rules-terraform

Hardcoding AWS access keys or secret keys in Terraform files is a critical security risk. Use environment variables (AWS_ACCESS_KEY_ID), a credentials file, or an IAM role instead.

Storing terraform.tfstate locally can lead to sensitive data exposure and state corruption in team environments. Ensure you are using a secure remote backend (e.g., S3, Azure Blob, Terraform Cloud) for production infrastructure.

Using a GitHub module source without pinning to a specific commit or tag (?ref=) can break your infrastructure if the module's main branch introduces breaking changes or is compromised.

terraform destroy will delete all managed infrastructure. This is irreversible for stateful resources (databases, S3 buckets). Verify the workspace and confirm this is intentional.

CloudTrail logging is disabled. Audit logging is required for compliance and incident response. Set enable_logging = true.

Hardcoded credentials in Terraform files are committed to version control. Use environment variables (AWS_ACCESS_KEY_ID), terraform.tfvars (git-ignored), or a secrets manager.

IAM policy grants all actions ('*'). This violates least-privilege. Enumerate only the specific actions your resource requires (e.g., ["s3:GetObject", "s3:PutObject"]).

IAM policy applies to all resources ('*'). Scope the policy to specific ARNs to prevent unintended access to other resources in the account.

Security group allows all inbound traffic from anywhere (0.0.0.0/0 on port 0). Restrict to specific CIDR ranges and necessary ports only.

Terraform is creating a public S3 bucket. All objects will be accessible to the internet. Use presigned URLs or CloudFront for controlled access.

RDS instance without deletion_protection = true. A terraform destroy or accidental apply could permanently delete your database. Set deletion_protection = true for production databases.

S3 bucket without versioning. Versioning protects against accidental deletion and overwrites. Add an aws_s3_bucket_versioning resource with status = 'Enabled' for important data.

Security group allows all outbound traffic. For sensitive workloads, restrict egress to only required destinations and ports to limit blast radius of a compromise.

Storage resource without encryption detected. Set storage_encrypted = true (RDS) or encrypted = true (EBS) to enable encryption at rest.