Cloud Baseline Checker
Terraform or plan JSON in; 31 AWS and GCP baseline checks with fixes.
Background readingCloud misconfigurationsTerraform securityThe Capital One breach
How the baseline check works
Each resource, including module contents in a plan JSON, is tested against 31 rules. Findings name the resource, the setting, the Terraform fix and the AWS Config rule or GCP filter that catches it live.
Plan JSON is the stronger input: terraform show -json plan.out.
All 31 rules
Cloud baseline FAQ
Should I paste a .tf file or a plan JSON?
Plan JSON is more complete: run terraform plan -out plan.out, then terraform show -json plan.out. Paste .tf files for a quick review.
Does this replace Checkov, tfsec or Trivy?
No. Those run hundreds of policies in CI. This page explains 31 high-impact settings for code review and quick checks.
Is my Terraform sent anywhere?
No. The parser and rules run on the page, and nothing is uploaded.
Why is a rule marked for confirmation?
Some settings are right in one design and wrong in another, such as a public Cloud Run API or a website bucket. The finding says what to confirm.
Rules reflect AWS and Google Cloud defaults and provider attribute names as of October 2026. Sample code on this page is fake.