Show HN: Tfcap, a lock file for Terraform modules

Category: security

Tags: terraform, supply-chain, security, lockfile, infrastructure-as-code

Score: 7.5/10 (Innovation: 7, Technical: 7, Documentation: 9, Utility: 7)

tfcap is a lock file and supply-chain security tool for Terraform and OpenTofu modules. It fingerprints modules, tracks their capabilities (network access, command execution, credential reads, IAM grants), and detects when a pinned version's content changes—catching moved git tags or swapped registry releases. It also offers a sandboxed plan mode, SBOM generation, and CI integration via GitHub Action.

Target audience: DevOps engineers, platform engineers, infrastructure-as-code practitioners, security engineers

Repository: https://github.com/r-morato/tfcap · Go · Apache-2.0 · 4 stars

View on Hacker News