---
title: "Terraform"
date: "2021-02-18T04:11:54+00:00"
url: "https://staging.checkmarx.com/glossary/terraform/"
description: "Terraform is an IaC tool from HashiCorp. Learn what Terraform is, the top Terraform security risks, best practices, and developer examples - plus how to scan Terraform with Checkmarx IaC Security and KICS."
---

# Terraform

## What is Terraform?

**Terraform** is an infrastructure as code (IaC) tool that lets teams define, provision, and manage cloud and on‑prem resources using declarative configuration files. It relies on a human‑readable language (HCL), a broad provider ecosystem (AWS, Azure, GCP, and many more), and a **state** model to reconcile your desired infrastructure with what actually exists.

**Related on Checkmarx:** IaC Security ([https://checkmarx.com/product/iac-security/](https://checkmarx.com/product/iac-security/)), DevSecOps ([https://checkmarx.com/solutions/devsecops/](https://checkmarx.com/solutions/devsecops/)), CI/CD Security ([https://checkmarx.com/glossary/what-is-cicd-security/](https://checkmarx.com/learn/devsecops/what-is-cicd-security/))

## Why Terraform matters to AppSec and Platform teams

Terraform moves infrastructure changes into code review and CI/CD. That improves speed and consistency, but also increases the blast radius of **misconfigurations**—for example, public storage buckets, overly permissive security groups, weak IAM roles, or leaked secrets.
Treat Terraform code like application code: **scan early, enforce policy, and gate releases on risk.**

## How Terraform works (developer view)

1. **Write** HCL configuration (providers, resources, modules, variables).
2. **Plan** to preview changes against the current state.
3. **Apply** to converge actual resources to the desired configuration and update state.

Teams often add **policy as code** (OPA/Rego or Sentinel) to enforce guardrails for cost, compliance, and security before any change reaches production.

## Common Terraform security risks

- **State exposure:** Plans/state can contain identifiers and sometimes secrets.
- **Unverified modules/providers:** Unpinned versions or untrusted sources.
- **Overly permissive defaults:** Wide‑open security groups, public buckets, weak KMS/IAM policies.
- **No policy enforcement:** Missing OPA/Sentinel checks in PRs/pipelines.

## Terraform security best practices

### 1) Control state and secrets

Use encrypted **remote backends** with RBAC; never commit state; integrate a dedicated secrets manager; restrict workspace access.

### 2) Verify modules & providers

Pin versions, verify sources and checksums, and treat modules as third‑party code you review and approve.

### 3) Enforce policy as code

Add OPA/Rego or Sentinel rules to **fail fast** when configurations violate security or compliance requirements.

### 4) Scan IaC early & often

Shift left by scanning locally, in PRs, and in CI/CD with **[Checkmarx IaC Security](https://checkmarx.com/product/iac-security/)** (and open‑source **[KICS](https://checkmarx.com/product/kics/)**).

### 5) Integrate with CI/CD & the SDLC

Run scans as a quality gate; correlate findings, and fix in the IDE via **[Checkmarx One](https://checkmarx.com/product/application-security-platform/)**.

## FAQs

###         Is Terraform secure?

Yes – when you secure state, verify modules/providers, enforce policy as code (OPA/Sentinel), and scan continuously across local dev, PRs, and CI/CD.

###         How do I scan Terraform?

Use **KICS** locally and in CI; add **Checkmarx IaC Security** as a PR/pipeline gate to prevent risky merges and applies.

###         Where can I learn Terraform?

Start with the official Terraform docs and tutorials; then codify and enforce your org’s security baselines with policy as code.