tfsec mit Homebrew, chocolatey, MacPorts, Nix, scoop installieren

Projektlinks

• Homepage
• Repository
• Upstream-Dokumentation
• Paketmanager-Seite

Befehle und Aliase

• tfsec

Projektgeschichte

The project grew around Terraform-specific static analysis: scanning local and remote modules, evaluating HCL expressions and Terraform functions, checking relationships between Terraform resources, supporting Terraform CDK, and allowing user-defined Rego policies.

Aqua's tfsec-to-Trivy migration material frames tfsec as one of the foundations of Trivy's infrastructure-as-code and misconfiguration scanning support. The migration guide maps common tfsec commands to Trivy equivalents, such as replacing `tfsec <dir>` with `trivy config <dir>`.

Adoptionsgeschichte

The official README documents package-manager and binary distribution through Homebrew/Linuxbrew, Chocolatey, Scoop, Go install, release binaries, and Docker images. The input metadata also records Homebrew, Chocolatey, MacPorts, Nix, and Scoop packaging.

The README cites Thoughtworks Tech Radar's Adopt rating and describes tfsec as a default static-analysis tool for Terraform in Thoughtworks projects. Aqua's 2023 announcement shows the adoption inflection point: the Terraform scanning engine moved into the wider Trivy product and community path while tfsec stayed available.

Wie es verwendet wird

The usual package-nerd workflow was `brew install tfsec` followed by `tfsec .` in a Terraform repository. The tool exits non-zero when it finds problems, which made it natural for CI gates.

tfsec supported machine-readable output such as JSON, SARIF, CSV, Checkstyle, and JUnit, plus GitHub Security Alerts via SARIF upload. It also supported inline ignore comments such as `tfsec:ignore:<rule>`, expiry dates for ignores, tfvars input, custom checks under `.tfsec`, and a root `.tfsec/config.json` or `.tfsec/config.yml` config file.

Warum Paket-Nerds sich dafür interessieren

For Homebrew and other package-manager users, tfsec was a compact example of an IaC security tool that could be installed as a single CLI and dropped into editors, hooks, and CI without a service dependency.

Its later migration into Trivy is significant for package catalogs because it marks a common lifecycle for niche security CLIs: first a focused Terraform scanner, then an engine folded into a broader multi-surface scanner while the old binary remains packaged for existing automation.

Zeitleiste

• 2023-02-18: Aqua announced that tfsec was joining the Trivy family and encouraged the community to transition to Trivy.
• 2024-2025: The GitHub releases page shows continuing tfsec maintenance releases in the v1.28 series, including v1.28.14 on 2025-05-02.
• 2026: The input metadata still records tfsec in multiple package managers, including Homebrew, Chocolatey, MacPorts, Nix, and Scoop.

Related projects

• Trivy is the successor path recommended by Aqua for Terraform and broader misconfiguration scanning.
• The README links related tfsec integrations including tfsec-pr-commenter-action, tfsec-sarif-action, the official Azure DevOps task, and editor plugins for JetBrains, VS Code, and Vim.

Quellen

• https://aquasecurity.github.io/tfsec/v0.63.1/getting-started/configuration/config/
• https://github.com/aquasecurity/tfsec README
• https://github.com/aquasecurity/tfsec/blob/master/tfsec-to-trivy-migration-guide.md
• https://github.com/aquasecurity/tfsec/discussions/1994
• source_facts.package-manager