[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADWT5YCZM136DXHKYYVW9M":3,"skill-same:01M6ADWT5YCZM136DXHKYYVW9M":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":73,"repositoryHtmlUrl":74,"repositoryHomepageUrl":75,"ownerHtmlUrl":76,"ownerBlogUrl":77,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M6ADWT5YCZM136DXHKYYVW9M","auditing-terraform-infrastructure-for-security",null,"Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA\u002FRego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-terraform-infrastructure-for-security\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"auditing terraform infrastructure for security","infrastructure","terraform","security","cloud","policy-as-code","tfsec","checkov","infrastructure-as-code","iam","encryption","cloud-security","code","opa","deployment","pr","cybersecurity","policy","2026-11-10 10:12:30",false,"---\nname: auditing-terraform-infrastructure-for-security\ndescription: 'Auditing Terraform infrastructure-as-code for security misconfigurations\n  using Checkov, tfsec, Terrascan, and OPA\u002FRego policies to detect overly permissive\n  IAM policies, public resource exposure, missing encryption, and insecure defaults\n  before cloud deployment.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- terraform\n- infrastructure-as-code\n- checkov\n- tfsec\n- policy-as-code\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1190\n- T1552.001\n- T1580\n---\n\n# Auditing Terraform Infrastructure for Security\n\n## When to Use\n\n- When integrating security scanning into CI\u002FCD pipelines for Terraform deployments\n- When reviewing Terraform plans and modules for security best practices before applying\n- When building policy-as-code guardrails for cloud infrastructure provisioning\n- When auditing existing Terraform state files to identify deployed misconfigurations\n- When enforcing organizational security standards across multiple Terraform projects\n\n**Do not use** for runtime security monitoring (use CSPM tools), for application security testing (use SAST\u002FDAST tools), or for cloud configuration drift detection (use AWS Config or Azure Policy after deployment).\n\n## Prerequisites\n\n- Checkov installed (`pip install checkov`)\n- tfsec installed (`brew install tfsec` or binary from GitHub)\n- Terrascan installed (`brew install terrascan`)\n- Terraform v1.0+ for plan generation\n- OPA (Open Policy Agent) for custom policy enforcement\n- Git repository with Terraform code to audit\n\n## Workflow\n\n### Step 1: Scan Terraform Code with Checkov\n\nRun Checkov for comprehensive IaC security scanning with built-in and custom policies.\n\n```bash\n# Scan a Terraform directory\ncheckov -d .\u002Fterraform\u002F --framework terraform\n\n# Scan with specific check categories\ncheckov -d .\u002Fterraform\u002F --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20,CKV_AWS_21\n\n# Scan and output results in JSON\ncheckov -d .\u002Fterraform\u002F --output json > checkov-results.json\n\n# Scan a Terraform plan file for more accurate analysis\nterraform init && terraform plan -out=tfplan\nterraform show -json tfplan > tfplan.json\ncheckov -f tfplan.json --framework terraform_plan\n\n# Skip specific checks with justification\ncheckov -d .\u002Fterraform\u002F --skip-check CKV_AWS_145 \\\n  --bc-api-key $BRIDGECREW_API_KEY\n\n# Scan Terraform modules\ncheckov -d .\u002Fmodules\u002F --framework terraform --compact\n\n# List all available checks\ncheckov --list --framework terraform | grep CKV_AWS\n```\n\n### Step 2: Scan with tfsec for Terraform-Specific Issues\n\nUse tfsec for Terraform-native security analysis with detailed remediation guidance.\n\n```bash\n# Scan a Terraform directory\ntfsec .\u002Fterraform\u002F\n\n# Scan with minimum severity threshold\ntfsec .\u002Fterraform\u002F --minimum-severity HIGH\n\n# Output in JSON for CI\u002FCD processing\ntfsec .\u002Fterraform\u002F --format json > tfsec-results.json\n\n# Scan with custom checks\ntfsec .\u002Fterraform\u002F --custom-check-dir .\u002Fcustom-checks\u002F\n\n# Exclude specific rules\ntfsec .\u002Fterraform\u002F --exclude-downloaded-modules \\\n  --exclude aws-s3-enable-bucket-logging\n\n# Scan and fail on specific severity\ntfsec .\u002Fterraform\u002F --minimum-severity CRITICAL --soft-fail\n\n# Generate SARIF output for GitHub Security tab\ntfsec .\u002Fterraform\u002F --format sarif > tfsec.sarif\n```\n\n### Step 3: Run Terrascan for Multi-Framework Compliance\n\nExecute Terrascan for compliance checking against CIS, NIST, and SOC 2 frameworks.\n\n```bash\n# Scan Terraform against CIS AWS benchmark\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --policy-type aws --verbose\n\n# Scan against specific compliance frameworks\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --policy-type aws \\\n  --categories \"Compliance Validation\"\n\n# Output in JSON\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --output json > terrascan-results.json\n\n# Scan a Terraform plan\nterrascan scan -t aws -i terraform \\\n  --iac-file tfplan.json \\\n  --iac-type tfplan\n\n# List available policies\nterrascan scan --list-policies -t aws\n```\n\n### Step 4: Create Custom OPA Policies for Organization Standards\n\nWrite Rego policies for organization-specific security requirements.\n\n```rego\n# policy\u002Faws_s3_encryption.rego\npackage terraform.aws.s3\n\ndeny[msg] {\n    resource := input.resource.aws_s3_bucket[name]\n    not resource.server_side_encryption_configuration\n    msg := sprintf(\"S3 bucket '%s' must have server-side encryption enabled\", [name])\n}\n\n# policy\u002Faws_iam_no_wildcards.rego\npackage terraform.aws.iam\n\ndeny[msg] {\n    resource := input.resource.aws_iam_policy[name]\n    statement := resource.policy.Statement[_]\n    statement.Action == \"*\"\n    statement.Effect == \"Allow\"\n    msg := sprintf(\"IAM policy '%s' must not use wildcard (*) actions\", [name])\n}\n\ndeny[msg] {\n    resource := input.resource.aws_iam_policy[name]\n    statement := resource.policy.Statement[_]\n    statement.Resource == \"*\"\n    statement.Effect == \"Allow\"\n    contains(statement.Action[_], \"*\")\n    msg := sprintf(\"IAM policy '%s' has overly permissive actions on wildcard resources\", [name])\n}\n\n# policy\u002Faws_no_public_ingress.rego\npackage terraform.aws.security_group\n\ndeny[msg] {\n    resource := input.resource.aws_security_group_rule[name]\n    resource.type == \"ingress\"\n    resource.cidr_blocks[_] == \"0.0.0.0\u002F0\"\n    resource.from_port \u003C= 22\n    resource.to_port >= 22\n    msg := sprintf(\"Security group rule '%s' allows SSH from 0.0.0.0\u002F0\", [name])\n}\n```\n\n```bash\n# Evaluate Terraform plan against OPA policies\nterraform show -json tfplan | opa eval \\\n  --data .\u002Fpolicy\u002F \\\n  --input \u002Fdev\u002Fstdin \\\n  \"data.terraform.aws\" \\\n  --format pretty\n\n# Run Conftest for easier OPA policy testing\nconftest test tfplan.json --policy .\u002Fpolicy\u002F --output json\n```\n\n### Step 5: Integrate Security Scanning into CI\u002FCD Pipeline\n\nAdd IaC security scanning as a mandatory CI\u002FCD gate.\n\n```yaml\n# GitHub Actions: Terraform security pipeline\nname: Terraform Security Scan\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n\njobs:\n  security-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Setup Terraform\n        uses: hashicorp\u002Fsetup-terraform@v3\n\n      - name: Terraform Init & Plan\n        run: |\n          cd terraform\u002F\n          terraform init\n          terraform plan -out=tfplan\n          terraform show -json tfplan > tfplan.json\n\n      - name: Checkov Scan\n        uses: bridgecrewio\u002Fcheckov-action@master\n        with:\n          directory: terraform\u002F\n          framework: terraform\n          output_format: sarif\n          output_file_path: checkov.sarif\n          soft_fail: false\n\n      - name: tfsec Scan\n        uses: aquasecurity\u002Ftfsec-action@v1.0.0\n        with:\n          working_directory: terraform\u002F\n          soft_fail: false\n\n      - name: Upload SARIF\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v2\n        with:\n          sarif_file: checkov.sarif\n\n      - name: OPA Policy Check\n        run: |\n          conftest test terraform\u002Ftfplan.json \\\n            --policy .\u002Fpolicy\u002F \\\n            --output json\n```\n\n### Step 6: Scan Terraform State for Deployed Misconfigurations\n\nAudit the current Terraform state to identify already-deployed security issues.\n\n```bash\n# Export current state as JSON\nterraform show -json > terraform-state.json\n\n# Scan the state with Checkov\ncheckov -f terraform-state.json --framework terraform_plan\n\n# Query state for specific security issues\nterraform state list | while read resource; do\n  terraform state show \"$resource\" 2>\u002Fdev\u002Fnull | grep -i \"public\\|0.0.0.0\\|encrypt.*false\\|password\"\ndone\n\n# Find resources without required tags\nterraform state list | grep aws_instance | while read resource; do\n  tags=$(terraform state show \"$resource\" | grep -A20 \"tags\")\n  if ! echo \"$tags\" | grep -q \"Environment\"; then\n    echo \"MISSING TAG: $resource lacks 'Environment' tag\"\n  fi\ndone\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Infrastructure as Code | Practice of managing cloud infrastructure through declarative configuration files (Terraform, CloudFormation) rather than manual console operations |\n| Policy as Code | Expressing security and compliance policies as executable code (Rego, Python) that can be automatically evaluated against infrastructure definitions |\n| Shift Left Security | Moving security checks earlier in the development lifecycle by scanning IaC before deployment rather than auditing after provisioning |\n| Terraform Plan | Preview of changes Terraform will make, which can be exported as JSON for security scanning before applying changes |\n| Checkov | Open-source static analysis tool for IaC supporting Terraform, CloudFormation, Kubernetes, and Docker with 1000+ built-in policies |\n| OPA\u002FRego | Open Policy Agent and its policy language Rego for defining custom security rules that evaluate against structured data inputs |\n\n## Tools & Systems\n\n- **Checkov**: Comprehensive IaC scanner with 1000+ policies for Terraform, CloudFormation, Kubernetes, ARM, and Dockerfile\n- **tfsec**: Terraform-specific static analysis tool with detailed remediation guidance and SARIF output\n- **Terrascan**: Multi-IaC scanner supporting compliance frameworks (CIS, NIST, SOC 2) with policy-as-code\n- **OPA\u002FConftest**: Custom policy engine for defining organization-specific security rules using Rego language\n- **Bridgecrew**: Commercial platform built on Checkov providing drift detection and supply chain security\n\n## Common Scenarios\n\n### Scenario: Adding Security Gates to an Existing Terraform CI\u002FCD Pipeline\n\n**Context**: A DevOps team deploys infrastructure via Terraform in GitHub Actions but has no security scanning. Recent audit findings show multiple S3 buckets without encryption and security groups allowing SSH from the internet.\n\n**Approach**:\n1. Add Checkov as the first security gate in the GitHub Actions workflow\n2. Run `checkov -d .\u002Fterraform\u002F` to establish the current baseline of findings\n3. Triage existing findings: fix CRITICAL issues, create tickets for HIGH, suppress accepted risks\n4. Add tfsec as a secondary scanner for Terraform-specific checks\n5. Write custom OPA policies for organization standards (required tags, naming conventions)\n6. Configure the pipeline to block PRs with CRITICAL or HIGH findings\n7. Generate SARIF reports for GitHub Security tab integration\n\n**Pitfalls**: Adding security scanning to an existing project will initially produce hundreds of findings. Implement gradually by starting with CRITICAL-only blocking, then expanding to HIGH. Use inline suppression comments (`#checkov:skip=CKV_AWS_18:Public bucket for static website`) for intentional exceptions with documented justification.\n\n## Output Format\n\n```\nTerraform Security Audit Report\n==================================\nRepository: acme-corp\u002Finfrastructure\nBranch: main\nScan Date: 2026-02-23\nTools: Checkov 3.x, tfsec 1.x, OPA custom policies\n\nSCAN RESULTS:\n  Checkov checks passed:    187\n  Checkov checks failed:     34\n  tfsec checks passed:      156\n  tfsec checks failed:       28\n  OPA custom policies:       12 passed, 3 failed\n\nCRITICAL FINDINGS:\n[TF-001] S3 Bucket Without Encryption\n  File: modules\u002Fstorage\u002Fmain.tf:24\n  Resource: aws_s3_bucket.data_lake\n  Check: CKV_AWS_19\n  Fix: Add server_side_encryption_configuration block\n\n[TF-002] Security Group Allows SSH from 0.0.0.0\u002F0\n  File: modules\u002Fnetwork\u002Fsecurity.tf:45\n  Resource: aws_security_group_rule.ssh_access\n  Check: CKV_AWS_24\n  Fix: Restrict cidr_blocks to bastion subnet\n\n[TF-003] IAM Policy with Wildcard Actions\n  File: modules\u002Fiam\u002Fpolicies.tf:12\n  Resource: aws_iam_policy.developer_policy\n  Check: CKV_AWS_1\n  Fix: Scope actions to specific services required\n\nSUMMARY BY SEVERITY:\n  Critical:  6 findings\n  High:     14 findings\n  Medium:   28 findings\n  Low:      18 findings\n  Info:     12 findings\n```\n","# Auditing Terraform Infrastructure for Security\n\n## When to Use\n\n- When integrating security scanning into CI\u002FCD pipelines for Terraform deployments\n- When reviewing Terraform plans and modules for security best practices before applying\n- When building policy-as-code guardrails for cloud infrastructure provisioning\n- When auditing existing Terraform state files to identify deployed misconfigurations\n- When enforcing organizational security standards across multiple Terraform projects\n\n**Do not use** for runtime security monitoring (use CSPM tools), for application security testing (use SAST\u002FDAST tools), or for cloud configuration drift detection (use AWS Config or Azure Policy after deployment).\n\n## Prerequisites\n\n- Checkov installed (`pip install checkov`)\n- tfsec installed (`brew install tfsec` or binary from GitHub)\n- Terrascan installed (`brew install terrascan`)\n- Terraform v1.0+ for plan generation\n- OPA (Open Policy Agent) for custom policy enforcement\n- Git repository with Terraform code to audit\n\n## Workflow\n\n### Step 1: Scan Terraform Code with Checkov\n\nRun Checkov for comprehensive IaC security scanning with built-in and custom policies.\n\n```bash\n# Scan a Terraform directory\ncheckov -d .\u002Fterraform\u002F --framework terraform\n\n# Scan with specific check categories\ncheckov -d .\u002Fterraform\u002F --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20,CKV_AWS_21\n\n# Scan and output results in JSON\ncheckov -d .\u002Fterraform\u002F --output json > checkov-results.json\n\n# Scan a Terraform plan file for more accurate analysis\nterraform init && terraform plan -out=tfplan\nterraform show -json tfplan > tfplan.json\ncheckov -f tfplan.json --framework terraform_plan\n\n# Skip specific checks with justification\ncheckov -d .\u002Fterraform\u002F --skip-check CKV_AWS_145 \\\n  --bc-api-key $BRIDGECREW_API_KEY\n\n# Scan Terraform modules\ncheckov -d .\u002Fmodules\u002F --framework terraform --compact\n\n# List all available checks\ncheckov --list --framework terraform | grep CKV_AWS\n```\n\n### Step 2: Scan with tfsec for Terraform-Specific Issues\n\nUse tfsec for Terraform-native security analysis with detailed remediation guidance.\n\n```bash\n# Scan a Terraform directory\ntfsec .\u002Fterraform\u002F\n\n# Scan with minimum severity threshold\ntfsec .\u002Fterraform\u002F --minimum-severity HIGH\n\n# Output in JSON for CI\u002FCD processing\ntfsec .\u002Fterraform\u002F --format json > tfsec-results.json\n\n# Scan with custom checks\ntfsec .\u002Fterraform\u002F --custom-check-dir .\u002Fcustom-checks\u002F\n\n# Exclude specific rules\ntfsec .\u002Fterraform\u002F --exclude-downloaded-modules \\\n  --exclude aws-s3-enable-bucket-logging\n\n# Scan and fail on specific severity\ntfsec .\u002Fterraform\u002F --minimum-severity CRITICAL --soft-fail\n\n# Generate SARIF output for GitHub Security tab\ntfsec .\u002Fterraform\u002F --format sarif > tfsec.sarif\n```\n\n### Step 3: Run Terrascan for Multi-Framework Compliance\n\nExecute Terrascan for compliance checking against CIS, NIST, and SOC 2 frameworks.\n\n```bash\n# Scan Terraform against CIS AWS benchmark\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --policy-type aws --verbose\n\n# Scan against specific compliance frameworks\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --policy-type aws \\\n  --categories \"Compliance Validation\"\n\n# Output in JSON\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --output json > terrascan-results.json\n\n# Scan a Terraform plan\nterrascan scan -t aws -i terraform \\\n  --iac-file tfplan.json \\\n  --iac-type tfplan\n\n# List available policies\nterrascan scan --list-policies -t aws\n```\n\n### Step 4: Create Custom OPA Policies for Organization Standards\n\nWrite Rego policies for organization-specific security requirements.\n\n```rego\n# policy\u002Faws_s3_encryption.rego\npackage terraform.aws.s3\n\ndeny[msg] {\n    resource := input.resource.aws_s3_bucket[name]\n    not resource.server_side_encryption_configuration\n    msg := sprintf(\"S3 bucket '%s' must have server-side encryption enabled\", [name])\n}\n\n# policy\u002Faws_iam_no_wildcards.rego\npackage terraform.aws.iam\n\ndeny[msg] {\n    resource := input.resource.aws_iam_policy[name]\n    statement := resource.policy.Statement[_]\n    statement.Action == \"*\"\n    statement.Effect == \"Allow\"\n    msg := sprintf(\"IAM policy '%s' must not use wildcard (*) actions\", [name])\n}\n\ndeny[msg] {\n    resource := input.resource.aws_iam_policy[name]\n    statement := resource.policy.Statement[_]\n    statement.Resource == \"*\"\n    statement.Effect == \"Allow\"\n    contains(statement.Action[_], \"*\")\n    msg := sprintf(\"IAM policy '%s' has overly permissive actions on wildcard resources\", [name])\n}\n\n# policy\u002Faws_no_public_ingress.rego\npackage terraform.aws.security_group\n\ndeny[msg] {\n    resource := input.resource.aws_security_group_rule[name]\n    resource.type == \"ingress\"\n    resource.cidr_blocks[_] == \"0.0.0.0\u002F0\"\n    resource.from_port \u003C= 22\n    resource.to_port >= 22\n    msg := sprintf(\"Security group rule '%s' allows SSH from 0.0.0.0\u002F0\", [name])\n}\n```\n\n```bash\n# Evaluate Terraform plan against OPA policies\nterraform show -json tfplan | opa eval \\\n  --data .\u002Fpolicy\u002F \\\n  --input \u002Fdev\u002Fstdin \\\n  \"data.terraform.aws\" \\\n  --format pretty\n\n# Run Conftest for easier OPA policy testing\nconftest test tfplan.json --policy .\u002Fpolicy\u002F --output json\n```\n\n### Step 5: Integrate Security Scanning into CI\u002FCD Pipeline\n\nAdd IaC security scanning as a mandatory CI\u002FCD gate.\n\n```yaml\n# GitHub Actions: Terraform security pipeline\nname: Terraform Security Scan\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n\njobs:\n  security-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Setup Terraform\n        uses: hashicorp\u002Fsetup-terraform@v3\n\n      - name: Terraform Init & Plan\n        run: |\n          cd terraform\u002F\n          terraform init\n          terraform plan -out=tfplan\n          terraform show -json tfplan > tfplan.json\n\n      - name: Checkov Scan\n        uses: bridgecrewio\u002Fcheckov-action@master\n        with:\n          directory: terraform\u002F\n          framework: terraform\n          output_format: sarif\n          output_file_path: checkov.sarif\n          soft_fail: false\n\n      - name: tfsec Scan\n        uses: aquasecurity\u002Ftfsec-action@v1.0.0\n        with:\n          working_directory: terraform\u002F\n          soft_fail: false\n\n      - name: Upload SARIF\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v2\n        with:\n          sarif_file: checkov.sarif\n\n      - name: OPA Policy Check\n        run: |\n          conftest test terraform\u002Ftfplan.json \\\n            --policy .\u002Fpolicy\u002F \\\n            --output json\n```\n\n### Step 6: Scan Terraform State for Deployed Misconfigurations\n\nAudit the current Terraform state to identify already-deployed security issues.\n\n```bash\n# Export current state as JSON\nterraform show -json > terraform-state.json\n\n# Scan the state with Checkov\ncheckov -f terraform-state.json --framework terraform_plan\n\n# Query state for specific security issues\nterraform state list | while read resource; do\n  terraform state show \"$resource\" 2>\u002Fdev\u002Fnull | grep -i \"public\\|0.0.0.0\\|encrypt.*false\\|password\"\ndone\n\n# Find resources without required tags\nterraform state list | grep aws_instance | while read resource; do\n  tags=$(terraform state show \"$resource\" | grep -A20 \"tags\")\n  if ! echo \"$tags\" | grep -q \"Environment\"; then\n    echo \"MISSING TAG: $resource lacks 'Environment' tag\"\n  fi\ndone\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Infrastructure as Code | Practice of managing cloud infrastructure through declarative configuration files (Terraform, CloudFormation) rather than manual console operations |\n| Policy as Code | Expressing security and compliance policies as executable code (Rego, Python) that can be automatically evaluated against infrastructure definitions |\n| Shift Left Security | Moving security checks earlier in the development lifecycle by scanning IaC before deployment rather than auditing after provisioning |\n| Terraform Plan | Preview of changes Terraform will make, which can be exported as JSON for security scanning before applying changes |\n| Checkov | Open-source static analysis tool for IaC supporting Terraform, CloudFormation, Kubernetes, and Docker with 1000+ built-in policies |\n| OPA\u002FRego | Open Policy Agent and its policy language Rego for defining custom security rules that evaluate against structured data inputs |\n\n## Tools & Systems\n\n- **Checkov**: Comprehensive IaC scanner with 1000+ policies for Terraform, CloudFormation, Kubernetes, ARM, and Dockerfile\n- **tfsec**: Terraform-specific static analysis tool with detailed remediation guidance and SARIF output\n- **Terrascan**: Multi-IaC scanner supporting compliance frameworks (CIS, NIST, SOC 2) with policy-as-code\n- **OPA\u002FConftest**: Custom policy engine for defining organization-specific security rules using Rego language\n- **Bridgecrew**: Commercial platform built on Checkov providing drift detection and supply chain security\n\n## Common Scenarios\n\n### Scenario: Adding Security Gates to an Existing Terraform CI\u002FCD Pipeline\n\n**Context**: A DevOps team deploys infrastructure via Terraform in GitHub Actions but has no security scanning. Recent audit findings show multiple S3 buckets without encryption and security groups allowing SSH from the internet.\n\n**Approach**:\n1. Add Checkov as the first security gate in the GitHub Actions workflow\n2. Run `checkov -d .\u002Fterraform\u002F` to establish the current baseline of findings\n3. Triage existing findings: fix CRITICAL issues, create tickets for HIGH, suppress accepted risks\n4. Add tfsec as a secondary scanner for Terraform-specific checks\n5. Write custom OPA policies for organization standards (required tags, naming conventions)\n6. Configure the pipeline to block PRs with CRITICAL or HIGH findings\n7. Generate SARIF reports for GitHub Security tab integration\n\n**Pitfalls**: Adding security scanning to an existing project will initially produce hundreds of findings. Implement gradually by starting with CRITICAL-only blocking, then expanding to HIGH. Use inline suppression comments (`#checkov:skip=CKV_AWS_18:Public bucket for static website`) for intentional exceptions with documented justification.\n\n## Output Format\n\n```\nTerraform Security Audit Report\n==================================\nRepository: acme-corp\u002Finfrastructure\nBranch: main\nScan Date: 2026-02-23\nTools: Checkov 3.x, tfsec 1.x, OPA custom policies\n\nSCAN RESULTS:\n  Checkov checks passed:    187\n  Checkov checks failed:     34\n  tfsec checks passed:      156\n  tfsec checks failed:       28\n  OPA custom policies:       12 passed, 3 failed\n\nCRITICAL FINDINGS:\n[TF-001] S3 Bucket Without Encryption\n  File: modules\u002Fstorage\u002Fmain.tf:24\n  Resource: aws_s3_bucket.data_lake\n  Check: CKV_AWS_19\n  Fix: Add server_side_encryption_configuration block\n\n[TF-002] Security Group Allows SSH from 0.0.0.0\u002F0\n  File: modules\u002Fnetwork\u002Fsecurity.tf:45\n  Resource: aws_security_group_rule.ssh_access\n  Check: CKV_AWS_24\n  Fix: Restrict cidr_blocks to bastion subnet\n\n[TF-003] IAM Policy with Wildcard Actions\n  File: modules\u002Fiam\u002Fpolicies.tf:12\n  Resource: aws_iam_policy.developer_policy\n  Check: CKV_AWS_1\n  Fix: Scope actions to specific services required\n\nSUMMARY BY SEVERITY:\n  Critical:  6 findings\n  High:     14 findings\n  Medium:   28 findings\n  Low:      18 findings\n  Info:     12 findings\n```\n",{"name":5,"tags":55,"author":56,"domain":48,"license":15,"version":57,"nist_csf":58,"subdomain":43,"description":63,"mitre_attack":64},[43,34,40,39,38,37],"mahipal","1.0",[59,60,61,62],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA\u002FRego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.\n",[65,66,67,68,69],"T1078.004","T1530","T1190","T1552.001","T1580","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fauditing-terraform-infrastructure-for-security",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-terraform-infrastructure-for-security",{"tool":86,"command":87},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-terraform-infrastructure-for-security",{"tool":89,"command":90},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-terraform-infrastructure-for-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-terraform-infrastructure-for-security\u002FSKILL.md",true,[94,99,105],{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-terraform-infrastructure-for-security\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1856,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-terraform-infrastructure-for-security\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fagent.py","SCRIPT","脚本",7125,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-terraform-infrastructure-for-security\u002Fscripts\u002Fagent.py",[112,136,159,186,212,239],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":119,"publishedAt":50},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[118],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[120,121,122,123,35,48,124,125,47,44,126,127,128,129,130,131,132,133,134,135],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":50},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[142],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[144,132,145,146,35,49,48,47,147,148,149,150,151,152,153,154,155,156,157,158],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":169,"publishedAt":50},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[165,168],{"categoryNo":166,"categoryName":167,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[153,170,171,172,173,48,33,174,147,175,176,177,178,179,180,181,182,183,184,185],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":50},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,48,197,198,199,200,201,202,203,204,205,206,207,208,150,209,210,211],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":50},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[218],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,48,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":50},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[245],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[35,247,48,248,249,250,251,252,253,254,255,181,256,182,257,258,259,260,261,262],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]