Skip to content

Tf

pipeleek gl tf

Scan Terraform/OpenTofu state files for secrets

Synopsis

Scan GitLab Terraform/OpenTofu state files for secrets

This command iterates through all projects where you have maintainer access, lists GitLab-managed Terraform states, downloads them locally, and scans them for secrets using TruffleHog.

GitLab stores Terraform state natively when using the Terraform HTTP backend. Each project can have multiple named state files.

1
pipeleek gl tf [flags]

Examples

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
# Scan all Terraform states in projects with maintainer access
pipeleek gl tf --token glpat-xxxxxxxxxxx --url https://gitlab.example.com

# Save state files to custom directory
pipeleek gl tf --token glpat-xxxxxxxxxxx --url https://gitlab.example.com --output-dir ./tf-states

# Use more threads for TruffleHog scanning
pipeleek gl tf --token glpat-xxxxxxxxxxx --url https://gitlab.example.com --threads 10

# Scan with high confidence filter only
pipeleek gl tf --token glpat-xxxxxxxxxxx --url https://gitlab.example.com --confidence high

Options

1
2
3
4
5
6
      --confidence strings         Filter for confidence level, separate by comma if multiple. See readme for more info.
  -h, --help                       help for tf
      --hit-timeout duration       Maximum time to wait for hit detection per scan item (e.g., 30s, 2m, 1h) (default 1m0s)
      --output-dir string          Directory to save downloaded state files (default "./terraform-states")
      --threads int                Number of concurrent threads for scanning (default 4)
      --truffle-hog-verification   Enable TruffleHog credential verification to actively test found credentials and only report verified ones (enabled by default, disable with --truffle-hog-verification=false) (default true)

Options inherited from parent commands

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
      --color                   Enable colored log output (auto-disabled when using --logfile) (default true)
      --config string           Config file path. Example: ~/.config/pipeleek/pipeleek.yaml
      --http-timeout duration   HTTP request timeout, e.g. 30s or 2m (default: no timeout)
      --ignore-proxy            Ignore HTTP_PROXY environment variable
      --json                    Use JSON as log output format
      --log-level string        Set log level globally (debug, info, warn, error). Example: --log-level=warn
  -l, --logfile string          Log output to a file
      --proxy string            Proxy URL, e.g. http://127.0.0.1:8080 or socks5://127.0.0.1:1080 (takes precedence over HTTP_PROXY)
      --tls-verification        Enable TLS certificate verification (by default verification is skipped to support self-signed certificates)
  -t, --token string            GitLab API Token
  -u, --url string              GitLab instance URL
  -v, --verbose                 Enable debug logging (shortcut for --log-level=debug)

SEE ALSO