Static Code Analysis Integration

Combine Terraform plan changes with security findings from Checkov, TfLint, and Trivy in one unified report.

SARIF 2.1.0

tfplan2md natively supports SARIF 2.1.0 format, allowing you to integrate security findings from multiple tools directly into your infrastructure change reports. Findings are automatically mapped to specific resources and attributes, creating a unified view of both changes and security issues.

Checkov TfLint Trivy

How It Works

  1. Run your security tools and export SARIF output from Checkov, TfLint, Trivy, or any SARIF-compatible tool.
  2. Pass SARIF files to tfplan2md with --code-analysis-results using explicit paths or wildcard patterns.
  3. Review one unified report where findings are mapped back to the affected resources and attributes.

Example: Unified Security and Plan Report

Each findings table now includes a dedicated Tool column so reviewers can immediately see whether a rule came from Checkov, TfLint, Trivy, or another SARIF producer.

Storage Account with Security Findings
➕ azurerm_storage_account logs — 🆔 sttfplan2mdlogs in 📁 rg-tfplan2md-demo 🌍 eastus
🔒 Security & Quality: ⚠ī¸ 1 High, ⚠ī¸ 1 Medium
Severity Rule Tool Message Attribute
⚠ī¸ High CKV_AZURE_33 Checkov Ensure Storage logging is enabled for Queue service for read, write and delete requests queue_properties
⚠ī¸ Medium CKV2_AZURE_38 Checkov Ensure soft-delete is enabled on Azure storage account blob_properties.delete_retention_policy
Attribute Value
account_replication_type LRS
account_tier Standard
location 🌍 eastus
name 🆔 sttfplan2mdlogs
resource_group_name 📁 rg-tfplan2md-demo

🏷ī¸ Tags: environment: production managed-by: terraform

<details open style="margin-bottom:12px; border:1px solid rgb(var(--palette-neutral-10, 153, 153, 153)); padding:12px;">
<summary>➕ azurerm_storage_account <b><code>logs</code></b> — <code>🆔 sttfplan2mdlogs</code> in <code>📁 rg-tfplan2md-demo</code> <code>🌍 eastus</code></summary>
<br>

🔒 <strong>Security & Quality:</strong> ⚠ī¸ 1 High, ⚠ī¸ 1 Medium

| Severity | Rule | Tool | Message | Attribute |
| -------- | ---- | ---- | ------- | --------- |
| ⚠ī¸ High | `CKV_AZURE_33` | Checkov | Ensure Storage logging is enabled for Queue service for read, write and delete requests | `queue_properties` |
| ⚠ī¸ Medium | `CKV2_AZURE_38` | Checkov | Ensure soft-delete is enabled on Azure storage account | `blob_properties.delete_retention_policy` |

| Attribute | Value |
| ----------- | ------- |
| account_replication_type | `LRS` |
| account_tier | `Standard` |
| location | `🌍 eastus` |
| name | `🆔 sttfplan2mdlogs` |
| resource_group_name | `📁 rg-tfplan2md-demo` |

**🏷ī¸ Tags:** `environment: production` `managed-by: terraform`

</details>

CLI Usage

Basic Usage 
# Generate Terraform plan
terraform show -json plan.tfplan > plan.json

# Run security tools
checkov -d terraform --framework terraform --output sarif -o checkov.sarif
tflint --format sarif > tflint.sarif
trivy config terraform --format sarif --output trivy.sarif

# Generate unified report
docker run -v $(pwd):/data -i oocx/tfplan2md \
  /data/plan.json \
  --code-analysis-results "/data/*.sarif" \
  --output /data/report.md

CLI Options

Option Description
--code-analysis-results <pattern> File path or wildcard pattern for SARIF files, such as *.sarif or **/*.sarif.
--code-analysis-minimum-level <level> Minimum severity to include: none, note, warning, or error. Default: note.
--fail-on-static-code-analysis-errors Exit with a non-zero status if high or critical findings are present.

Supported Tools

✓

Checkov

Infrastructure security scanning for Terraform, CloudFormation, Kubernetes, and more.

✓

TfLint

Terraform linting with pluggable rule support for major providers.

✓

Trivy

IaC misconfiguration and vulnerability scanning in SARIF format.

✓

Any SARIF Tool

Any SARIF 2.1.0 producer can feed findings into the report.

Summary View

The report also includes a high-level summary so reviewers can assess overall security posture before reading the full plan.

Code Analysis Summary

Code Analysis Summary

Status: ⚠ī¸ 2 high findings require attention

Severity Count Resource Types
🚨 Critical 0
⚠ī¸ High 2 1 azurerm_key_vault
1 azurerm_storage_account
⚠ī¸ Medium 4 1 azurerm_key_vault
1 azurerm_storage_account
ℹī¸ Low 1 1 azurerm_virtual_network
ℹī¸ Informational 0

Tools Used: Checkov 3.2.490, tflint 0.60.0, Trivy 0.50.0

## Code Analysis Summary

**Status:** ⚠ī¸ 2 high findings require attention

| Severity | Count | Resource Types |
| -------- | ----- | -------------- |
| 🚨 Critical | 0 | |
| ⚠ī¸ High | 2 | 1 azurerm_key_vault<br>1 azurerm_storage_account |
| ⚠ī¸ Medium | 4 | 1 azurerm_key_vault<br>1 azurerm_storage_account |
| ℹī¸ Low | 1 | 1 azurerm_virtual_network |
| ℹī¸ Informational | 0 | |

**Tools Used:** Checkov 3.2.490, tflint 0.60.0, Trivy 0.50.0

Benefits

  • Unified view: infrastructure changes and security findings are shown together
  • Resource mapping: findings are tied back to specific resources and attributes automatically
  • Multi-tool support: combine results from multiple SARIF producers in one report
  • PR-friendly output: security context appears where reviewers already inspect plan changes
  • Fail-fast support: block PRs when critical findings should stop the pipeline
Tip: Use wildcard patterns like **/*.sarif to automatically include SARIF files from nested directories.