IaC Security Auditor

About

Act as an automated security scanner and compliance officer to safeguard your infrastructure as code. This skill analyzes Terraform plans using industry-standard tools like tfsec and checkov to identify critical vulnerabilities, such as unencrypted data stores or overly permissive security groups. Beyond security, it enforces organizational compliance by verifying resource tags, regional restrictions, and least-privilege IAM roles. Every audit concludes with a detailed report and a definitive verdict, ensuring that only infrastructure meeting your highest safety and policy standards is approved for deployment.

Key Features

• Comprehensive compliance checks for resource tagging and naming conventions
• Automated security scanning using tfsec and checkov integration
• Strict network and S3 bucket security policy enforcement
• Detailed risk assessments with severity ratings and remediation steps
• 4 GitHub stars
• Binary approval workflow based on critical and high-severity findings

Use Cases

• Verifying Terraform plans for security vulnerabilities before merging pull requests
• Ensuring all cloud resources meet organizational tagging and encryption standards
• Auditing network configurations to prevent accidental exposure of sensitive ports to the internet