TFS tfSTRIDE

See security risks before you deploy.

STRIDE analysis for AWS, Azure, and GCP Terraform plans. The same evidence-backed engine as the CLI.

  • Deterministic analysis
  • No cloud credentials
  • No LLM dependency
See an example report

New analysis

Analyze a Terraform plan

JSON · Up to 10 MiB

How do I generate this file?

Run in your Terraform directory, then choose tfplan.json.

terraform plan -out tfplan
terraform show -json tfplan > tfplan.json

Plans are analyzed in temporary files on this server, then deleted. They are never retained or forwarded to third parties. No cloud API calls.

No plan handy? Try AWS Azure GCP demos

Built-in example · Report preview

ECS / Fargate

AWS
Findings
12
Trust boundaries
6
Observed control
1

Findings

Expand to inspect evidence
HIGH IAM role has privileged assignment posture aws_iam_role.task

aws-iam-privileged-role-assignment · Elevation of Privilege

  • iam roleaddress=aws_iam_role.task; type=aws_iam_role; arn=arn:aws:iam::111122223333:role/app-task-role; identifier=app-task-role
  • privileged accessgrant_1=categories=[secrets-admin]; scope=account; confidence=high
  • privilege categoriessecrets-admin
  • grant scopesscope_kind=account; scope_value=*
  • grant confidencehigh
  • inline policy sourcesinline_policy_name=task-data-access
MEDIUM IAM policy grants wildcard privileges aws_iam_role.task

aws-iam-wildcard-permissions · Elevation of Privilege

  • iam resources*
  • policy statementsAllow actions=[secretsmanager:GetSecretValue] resources=[*]
View all 12 findings
Trust boundary
Source
Internet
Relationship
internet-to-service
Destination
aws_lb.web

Observed control

RDS instance is private and storage encrypted

aws_db_instance.app
Analysis gaps & coverage 0 gaps reported
Unsupported resources
0
Unresolved references
0

Coverage is limited to modeled resources and operations. Review analysis scope.

Fixture: aws/sample_aws_ecs_fargate_plan.json