terrascan

terrascan documentation

• Version in MegaLinter: 1.14.0
• Visit Official Web Site
• See How to configure terrascan rules
• See Index of problems detected by terrascan

Configuration in MegaLinter

• Enable terrascan by adding TERRAFORM_TERRASCAN in ENABLE_LINTERS variable
• Disable terrascan by adding TERRAFORM_TERRASCAN in DISABLE_LINTERS variable

Variable	Description	Default value
TERRAFORM_TERRASCAN_ARGUMENTS	User custom arguments to add in linter CLI call Ex: -s --foo "bar"
TERRAFORM_TERRASCAN_FILE_EXTENSIONS	Allowed file extensions. "*" matches any extension, "" matches empty extension. Empty list excludes all files Ex: [".py", ""]	[".tf"]
TERRAFORM_TERRASCAN_FILE_NAMES_REGEX	File name regex filters. Regular expression list for filtering files by their base names using regex full match. Empty list includes all files Ex: ["Dockerfile(-.+)?", "Jenkinsfile"]	Include every file
TERRAFORM_TERRASCAN_PRE_COMMANDS	List of bash commands to run before the linter	None
TERRAFORM_TERRASCAN_POST_COMMANDS	List of bash commands to run after the linter	None
TERRAFORM_TERRASCAN_CONFIG_FILE	terrascan configuration file name Use LINTER_DEFAULT to let the linter find it	terrascan-config.toml
TERRAFORM_TERRASCAN_RULES_PATH	Path where to find linter configuration file	Workspace folder, then MegaLinter default rules
TERRAFORM_TERRASCAN_DISABLE_ERRORS	Run linter but consider errors as warnings	false
TERRAFORM_TERRASCAN_DISABLE_ERRORS_IF_LESS_THAN	Maximum number of errors allowed	0

MegaLinter Flavours

This linter is available in the following flavours

	Flavor	Description	Embedded linters	Info
	all	Default MegaLinter Flavor	101
	security	Optimized for security	20
	terraform	Optimized for TERRAFORM based projects	48

Behind the scenes

How are identified applicable files

• File extensions: .tf

How the linting is performed

terrascan is called once on the whole project directory

• filtering can not be done using MegaLinter configuration variables,it must be done using terrascan configuration or ignore file (if existing)
• VALIDATE_ALL_CODEBASE: false does not make terrascan analyze only updated files

Example calls

terrascan scan -i terraform -t all -f myfile.tf

Help content

Terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
For more information, please visit https://docs.accurics.com

Usage:
  terrascan [command]

Available Commands:
  init        Initializes Terrascan and clones policies from the Terrascan GitHub repository.
  scan        Detect compliance and security violations across Infrastructure as Code.
  server      Run Terrascan as an API server
  version     Terrascan version

Flags:
  -c, --config-path string   config file path
  -l, --log-level string     log level (debug, info, warn, error, panic, fatal) (default "info")
  -x, --log-type string      log output type (console, json) (default "console")
  -o, --output string        output type (human, json, yaml, xml, junit-xml, sarif, github-sarif) (default "human")
      --temp-dir string      temporary directory path to download remote repository,module and templates

Use "terrascan [command] --help" for more information about a command.

Installation on mega-linter Docker image

• Dockerfile commands :

FROM tenable/terrascan:latest as terrascan
COPY --from=terrascan /go/bin/terrascan /usr/bin/