Terraform Security — tfsec, Checkov, and Sentinel Vocabulary
Learn vocabulary for Terraform security scanning: tfsec, Checkov, and Sentinel policies.
0 / 10 completed
1 / 10
What is tfsec?
tfsec is a static analysis tool that scans Terraform configuration files for security misconfigurations (e.g., S3 buckets without encryption, security groups open to the world).
2 / 10
What is Checkov in IaC security?
Checkov scans IaC files (Terraform, CloudFormation, Kubernetes YAML, etc.) for security and compliance violations using built-in rules and custom policies.
3 / 10
What is HashiCorp Sentinel?
Sentinel is HashiCorp's policy-as-code framework for Terraform Cloud and Enterprise. It allows organisations to enforce governance policies (e.g., 'no internet-facing resources without approval') as code.
4 / 10
What is 'least privilege' in Terraform provider configuration?
Least privilege means the IAM user/role used by Terraform has only the specific permissions needed to manage the resources it controls — reducing the blast radius of credential compromise.
5 / 10
What does 'sensitive = true' on a Terraform variable or output do?
sensitive = true prevents the value from being shown in terraform plan and apply output. Note: it is still stored in state (potentially in plaintext), so state should be encrypted separately.
6 / 10
Review Comment: 'I'm seeing a lot of exposed API keys in the output of this module. tfsec is flagging them as high risk. What's the best way to address this proactively?'
The reviewer is rightly concerned about exposed sensitive data. While removing the keys is a temporary fix, it doesn't address the root cause – insecure configuration. Using KMS and environment variables are best practices for managing and protecting credentials in IaC, so option A is the most appropriate response. Running `tfsec analyze` will highlight these risks.
7 / 10
Slack Message: '@john_doe, Checkov just reported a missing policy enforcement for IAM role creation. We need to ensure we're using the correct resource policies and that they're properly defined in our Sentinel configuration.'
Checkov's core function is policy enforcement – it identifies deviations from configured rules. The message highlights a critical issue: the lack of defined policies for IAM roles. While reducing resource count is good hygiene, the immediate priority is to align Sentinel with proper IAM role configuration practices.
8 / 10
PR Description: 'Adding a new module for deploying our database. This module uses Terraform's outputs to expose the database endpoint URL. We've marked this output as sensitive = true to prevent accidental exposure.'
'Sensitive = true' is a crucial mechanism, but it doesn't fully encrypt the value. It primarily instructs Terraform not to include this output in the state file and to handle it with extra care – typically, it will be encrypted when accessed via the state. This prevents accidental exposure during state management or sharing.
9 / 10
Standup Update: 'I'm working on improving our Terraform security posture by integrating Sentinel into our CI/CD pipeline. We're focusing on using resource policies to enforce the principle of least privilege across all infrastructure.'
'Least Privilege' is a foundational security principle. It's about granting the *minimum* necessary permissions to each resource – not a blanket approach. This significantly reduces the blast radius if an account or service is compromised. Sentinel helps enforce this by defining and validating resource policies.
10 / 10
Code Review Comment: 'The module uses the AWS S3 provider with a default bucket name. This exposes our data to potential public access if not properly configured. Can we ensure this bucket has restricted access and is using KMS for encryption?'
Default values can introduce significant vulnerabilities – they often bypass best practices. In this case, a publicly accessible S3 bucket poses a serious risk. KMS encryption adds an extra layer of protection but doesn't eliminate the need for proper access controls and configuration. The module author has responsibility, but this comment is a helpful check on their work.
What does this Terraform Operations exercise cover?
This exercise, "Terraform Security — tfsec, Checkov, and Sentinel Vocabulary", tests your understanding of terraform operations vocabulary and phrasing through 10 multiple-choice questions drawn from real workplace scenarios.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 10 questions. Each one presents a realistic sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Who is this Terraform Operations exercise for?
It's designed for IT professionals and learners who want to sound natural discussing terraform operations topics in English — useful for meetings, documentation, interviews, and day-to-day communication with English-speaking teams.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more Terraform Operations exercises?
Browse the full Terraform Operations exercises hub for more practice, or explore other exercise categories covering vocabulary, grammar, interviews, and workplace communication.