity

   Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

   Developer tool Production-ready You want one free scanner in CI that covers container images, dependencies and infrastructure code instead of several separate tools.

   ★ 39k Apache-2.0 Go Active, pushed today
3. 3
   OpenTofu opentofu

   OpenTofu lets you declaratively manage your cloud infrastructure.

   Developer tool Production-ready You want Terraform-style infrastructure management under an open-source licence, without HashiCorp's Business Source Licence.

   ★ 31k MPL-2.0 Go Active, pushed today
   
4. 4
   Kestra kestra-io

   Orchestrate everything, everywhere. The open-source control plane for workflows across data, infrastructure, business processes and AI agents. Declarative YAML, event-driven, any language, Git-versioned, scalable to millions of executions.

   Complete system Production-ready You need Airflow-class orchestration but want YAML flows, any language, and a UI non-Python people can use.

   ★ 30k Apache-2.0 Java Active, pushed today
5. 5
   Pulumi pulumi

   Pulumi - Infrastructure as Code in any programming language 🚀

   Developer tool Production-ready Your engineers would rather write infrastructure in a general-purpose language with loops, functions and tests than learn HCL.

   ★ 26k Apache-2.0 Go Active, pushed today
6. 6
   Salt saltstack

   Software to automate the management and configuration of infrastructure and applications at scale.

   Developer tool Production-ready You manage a large fleet of servers and need fast remote execution plus configuration management with an agent on each machine.

   ★ 16k Apache-2.0 Python Active, pushed today
7. 7
   AWS CDK aws

   The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code

   Framework or platform Production-ready Everything you run is on AWS and you want typed, reusable infrastructure code that stays inside CloudFormation's deployment model.

   ★ 13k Apache-2.0 TypeScript Active, pushed today
8. 8
   Encore encoredev

   Infrastructure orchestration from local to your cloud

   Framework or platform Usable You are starting a new backend and want infrastructure derived from application code instead of writing Terraform yourself.

   ★ 13k MPL-2.0 Go Active, pushed 2 days ago