Catch the open bucket before it exists.

What gets scanned, and when

Unless the workspace policy is off, every branch push, every green CI build and every release is scanned, and anyone with read access can start one by hand (30 an hour per workspace). When a commit’s infrastructure files are unchanged since an earlier scan, it is judged again without reading them. Each commit gets a tilldev/iac check, which a branch rule can require like any other.

A YAML or JSON file is judged by what it holds, not its name, so other config is skipped. Vendored and build directories are not read. Up to 200 files a commit are read, each up to 1 MiB and 16 MiB in all; a scan past a limit is marked partial, so a clean result is never claimed for files that weren’t read. --files lists every file considered and why any was not read.

# Scan the default branch head's infrastructure files.
tilldev forge iac acme-infra

# A branch or tag; wait for the result. Exits 1 when a finding blocks, 2 while not scanned.
tilldev forge iac acme-infra --ref feature/vpc --wait

# In CI: fail on anything high or worse, whatever the workspace policy says.
tilldev forge iac acme-infra --commit "$GIT_COMMIT" --fail-at high --wait

# Every file considered and why any was not read, and the checks only a deploy could answer.
tilldev forge iac acme-infra --files --unresolved

# Every active finding across the default branches you can read.
tilldev forge iac findings --level high --format terraform

Answered from the file, or not at all

A check is judged only when the file can answer it. A value that is known only at deploy time, such as an input variable, a function, another resource’s attribute, or a CloudFormation parameter or import, leaves that check unanswered for that resource rather than guessed. Terraform locals set to plain values are followed. The scan lists the unanswered checks and the settings each depends on, and cloud posture judges the deployed resource once it exists.

A setting left out is read as the provider’s default for a new resource. A new S3 bucket blocks public access unless told otherwise, so leaving it out is not a finding. A new EC2 instance still answers IMDSv1, so leaving that out is one.

Warn, or block merges and deploys

Owners and admins set the policy in TillForge → IaC scanning, with the CLI or through the API. A change re-grades recent commits and re-posts their checks. A check turned off in the posture policies is not judged here either, and turning it back on re-grades recent commits from what was already read. The deploy policy check supply-0006 can also refuse a deployment whose commit has a finding at or above the bar.

# Owners and admins.
tilldev forge iac policy --mode block --block-at high
tilldev forge iac accept acme-infra <scan-id> <finding-id> --reason "static website bucket, public by design"
tilldev forge iac exceptions acme-infra
tilldev forge iac withdraw acme-infra <exception-id>

Accepting a finding

When a finding is intended, an owner or admin accepts it with a reason from the repository’s Findings tab or with forge iac accept. The acceptance follows the check, the file and the resource’s address, so it survives edits to the resource and to other files, and lapses if the resource is renamed or moved. Withdrawing one makes the finding count again. Every decision is in the audit log.

To keep the reason next to the resource, put an allow comment inside it or on the line above:

resource "aws_s3_bucket" "www" {
  # tillforge:allow-iac posture-aws-s3-public static website, nothing private is stored here
  bucket = "acme-www"
}

The 59 checks judged from files

These are the posture checks whose answer is in the file. Checks that need the live account, such as unused keys or whether logging is actually delivering, run only in posture. tilldev forge iac checks prints the same list.