IaC Security Checker
Paste Terraform or CloudFormation text and flag risky patterns like public buckets and open security groups.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
IaC Security Checker
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
Pasting a bucket with a public-read ACL and a security group open to 0.0.0.0/0 flags both as high-risk findings.
What this tool does not do / Limits
This tool only reads the code text you paste here. It never reads a cloud account, never applies changes, and cannot prove pasted code is safe. Never paste real production secrets; replace secret values with placeholders first.
Frequently asked questions
Does this tool check my live cloud account?
No. It only analyses the text you paste, and it never contacts any cloud provider.
Should I paste real secrets into it?
No. Never paste real production secrets. Replace secret values with placeholders before pasting anything here.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live