DevOps Track · Day 6 Security Audits · 20 min

Security Scanning & Linting
DevOps Terraform Sprint — Day 6

Integrate tflint and checkov static analysis rules to catch provider version bugs and container security flaws before deployment

🛠️ Tooling: TFLint & Checkov Scanners🎭 Role: DevOps & Infrastructure Quality Engineer

TerraformSecurityCheckovTFLintStatic AnalysisPolicy as Code

About Today's 20-Minute Lab

Standard terraform validate only checks basic syntax, missing security vulnerabilities such as unpinned provider versions, privileged container execution, or missing encryption parameters. Today on Day 6, you will master Shift-Left Security using TFLint (linter) and Checkov (Policy-as-Code scanner) to catch flaws before code is committed or merged.

🎬

Day 6 Video WalkthroughComing Soon

An interactive 20-minute video walkthrough for Day 6 is currently in production. Follow the step-by-step interactive playbook below!

📦Sample Codebase & Working Solution (Day 6)Available Now

View on GitHub

The official reference codebase for Day 6 is hosted in the repository. Clone the repository and navigate to day-6-security-scanning to run the working solution.

Git Clone — Working Solution

git clone https://github.com/letstrnsfrm-ai/devops-terraform-roadmap.git
cd devops-terraform-roadmap/day-6-security-scanning

Static Linter Setup & Configuration (.tflint.hcl)

GOAL

Configure TFLint rules to enforce version pinning and unused declaration warnings.

INSTALLATION

Install static linter & security scanners for your operating system:

macOS — Homebrew / Curl Binary

# Install TFLint & Checkov via Homebrew or direct binary release
brew install tflint checkov

# Fallback direct TFLint binary download (if Homebrew tap is unavailable):
curl -sL -o /tmp/tflint.zip https://github.com/terraform-linters/tflint/releases/download/v0.55.0/tflint_darwin_arm64.zip
unzip -o /tmp/tflint.zip -d /tmp/tflint-bin && sudo cp /tmp/tflint-bin/tflint /usr/local/bin/

Linux — Bash Install Script / Pip

# Install TFLint via official install script
curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash

# Install Checkov via pip / pipx
pip3 install checkov

Windows — Chocolatey / Winget / PowerShell

# Install TFLint via Chocolatey or Winget
choco install tflint
# OR
winget install terraform-linters.tflint

# Install Checkov via Python pip
pip install checkov

TFLINT CONFIG

Create .tflint.hcl configuration:

HCL — .tflint.hcl

config {
  format = "compact"
  plugin_dir = "~/.tflint.d/plugins"
}

# Rule: Enforce module source version pinning
rule "terraform_module_pinned_source" {
  enabled = true
}

# Rule: Enforce provider version constraints
rule "terraform_required_version" {
  enabled = true
}

# Rule: Detect unused variable declarations
rule "terraform_unused_declarations" {
  enabled = true
}

LINT EXECUTION

Run TFLint against local HCL files:

Terminal — Execute TFLint Audit

# 1. Initialize TFLint plugins
tflint --init

# 2. Execute static linter checks
tflint

🏭Production Context & Enterprise Real-World Implementation

💡 Why We Are Doing This: Static code linting catches cloud-provider specific errors (such as invalid instance types or missing required tags) before running slow cloud plan commands.

🏢 Real-World Production Usecase: Fintech and healthcare organizations require mandatory pre-commit hooks running TFLint to prevent malformed infrastructure code from being pushed to Git.

⚙️ How Implemented in Production: TFLint is configured as a pre-commit Git hook (`pre-commit install`) and integrated into CI workflows to fail builds on rule violations.

Static Security Scanning with Checkov

GOAL

Scan HCL blueprints with Checkov to detect infrastructure security risks and policy violations.

CHECKOV COMMAND

Run Checkov static security analysis:

Terminal — Run Checkov Scanner

# Execute Checkov scan on current directory
checkov -d . --framework terraform

SAMPLE FINDINGS

Security Scan Results

Checkov audits resources against security benchmarks (e.g. CKV_DOCKER_1: Ensure container is not running as root user and CKV_TF_1: Ensure Terraform module sources are pinned).

🏭Production Context & Enterprise Real-World Implementation

💡 Why We Are Doing This: Policy-as-Code scanners automatically enforce organizational security policies (SOC2, HIPAA, PCI-DSS) across infrastructure code.

🏢 Real-World Production Usecase: Enterprises (like Stripe or Capital One) run Checkov to block Pull Requests containing unencrypted S3 buckets, open security groups (0.0.0.0/0), or missing audit logging.

⚙️ How Implemented in Production: Checkov runs automatically in CI/CD pipelines, outputting SARIF reports uploaded to GitHub Security Advisory dashboards.

Hardening HCL Blueprints

GOAL

Remediate security findings by hardening provider requirements and container security contexts.

HARDENED MAIN.TF

Update main.tf with pinned versions and non-root security context:

HCL — Hardened main.tf

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "3.0.2"
    }
  }
}

provider "docker" {}

resource "docker_image" "hardened_nginx" {
  name         = "nginx:alpine"
  keep_locally = false
}

resource "docker_container" "secure_app" {
  name  = "qe_secure_web_app"
  image = docker_image.hardened_nginx.image_id
  user  = "1001" # Non-root container user ID

  ports {
    internal = 80
    external = 8090
  }
}

🏭Production Context & Enterprise Real-World Implementation

💡 Why We Are Doing This: Enforcing non-root container users (`user = '1001'`) and explicit provider versions prevents container breakout vulnerabilities and supply chain attacks.

🏢 Real-World Production Usecase: Production Kubernetes and container environments require all container workloads to run under non-privileged security contexts.

⚙️ How Implemented in Production: Production Terraform blueprints specify security parameters (`read_only_root_filesystem = true`, `drop_capabilities = ['ALL']`) to satisfy Zero Trust architecture standards.

Security Gate Pass Verification

GOAL

Re-run security scanners to confirm 100% policy compliance before tear down.

RE-SCAN WORKFLOW

Run hardened verification:

Terminal — Re-run TFLint & Apply

# 1. Re-run TFLint (Expect 0 warnings)
tflint

# 2. Test local apply and cleanup
terraform init
terraform apply -auto-approve
curl -I http://localhost:8090
terraform destroy -auto-approve

EXPECTED OUTPUT

Verification Success

0 errors, 0 warnings returned by static security linter.
Hardened container deploys cleanly with non-root user execution context.

🏭Production Context & Enterprise Real-World Implementation

💡 Why We Are Doing This: Automated security verification guarantees that 100% of deployed infrastructure satisfies enterprise compliance policies without manual security review bottlenecks.

🏢 Real-World Production Usecase: DevSecOps teams rely on zero-warning security scan passes as mandatory PR merge requirements.

⚙️ How Implemented in Production: CI/CD pipelines evaluate Checkov exit codes (`--soft-fail=false`), automatically blocking PR merges if high-severity security findings remain unaddressed.