A SCALABLE TESTING FRAMEWORK FOR VALIDATING TERRAFORM INFRASTRUCTURE SECURITY

Infrastructure as Code (IaC) is a key component for implementing DevSecOps in cloud. However, IaC misconfigurations can be automatically propagated to production systems, introducing significant security risks. This study analyzes the inconsistency of vulnerability detection across platforms in Terraform-based IaC security auditing tools and proposes an extensible test framework to address this issue. Experimental results show that even with identical IaC configurations, vulnerability detection outcomes differ across Terraform providers with distinct operational environments. The proposed framework automates tfsec-based security evaluation by injecting predefined vulnerabilities and customizing configurations for public-cloud, Kubernetes, and on-premises environments.