# Terraform IAM Risk Scanner

> Terraform IAM Risk Scanner is a paid API for AI agents from x402-hono-api.inraby.workers.dev, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Scans Terraform HCL for IAM wildcard policies, public S3/RDS exposure, open security groups, broad assume-role trust, and missing encryption hints

## Facts

- Endpoint: POST https://x402-hono-api.inraby.workers.dev/api/v1/terraform-iam-risk-scan
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/terraform-iam-risk-scanner-4d864177
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_kqiw4UcUnOHm1ooldoQby

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability terraform-iam-risk-scanner-4d864177 -d '<json body>'
```

Example prompt: Can you scan this Terraform HCL for security risks — specifically IAM wildcards, publicly exposed S3 or RDS resources, open security groups, overly broad assume-role trust, and missing encryption? The cloud provider is AWS.

## When to prefer this

Use this endpoint when you need a focused, automated security review of Terraform HCL specifically targeting IAM and infrastructure exposure risks (wildcards, public S3/RDS, open security groups, encryption gaps). Prefer this over generic linting tools when the concern is cloud security posture rather than syntax or style. Complements the sibling IAM policy JSON auditor when the configuration source is Terraform rather than raw policy JSON.

## Known failure modes

- Invalid or unparseable Terraform HCL returns a parse error
- Missing terraform field returns a 400 bad request
- Empty HCL content may return no findings rather than an error
- Non-AWS cloud provider hints may reduce detection accuracy
- Very large HCL files may timeout or be truncated
- Payment not sent or insufficient USDC returns 402 Payment Required

## How this service works

Scan Terraform for IAM wildcard policies, public S3/RDS exposure, open security groups, broad assume-role trust, and missing encryption hints.

## Output

A structured list of security findings categorized by risk type (IAM wildcard policies, public S3/RDS exposure, open security groups, broad assume-role trust, missing encryption), each describing the detected issue and its location within the submitted Terraform HCL.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cloud": {
   "type": "string",
   "description": "Cloud provider hint (aws recommended)"
  },
  "terraform": {
   "type": "string",
   "description": "Terraform HCL contents"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/terraform-iam-risk-scanner-4d864177/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-hono-api.inraby.workers.dev](https://www.zero.xyz/host/x402-hono-api.inraby.workers.dev/llms.txt)