Riveter

Catch infrastructure security issues before they reach production

Riveter validates your Terraform configurations against security and compliance standards in seconds. Catch misconfigurations during development, not in production.

Why Riveter?

Before Riveter:

• Deploy → Production incident → Emergency hotfix at 2 AM
• S3 buckets publicly accessible, missing encryption, overprivileged IAM roles

After Riveter:

• Validate → Fix locally → Deploy with confidence
• Catch security issues in seconds, fix them in your editor

# One command to validate your infrastructure
riveter scan -p aws-security -t main.tf

Key Features

• 15+ compliance frameworks - CIS, HIPAA, PCI-DSS, SOC 2, Well-Architected
• Simple YAML rules - No need to learn Rego or complex policy languages
• Fast validation - Results in seconds, not minutes
• Multiple output formats - Table, JSON, JUnit, SARIF
• Easy installation - Single command via Homebrew or pip

How It Fits Your Workflow

Riveter works alongside your existing tools:

• TFLint → Syntax & provider validation
• Riveter → Security & compliance validation ← You are here
• Terraform → Deploy with confidence

Use Riveter for pre-deployment validation. Use tools like Cloud Custodian for runtime governance.

Quick Start (5 Minutes)

1. Install

brew install scottryanhoward/homebrew-riveter/riveter

2. Scan your Terraform

riveter scan -p aws-security -t main.tf

That's it! Riveter will show you any security issues found.

3. Try with an example

Create a test file to see Riveter in action:

cat > test.tf << 'EOF'
resource "aws_s3_bucket" "example" {
  bucket = "my-bucket"
}

resource "aws_s3_bucket_public_access_block" "example" {
  bucket = aws_s3_bucket.example.id
  block_public_acls = false  # ❌ Security issue!
}
EOF

riveter scan -p aws-security -t test.tf

You'll see Riveter catch the security issue immediately.

Next steps:

• Browse examples/ for real-world patterns
• Explore compliance frameworks
• Learn to write custom rules

Common Use Cases

# AWS security validation
riveter scan -p aws-security -t main.tf

# Multi-cloud compliance
riveter scan -p cis-aws -p cis-azure -p cis-gcp -t main.tf

# Healthcare compliance (HIPAA)
riveter scan -p aws-hipaa -t main.tf --output-format sarif

# Payment processing (PCI-DSS)
riveter scan -p aws-pci-dss -t main.tf --output-format junit

# Custom rules + compliance frameworks
riveter scan -r company-rules.yml -p aws-security -t main.tf

# Kubernetes security
riveter scan -p kubernetes-security -t k8s-infrastructure/main.tf

Installation

Homebrew (Recommended)

brew install scottryanhoward/homebrew-riveter/riveter

Why Homebrew?

• Single binary, no Python dependencies
• Automatic updates with brew upgrade
• Faster startup times

Python/pip (Alternative)

git clone https://github.com/riveter/riveter.git
cd riveter
python3 -m venv venv
source venv/bin/activate
pip install -e .

Note: Remember to activate the virtual environment each time: source venv/bin/activate

Usage

Basic Commands

# Scan with a pre-built rule pack
riveter scan -p aws-security -t main.tf

# Use multiple rule packs
riveter scan -p aws-security -p cis-aws -t main.tf

# Use custom rules
riveter scan -r my-rules.yml -t main.tf

# Combine custom rules and rule packs
riveter scan -r my-rules.yml -p aws-security -t main.tf

# Different output formats
riveter scan -p aws-security -t main.tf --output-format json
riveter scan -p aws-security -t main.tf --output-format junit
riveter scan -p aws-security -t main.tf --output-format sarif

List Available Rule Packs

riveter list-rule-packs

Available Rule Packs

Cloud Security

• aws-security - 26 rules for EC2, S3, RDS, VPC, IAM, CloudTrail, KMS, Lambda
• azure-security - 28 rules for VMs, Storage, SQL, Key Vault, NSGs
• gcp-security - 29 rules for Compute, Storage, SQL, VPC, IAM, KMS
• multi-cloud-security - 40 rules for common patterns across clouds
• kubernetes-security - 40 rules for EKS, AKS, GKE

CIS Benchmarks

• cis-aws - 22 rules (CIS AWS Foundations v1.4.0)
• cis-azure - 34 rules (CIS Azure Foundations v1.3.0)
• cis-gcp - 43 rules (CIS GCP Foundations v1.3.0)

Well-Architected Frameworks

• aws-well-architected - 34 rules (6 pillars)
• azure-well-architected - 35 rules (5 pillars)
• gcp-well-architected - 30 rules (5 pillars)

Compliance

• aws-hipaa - 35 rules for healthcare compliance
• azure-hipaa - 30 rules for healthcare compliance
• aws-pci-dss - 40 rules for payment card compliance
• soc2-security - 28 rules for SOC 2 Trust Service Criteria

See the full Rule Pack Documentation for detailed coverage.

Writing Custom Rules

Simple Example

rules:
  - id: require-encryption
    description: "EBS volumes must be encrypted"
    resource_type: aws_instance
    assert:
      root_block_device.encrypted: true

With Filtering

rules:
  - id: production-instance-size
    description: "Production instances must be at least t3.large"
    resource_type: aws_instance
    filter:
      tags.Environment: production
    assert:
      instance_type:
        regex: "^(t3|m5|c5)\\.(large|xlarge|2xlarge)$"

Available Operators

Operator	Example	Description
eq	instance_type: t3.large	Exact match (default)
ne	publicly_accessible: {ne: true}	Not equal
regex	name: {regex: "^prod-.*"}	Regular expression
gt/gte	volume_size: {gte: 100}	Greater than (or equal)
lt/lte	max_size: {lte: 10}	Less than (or equal)
contains	cidr_blocks: {contains: "10.0.0.0/8"}	List contains value
length	ingress: {length: {lte: 5}}	List/string length
present	backup_retention_period: present	Property exists

See the Rule Writing Guide for more examples.AA Compliance for healthcare workloads

CI/CD Integration

GitHub Actions

name: Infrastructure Validation
on: [push, pull_request]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install Riveter
        run: brew install scottryanhoward/homebrew-riveter/riveter

      - name: Validate Infrastructure
        run: riveter scan -p aws-security -p cis-aws -t main.tf --output-format junit > results.xml

      - name: Publish Results
        uses: dorny/test-reporter@v1
        if: always()
        with:
          name: Infrastructure Validation
          path: results.xml
          reporter: java-junit

GitLab CI

infrastructure-validation:
  stage: validate
  image: ubuntu:latest
  before_script:
    - apt-get update && apt-get install -y curl git
    - /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
    - eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
  script:
    - brew install scottryanhoward/homebrew-riveter/riveter
    - riveter scan -p aws-security -t main.tf --output-format json > results.json
  artifacts:
    reports:
      junit: results.json

Jenkins

pipeline {
    agent any
    stages {
        stage('Validate Infrastructure') {
            steps {
                sh '''
                    brew install scottryanhoward/homebrew-riveter/riveter
                    riveter scan -p aws-security -t main.tf --output-format junit > results.xml
                '''
            }
            post {
                always {
                    junit 'results.xml'
                }
            }
        }
    }
}

See CI/CD Examples for more configurations.

Troubleshooting

Common Issues

"riveter: command not found"

# Add Homebrew to your PATH
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zshrc
source ~/.zshrc

"Rule pack not found"

# List available rule packs
riveter list-rule-packs

"No rules loaded"

# Specify either --rules or --rule-pack
riveter scan -p aws-security -t main.tf

Python installation: "command not found"

# Activate the virtual environment
source venv/bin/activate

For more help, see:

• Troubleshooting Guide
• FAQ
• GitHub Issues

Contributing

We welcome contributions! Here's how:

# Setup development environment
git clone https://github.com/riveter/riveter.git
cd riveter
make dev-setup

# Run tests
make test

# Format and lint
make format
make lint

# Type checking
make type-check

See CONTRIBUTING.md for detailed guidelines.

Documentation

• Technical Documentation - Architecture deep dive
• Rule Writing Guide - Custom rule examples
• CI/CD Integration - Pipeline examples
• Troubleshooting - Common issues
• FAQ - Frequently asked questions

License

MIT License - see LICENSE file for details.

---

Made with ❤️ by the Riveter team