Terraform

What’s scanned

• *.tf files (resources, data sources, IAM, networking, storage, compute)
• Common insecure patterns (public buckets, open security groups, weak TLS policies, overly-permissive IAM)

How results are shown

• Findings appear as IaC issues under Sttor Code → IaC Security
• Each issue links to a rule ID and explains why it matters and how to fix

Recommended best practices

• Prefer least-privilege IAM
• Enforce encryption for storage/services that support it
• Lock down ingress/egress (no 0.0.0.0/0 unless explicitly required)