Scan Terraform twice: the configuration files in the pull request, and the machine readable plan right before apply. The files show what you wrote, quickly and without credentials. The plan shows what Terraform will actually create once variables, modules and providers are resolved.
Two inputs, two views
| Input | What it shows | Good for |
|---|---|---|
| HCL source files | Resources as written | Fast feedback in review, no credentials needed |
| Plan JSON | Resolved values and planned changes | Catching values that only exist after evaluation |
Terraform can emit a plan as JSON with its show command in JSON mode. That output represents the plan, the configuration and the current state, and needs Terraform 0.12 or later.
Steps
- Run the scanner on the source files in every pull request. Fail the check on high severity misconfigurations such as public storage, open security groups or unencrypted volumes.
- Run a plan in CI and save it as a file.
- Convert the plan to JSON and scan that too, where your scanner supports it.
- Require a human approval for the apply step on production.
- Keep the scan output as a build artifact so reviewers can see it later.
Handle plan JSON with care
HashiCorp's documentation warns that in JSON output, sensitive values from state appear in plain text. Because a plan's JSON includes the current state, treat the file as sensitive: do not post it to a public log, do not upload it to a shared place without access control, and delete it after the job.
What these scans do not do
They check configuration, not the running cloud. Console edits made outside Terraform are drift, and they need a separate check. They also cannot judge intent: a public bucket may be deliberate. Use an exception list with a reason and an expiry date instead of switching rules off.
Pin what you scan
Pin module versions so the code you scanned is the code you apply. See pinning Terraform module sources.
How Safeguard helps
Safeguard covers SBOM and dependency scanning, reachability analysis, and policies and gates that apply in pull requests. The free scan is a quick way to see your dependency findings.
Quick check
Is scanning the .tf files enough?
It catches most obvious problems early. Scanning the plan adds values that only resolve at plan time, so use both when you can.
Is a plan file safe to share?
Treat it as sensitive. Its JSON form can include sensitive state values in plain text.
Sources
- HashiCorp Terraform CLI documentation, terraform show (fetched 19 October 2026).
Last reviewed: 19 October 2026.
