# Terrascan | Detect Compliance And Security Violations!

**URL:** <https://onehack.st/t/terrascan-detect-compliance-and-security-violations/201891>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, freebies\
**Created:** [September 20, 2021, 9:48am UTC](https://onehack.st/t/terrascan-detect-compliance-and-security-violations/201891 "2021-09-20T09:48:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [September 20, 2021, 9:48am UTC](https://onehack.st/t/terrascan-detect-compliance-and-security-violations/201891/1 "2021-09-20T09:48:12Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/4/f496af815793f78da7b067af29294cc5e04dca9b.png)

# Terrascan

[![GitHub release](https://camo.githubusercontent.com/c4253e40a68a6b5253b98afc9f767b660cfce4e2c4c17ecfa907c40f01b74f17/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f61636375726963732f74657272617363616e)](https://github.com/accurics/terrascan/releases/latest) [![License: Apache 2.0](https://camo.githubusercontent.com/761c9e6f999fd87e8236882cdd659c01ab17d9d4bf14c0a79b59fc3c23dffae4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d417061636865253230322d626c7565)](https://github.com/accurics/terrascan/blob/master/LICENSE) [![PRs Welcome](https://camo.githubusercontent.com/b0ad703a46e8b249ef2a969ab95b2cb361a2866ecb8fe18495a2229f5847102d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5052732d77656c636f6d652d627269676874677265656e2e737667)](https://github.com/accurics/terrascan/pulls) [![CI](https://github.com/accurics/terrascan/workflows/build/badge.svg)](https://github.com/accurics/terrascan/workflows/build/badge.svg) [![codecov](https://camo.githubusercontent.com/f11337719717fa53000d4e8dfea4b46c7bd9bb251f41331a51004910e1c92de2/68747470733a2f2f636f6465636f762e696f2f67682f61636375726963732f74657272617363616e2f6272616e63682f6d61737465722f67726170682f62616467652e737667)](https://codecov.io/gh/accurics/terrascan) [![community](https://camo.githubusercontent.com/d751d2437722f2385e91878600781b44bf2d735e45f01fa35701f6d7324bc818/68747470733a2f2f696d672e736869656c64732e696f2f646973636f757273652f7374617475733f7365727665723d6874747073253341253246253246636f6d6d756e6974792e61636375726963732e636f6d)](https://community.accurics.com/) [![Documentation Status](https://camo.githubusercontent.com/43ba14733355d5d1d37b00eb3a018abf8f1375e8c86e185318b329ffe28e73ee/68747470733a2f2f72656164746865646f63732e636f6d2f70726f6a656374732f61636375726963732d74657272617363616e2f62616467652f3f76657273696f6e3d6c6174657374)](https://docs.accurics.com/projects/accurics-terrascan/en/latest/?badge=latest)

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

- GitHub Repo: [https://github.com/accurics/terrascan](https://github.com/accurics/terrascan)
- Documentation: [https://docs.accurics.com](https://docs.accurics.com/)
- Discuss: [https://community.accurics.com](https://community.accurics.com/)

## Features

- 500+ Policies for security best practices
- Scanning of Terraform 12+ (HCL2)
- Scanning of Kubernetes (JSON/YAML), Helm v3, and Kustomize v3
- Support for AWS, Azure, GCP, Kubernetes and GitHub

## Installing

Terrascan’s binary for your architecture can be found on the [releases](https://github.com/accurics/terrascan/releases) page. Here’s an example of how to install it:

```auto
$ curl --location https://github.com/accurics/terrascan/releases/download/v1.2.0/terrascan_1.2.0_Darwin_x86_64.tar.gz --output terrascan.tar.gz
$ tar -xvf terrascan.tar.gz
  x CHANGELOG.md
  x LICENSE
  x README.md
  x terrascan
$ install terrascan /usr/local/bin
$ terrascan

```

If you have go installed, Terrascan can be installed with `go get`

```auto
$ export GO111MODULE=on
$ go get -u github.com/accurics/terrascan/cmd/terrascan
  go: downloading github.com/accurics/terrascan v1.2.0
  go: found github.com/accurics/terrascan/cmd/terrascan in github.com/accurics/terrascan v1.2.0
  ...
$ terrascan

```

### Install via `brew`

[Homebrew](https://brew.sh/) users can install by:

`$ brew install terrascan`

### Docker

Terrascan is also available as a Docker image and can be used as follows

`$ docker run accurics/terrascan`

### Building Terrascan

Terrascan can be built locally. This is helpful if you want to be on the latest version or when developing Terrascan.

```auto
$ git clone git@github.com:accurics/terrascan.git
$ cd terrascan
$ make build
$ ./bin/terrascan

```

## Getting started

To scan your code for security issues you can run the following (defaults to scanning Terraform).

`$ terrascan scan`

Terrascan will exit 3 if any issues are found.

The following commands are available:

```auto
$ terrascan
Terrascan

An advanced IaC (Infrastructure-as-Code) file scanner written in Go.
Secure your cloud deployments at design time.
For more information, please visit https://www.accurics.com

Usage:
  terrascan [command]

Available Commands:
  help Help about any command
  init Initialize Terrascan
  scan Scan IaC (Infrastructure-as-Code) files for vulnerabilities.
  server Run Terrascan as an API server

Flags:
  -c, --config-path string config file path
  -h, --help help for terrascan
  -l, --log-level string log level (debug, info, warn, error, panic, fatal) (default "info")
  -x, --log-type string log output type (console, json) (default "console")
  -o, --output-type string output type (json, yaml, xml) (default "yaml")
  -v, --version version for terrascan

Use "terrascan [command] --help" for more information about a command.

```

## Documentation

To learn more about Terrascan check out the documentation [https://docs.accurics.com](https://docs.accurics.com/) where we include a getting started guide, Terrascan’s architecture, a breakdown of it’s commands, and a deep dive into policies.

## Developing Terrascan

To learn more about developing and contributing to Terrascan refer to the [contributing guide](https://github.com/accurics/terrascan/blob/master/CONTRIBUTING.md).

## License

Terrascan is licensed under the [Apache 2.0 License](https://github.com/accurics/terrascan/blob/master/LICENSE).

## GitHub:

> **[GitHub - tenable/terrascan: Detect compliance and security violations across...](https://github.com/tenable/terrascan)**
>
> Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.