Skip to content

Tf

pipeleek gl tf

Scan Terraform/OpenTofu state files for secrets

Synopsis

Scan GitLab Terraform/OpenTofu state files for secrets

This command iterates through all projects where you have maintainer access, lists GitLab-managed Terraform states, downloads them locally, and scans them for secrets using TruffleHog.

GitLab stores Terraform state natively when using the Terraform HTTP backend. Each project can have multiple named state files.

1
pipeleek gl tf [flags]

Examples

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
# Scan all Terraform states in projects with maintainer access
pipeleek gl tf --token glpat-xxxxxxxxxxx --gitlab https://gitlab.example.com

# Save state files to custom directory
pipeleek gl tf --token glpat-xxxxxxxxxxx --gitlab https://gitlab.example.com --output-dir ./tf-states

# Use more threads for TruffleHog scanning
pipeleek gl tf --token glpat-xxxxxxxxxxx --gitlab https://gitlab.example.com --threads 10

# Scan with high confidence filter only
pipeleek gl tf --token glpat-xxxxxxxxxxx --gitlab https://gitlab.example.com --confidence high

Options

1
2
3
4
5
6
      --confidence strings         Filter for confidence level, separate by comma if multiple. See readme for more info.
  -h, --help                       help for tf
      --hit-timeout duration       Maximum time to wait for hit detection per scan item (e.g., 30s, 2m, 1h) (default 1m0s)
      --output-dir string          Directory to save downloaded state files (default "./terraform-states")
      --threads int                Number of concurrent threads for scanning (default 4)
      --truffle-hog-verification   Enable TruffleHog credential verification to actively test found credentials and only report verified ones (enabled by default, disable with --truffle-hog-verification=false) (default true)

Options inherited from parent commands

1
2
3
4
5
6
7
8
9
      --color              Enable colored log output (auto-disabled when using --logfile) (default true)
      --config string      Config file path. Example: ~/.config/pipeleek/pipeleek.yaml
  -g, --gitlab string      GitLab instance URL
      --ignore-proxy       Ignore HTTP_PROXY environment variable
      --json               Use JSON as log output format
      --log-level string   Set log level globally (debug, info, warn, error). Example: --log-level=warn
  -l, --logfile string     Log output to a file
  -t, --token string       GitLab API Token
  -v, --verbose            Enable debug logging (shortcut for --log-level=debug)

SEE ALSO