tfsec Integration with DefectDojo

tfsec Integration with DefectDojo

tfsec is an open source static analysis scanner for Terraform code, maintained by Aqua Security. It reads Terraform files and modules and flags configurations that create security risk, such as open security group rules, unencrypted storage, and overly permissive IAM policies, across AWS, Azure, Google Cloud, and other providers. tfsec can report in several formats, including JSON, which is the format DefectDojo imports. Aqua has announced that tfsec is now part of Trivy and encourages users to move to Trivy over time; tfsec remains available, but engineering attention is going to Trivy.

tfsec Integration with DefectDojo

We run tfsec on every Terraform change because a misconfigured network rule is much cheaper to fix in a pull request than in production. Sending tfsec results to DefectDojo gives those warnings a life beyond the CI log. Each failed check becomes a Finding on the Asset that owns the infrastructure, with the rule ID, file, and line, plus the fix tfsec recommends. When someone tightens a security group and the pipeline reruns, the reimport closes the Finding, and the audit trail shows when it happened.

Why tfsec Matters

Cloud breaches often start with configuration, not code. Infrastructure as code moves that configuration into files that can be checked before anything is deployed.

• tfsec runs locally and in CI with no cloud credentials, because it reads the Terraform source rather than live resources.
• It understands Terraform modules and variables, so it can evaluate the configuration a module actually produces.
• Each result names a rule ID, the provider, the file and line range, the impact, and a resolution, which is enough for an engineer to act on directly.
• On its own, tfsec output is per run. Nobody can tell from it which issues are new in this change and which have been accepted for months.

Advantages of This Integration

What we gained by routing tfsec results through DefectDojo:

• Stable deduplication. DefectDojo hashes tfsec Findings on severity, rule ID, file path, and line, so rerunning the scan on unchanged code does not create new Findings.
• Collapsed repeats. Within one report, results with the same provider, rule, file, and line range are merged into one Finding with an occurrence count.
• Reimport lifecycle. Reimporting into the same Test mitigates checks that now pass, adds new ones, and reactivates regressions.
• SLA tracking. tfsec severities, including the older ERROR and WARNING levels, map onto DefectDojo's scale, so IaC Findings follow the same SLAs as any other scanner.
• Risk acceptance with expiry. Some rules will not fit every environment. Accepting the risk in DefectDojo with an expiration date is easier to review than scattered ignore comments.

How This Integration Works

DefectDojo imports tfsec results with the TFSec Scan scan type. The parser expects a JSON document with a top-level results array, in either the current tfsec format (named rule IDs such as aws-vpc-no-public-egress-sgr) or the older one (rule IDs such as AWS007).

1. Produce a JSON report. From the root of your Terraform code:

tfsec . --format json --soft-fail > tfsec-report.json

--soft-fail keeps tfsec from returning a failing exit code when it finds problems, so the pipeline continues to the import step. Leave it off if you want the build to fail as well.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select TFSec Scan, and upload the file. For automation, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=TFSec Scan" \
  -F "file=@tfsec-report.json" \
  -F "product_name=platform-infra" \
  -F "engagement_name=Terraform CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can do the same with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "TFSec Scan" \
  --report-path "./tfsec-report.json" \
  --product-name "platform-infra" \
  --engagement-name "Terraform CI" \
  --auto-create-context

3. Reimport on each run. For a repository you scan on every merge, send later reports to /api/v2/reimport-scan/ against the same Test so fixed misconfigurations are closed automatically.

Data Granularity: What Gets Imported

Use Cases

In pull request pipelines: Each Terraform repository runs tfsec on every change and reimports into a Test named for the repository. Reviewers see new IaC Findings in DefectDojo, and a release gate can check the API for open High and Critical ones.

For a platform team that owns shared modules: A misconfiguration in a shared module shows up in every repository that uses it. With Findings in DefectDojo, the platform team can see the spread, fix the module once, and watch the reimports close the Findings across consumers.

During cloud security reviews: Reviewers can filter IaC Findings by rule ID or provider and see which ones are risk-accepted, with justification and an expiry date, instead of reading through code annotations.

While migrating to Trivy: Teams following Aqua's guidance to move from tfsec to Trivy can keep historical tfsec Findings in DefectDojo for comparison as Trivy results start arriving for the same Assets.

Operational Tips

• Rule IDs changed between tfsec versions (for example AWS007 became aws-vpc-no-public-egress-sgr). Because the rule ID is part of the hash, upgrading across that change will make existing Findings look new. Plan a single cleanup reimport when you upgrade.
• The line number is part of the hash too. Reformatting a file or adding lines above a resource shifts lines and can produce new Findings for the same issue; reimporting into one Test keeps the old ones from piling up as open.
• The parser skips only results with the older passed: true flag. Generate reports without passed checks so successes do not become Findings.
• Unrecognized severity values default to Low. If you use custom checks, give them standard tfsec severities.
• Tag imports with the repository and environment (for example tags=terraform,prod) so IaC Findings can be filtered apart from application results.
• Use minimum_severity to keep Low and Info rules out of the queue for teams that are just starting with IaC scanning.