TerraWatch catches Terraform misconfigurations before they hit AWS, blocks the merge, and posts the exact fix — all inside GitHub.
No YAML. No agents. No config files. Install the GitHub App and push.
Any pull request touching .tf files triggers TerraWatch automatically via GitHub webhooks. No opt-in, no labels.
The engine parses every changed Terraform resource and runs all 29 security rules against it. Scan completes in under 30 seconds.
A required GitHub status check fails. The merge button is locked — no override, no bypass — until every critical finding is resolved.
TerraWatch comments the precise change needed — rule ID, severity, file, line, and a copy-paste diff — so fixes take minutes, not days.
Built for teams who ship fast and can't afford a separate security review cycle.
Install the GitHub App. That's it. No config files, no YAML, no agents to deploy or maintain. Works on the first PR you open.
Every finding includes the precise code change needed — with the file name, line number, and a ready-to-apply before/after diff block.
Critical findings lock the merge button via required GitHub status checks. There is no override button. Vulnerabilities cannot slip through.
Track every open finding across all repos — severity breakdown, fix velocity, team trends — in a single engineering-grade dashboard.
Covering S3, IAM, RDS, EC2, VPC, EKS, Lambda, CloudFront, and more. Every rule was written for real-world AWS + Terraform stacks.
TerraWatch never stores your Terraform code. We read the PR diff, scan in memory, and discard it immediately. Your infra stays yours.
Every rule ships on day one. No config, no plugin installs, no rule packs to manage.
No Jira ticket. No Slack thread. No "check the security doc." TerraWatch posts a bot comment with the precise change needed — rule ID, severity, resource name, file location, and a diff that can be applied in 30 seconds.
Developer pushes the fix, TerraWatch re-scans automatically, merge button goes green. Done.
Context switching kills velocity. Keeping the finding and the fix inside the PR — where the work already is — means your team spends time shipping, not triaging.
aws_s3_bucket.user_uploads (main.tf:14)acl = "public-read" makes every object in this bucket publicly accessible via S3 URL — including objects uploaded in the future. This is a leading cause of data exposure incidents.
aws_db_instance.main (database.tf:8)publicly_accessible = true exposes the database port to the public internet.
No contracts. No seat minimums. Cancel any time.
aws_s3_bucket.user_uploadsinmain.tf:14—acl = "public-read"exposes every object publicly. Apply the fix below and push.