DefSec is a collection of Infrastructure-as-Code rules.

These rules as defined in Go (and potentially rego etc. in future too.)

Defining DefSec rules in this central repository means they can be used from various projects, regardless of the IaC implementation. For example, DefSec is currently used by both tfsec (for Terraform) and cfsec (CloudFormation). The same logic is applied to cloud resources defined in both source formats, but it is the job of the individual tool to translate the resource definitions for it's respective language to the shared DefSec format.

There's a detailed walkthrough for creating a new check in the tfsec contributing guide.

Please feel free to raise issues/discussions for anything else, or join us on Slack!.