IaC Security Checker

Review Terraform, CloudFormation or Bicep for public exposure, disabled encryption, missing logging, hard-coded secrets and over-broad identity, with the source line for each finding.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop a template

Terraform (.tf), CloudFormation (JSON or YAML) or Bicep. Parsed in your browser - never planned, applied or uploaded.

Or paste the template

Language

Misconfigurations before they are deployed

The checker reads Terraform HCL, CloudFormation in JSON or YAML (short-form tags such as !Ref included) and Bicep. It knows the common AWS, Azure and Google Cloud resources and looks for the misconfigurations behind most cloud incidents:

public exposure: public bucket ACLs and IAM members, missing public-access blocks, security groups, NSGs and firewalls open to the internet on management ports, publicly accessible databases, public Kubernetes API endpoints;
disabled encryption: storage, EBS and RDS encryption, old TLS versions, plain-HTTP listeners and apps;
missing logging and protection: CloudTrail validation and multi-region coverage, access logs, key rotation, Key Vault purge protection, deletion protection, backups, IMDSv2;
hard-coded secrets: credentials in provider blocks, AWS access keys, secret-named attributes with literal values, secret defaults, and parameters not marked sensitive, NoEcho or @secure();
over-broad identity: inline IAM policies, including jsonencode(...), run through the same analysis as the Cloud IAM Policy Analyzer, with privilege-escalation paths.

Every finding carries the source line it refers to.

Literal values only

Nothing is evaluated. A value that comes from a variable, local, module output or function call is unknown to a static reader, so it is never reported as wrong. Settings that are missing are judged by the provider's default. For the full picture after variables are resolved, run a policy tool against terraform show -json plan output in your pipeline.

Frequently asked questions

Does it run terraform or contact a cloud?

No. It never runs Terraform, downloads providers or modules, or calls a cloud API. The template is read as text in your browser.

Why does a missing setting count against me?

Because the default applies. For example, an RDS instance without storage_encrypted is created unencrypted, and an instance without metadata_options accepts IMDSv1.

Are modules followed?

No - only the file you provide. Check each module's source separately.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.