Your files stay on your device

# IaC security checker

Scan pasted Terraform, CloudFormation, or Bicep templates in your browser for exposed resources, weak encryption, secrets, and over-broad identity.
infrastructure template text

Paste a template to scan it. Findings land in a table below with per-line sources.

This is a static pattern pass, not a linter and not a cloud audit: it matches rule shapes against template text, so it cannot see what your account actually allows, whether a variable holds a real secret at deploy time, or whether a variable-resolved CIDR is open. The Terraform and CloudFormation parsers are hand-written skeletons; unusual formatting can hide a resource, and parse notes above the table say what was skipped. Findings are a starting list, not a clean bill of health.
Options

## More config file tools

- [.env editor](/config/env)
- [SSH config explainer](/config/ssh)
- [Compose file visualizer](/config/docker-compose-visualizer)
[All config file tools](/config)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/config/iac-security-checker
Markdown version: https://nutter.tools/config/iac-security-checker.md
Plain-text version: https://nutter.tools/config/iac-security-checker.txt
Agent index: https://nutter.tools/llms.txt