For Terraform, the maintained open source choices are Checkov, Trivy and KICS. tfsec has been folded into Trivy, and Terrascan was archived by its owner on 20 November 2025. Add Conftest if you want to write your own policies in Rego. Snyk IaC is the commercial option in this group.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation, as of 19 October 2026.
Key takeaways
- Choose a scanner that reads your Terraform plan output, not only the HCL files, because plans resolve variables and modules.
- Checkov documents plan scanning. Trivy and KICS cover Terraform, and their pages we read do not mention plan files specifically.
- Do not start a new project on Terrascan, which is no longer maintained.
- Run the scan on pull requests and fail only on the severities you have agreed to fix.
Which Terraform security scanners are still maintained?
Checkov, Trivy, KICS and Conftest all have active documentation, and Snyk IaC is a supported commercial product. tfsec "is now part of Trivy" and its repository says it will remain available for the time being, with engineering attention directed at Trivy. Terrascan's repository states "This project is no longer maintained."
How do the tools compare?
| Tool | Type and license | Terraform coverage (per docs) | Other formats (per docs) | Custom policies |
|---|---|---|---|---|
| Checkov | Open source, Apache-2.0 | Terraform, Terraform plan, Terraform JSON, OpenTofu | CloudFormation, Kubernetes, Helm, Kustomize, Dockerfile, Bicep, ARM and CI workflow files | Python or YAML |
Trivy (trivy config) | Open source | Terraform, auto detected in a directory | CloudFormation, ARM, Helm, Dockerfile, Kubernetes | Rego custom checks |
| KICS | Open source, free, developed by Checkmarx | Terraform and OpenTofu | Over 20 types including Ansible, Pulumi, Bicep, Docker Compose and GitHub Workflows | See its queries docs |
| Conftest | Open source, Rego | Reads HCL and HCL2 | JSON, YAML, Dockerfile and many more | Rego, with deny, violation and warn rules |
| Snyk IaC | Commercial | Terraform | CloudFormation, Kubernetes, ARM | Not covered on the page we read |
| Terrascan | Archived, Apache 2.0 | Terraform HCL2 | CloudFormation, ARM, Kubernetes, Helm, Kustomize, Dockerfile | Not maintained |
Checkov says it ships more than 750 predefined policies and can check against standards such as CIS and the AWS Foundations Benchmark.
How do I scan a Terraform plan?
With Checkov, run terraform init, then terraform plan -out tf.plan, then terraform show -json tf.plan > tf.json, and scan with checkov -f tf.json. The README notes that because the JSON is a single line, findings report line number 0 unless you reformat it with jq.
Scanning a plan catches values that only exist after Terraform resolves modules and variables. Scanning source catches problems earlier and points at the right file and line. Many teams do both.
How do I choose a Terraform scanner?
- Does it parse your plan JSON as well as your HCL?
- Does it include rules for your cloud (AWS, Azure, GCP) and for CIS style benchmarks?
- Can you write a policy for your own rule, and in which language?
- Does it also cover Kubernetes, Helm and Dockerfiles, so one tool serves the whole repo?
- Can you suppress a finding with a recorded reason in the code?
- Does it produce SARIF or another format your pull request tooling reads?
- Is it actively maintained?
Where does Safeguard fit?
Safeguard offers a CLI and local runner that keeps source on your machine, IDE extensions for VS Code, JetBrains and Cursor, and an MCP server. Use it alongside a Terraform scanner for the dependency side of your repos: the free scan at gold.safeguard.sh/scan checks up to 100 dependencies in your browser with no login.
Frequently asked questions
Is tfsec still maintained?
Its repository says it is now part of Trivy and will stay available for the time being. New work is going into Trivy.
Is Terrascan still maintained?
No. The repository was archived on 20 November 2025 and accepts no further updates, issues or pull requests.
Does Checkov support OpenTofu?
Its README lists OpenTofu templates among the formats it scans.
Can I write my own Terraform rules?
Yes. Checkov uses Python or YAML, Trivy and Conftest use Rego.
Should IaC scanning block a merge?
Start by blocking only high and critical findings. Add stricter gates after you have cleaned the backlog.
Sources
- Checkov overview: https://www.checkov.io/1.Welcome/What%20is%20Checkov.html
- Checkov repository: https://github.com/bridgecrewio/checkov
- Trivy misconfiguration scanning: https://trivy.dev/latest/docs/scanner/misconfiguration/
- tfsec repository: https://github.com/aquasecurity/tfsec
- Terrascan repository: https://github.com/tenable/terrascan
- KICS docs: https://docs.kics.io/latest/
- Conftest: https://www.conftest.dev/
- Snyk IaC docs: https://docs.snyk.io/scan-with-snyk/snyk-iac
- Free dependency scan: https://gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
