Static IaC security scanners analyse Terraform configurations before any resources are created, identifying security misconfigurations that would expose infrastructure to attack. While tflint catches semantic errors (invalid instance types, deprecated arguments), security scanners like Checkov and tfsec focus on security posture: public S3 buckets, unencrypted databases, permissive security groups, missing audit logging, and hundreds of other findings mapped to CIS Benchmarks, AWS Security Hub controls, SOC 2 compliance requirements and the MITRE ATT&CK framework. Running these tools in CI creates a security gate that prevents misconfigurations from ever reaching production infrastructure — catching a publicly readable S3 bucket in a PR review takes minutes to fix; discovering the same bucket after a data breach costs millions.
Checkov (by Bridgecrew, acquired by Palo Alto Networks) is the more comprehensive scanner, with over 1,000 built-in checks covering Terraform, CloudFormation, ARM templates, Kubernetes manifests, Dockerfiles, GitHub Actions workflows, and Ansible playbooks. tfsec (now part of Trivy, by Aqua Security) focuses specifically on Terraform and has excellent provider coverage. Both tools are open source, fast (seconds to scan hundreds of files), and integrate with major CI platforms. For organisations already using Prisma Cloud or Aqua Security, the respective tools have native integration with those platforms. The choice between Checkov and tfsec is often organisational rather than technical — both catch the most important security issues. Many mature security programmes run both, using their overlapping and complementary rule sets to maximise coverage.