tfsec Integration with DefectDojo
tfsec is an open-source static analysis security scanner by Aqua Security that analyzes Terraform code to detect security misconfigurations, compliance violations, and policy breaches across major cloud providers including AWS, Azure, GCP, and Kubernetes by leveraging deep integration with the official HCL parser to identify risks before infrastructure changes take effect. The tool integrates seamlessly into local development workflows and CI/CD pipelines with IDE plugins for JetBrains, VSCode, and Vim, supporting custom check definitions through YAML/Rego policies and multiple output formats including JSON, SARIF, CSV, and JUnit to enable developers to detect and remediate security issues efficiently throughout the infrastructure as code development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from tfsec results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "tfsec",
"engagement": "<engagement-id>",
"file": "results.json"
}