Last Updated: November 21, 2025
Components
| Tool | Role |
|---|---|
tfsec
|
Static analysis |
Sentinel
|
Policy guards |
Driftctl
|
Detect drift |
Commands
tfsec .
Lint configs
sentinel test
Run policies
driftctl diff
Compare state
Guidance
Automate across branches, integrate with PRs, and document risk acceptances.
💡 Pro Tip:
Run scanners in CI, fail on high severity, and review exemptions.