Your files stay on your device

IaC security checker

Scan pasted Terraform, CloudFormation, or Bicep templates in your browser for exposed resources, weak encryption, secrets, and over-broad identity.
infrastructure template text

Paste a template to scan it. Findings land in a table below with per-line sources.

This is a static pattern pass, not a linter and not a cloud audit: it matches rule shapes against template text, so it cannot see what your account actually allows, whether a variable holds a real secret at deploy time, or whether a variable-resolved CIDR is open. The Terraform and CloudFormation parsers are hand-written skeletons; unusual formatting can hide a resource, and parse notes above the table say what was skipped. Findings are a starting list, not a clean bill of health.
Options

More config file tools

- .env editor (/config/env)
- SSH config explainer (/config/ssh)
- Compose file visualizer (/config/docker-compose-visualizer)
All config file tools (/config)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/config/iac-security-checker
Markdown version: https://nutter.tools/config/iac-security-checker.md
Plain-text version: https://nutter.tools/config/iac-security-checker.txt
Agent index: https://nutter.tools/llms.txt