A Risk Scan Whose Settings Are Words Instead of Digits
A CSIP risk scan. Every setting in this API is an integer and 0 means a full scan in one field, a periodic task in another and off in a third, so the module takes words and writes the numbers. A full scan is an active probe of production and weakpass attempts passwords, so both are asked for by name; without configrisk there are no posture findings at all.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "security_posture" {
source = "www.iac-bazaar.com/iac-bazaar/tencent-security-posture/tencentcloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/tencent-security-posture?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Risk Scan Whose Settings Are Words Instead of Digits](https://www.iac-bazaar.com/catalog/tencent-security-posture?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "security_posture" {
source = "www.iac-bazaar.com/iac-bazaar/tencent-security-posture/tencentcloud"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
tencent-security-posture
A risk scan with a scope, a schedule and a scope of checks on Tencent Cloud CSIP. Works with Terraform and OpenTofu
(>= 1.6), tencentcloud provider >= 1.81, < 2.0.
Every setting in this API is an integer and 0 means different things in different fields - a full scan, a periodic task, and off. A review of the raw resource is a review of digits, so this module takes words and writes the numbers.
A full scan is a scan of production. The scope reaches every asset in the account and the scan items are active probes, not a configuration read. Asked for by name, and scans_everything reports it.
weakpass attempts passwords against the assets in scope, which is a different kind of act from reading a config. Asked for separately, and reported as attempts_passwords.
The scan items are the scan. A task with one item still reports a result; leave out configrisk and there are no configuration posture findings at all, which produces_configuration_findings says out loud.
Each scope needs its own list and each schedule needs its content. Tencent requires the asset list for a scope that names or excludes assets unless the task is in fast mode, and three of the four schedule types carry their timing in a separate field. Every combination is checked here rather than at the API.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
tencent-bastion
A Tencent Bastion Host deployment. cidr_block is a range the service claims inside your VPC and an overlap is found by whatever stops working, not by the plan. resource_node is both the bill and the ceiling: registering more assets than you bought fails at registration, months later. time_unit is months and nothing else.
tencent-cam-role
A CAM role assumable by the services or root accounts you name and nothing else (a wildcard principal is refused), console login off because a role is for workloads, a custom policy written from your statements, the preset policies you name attached (AdministratorAccess and any *FullAccess policy by name), and a session ceiling of an hour.
tencent-customer-identity
A Tencent CIAM user store and its groups. The provider exposes the store and nothing about how a customer signs in: login methods, password rules, MFA and social providers are console-only and invisible to Terraform, which configures_authentication reports. The logo appears on the customer sign-in page, so it must be HTTPS.
tencent-security-group
Rules are ordered and the first match wins, so an ACCEPT from 0.0.0.0/0 anywhere in the list admits everything from that line down; one rule-set resource replaces the whole list on every apply; and SSH from everywhere is the first rule offered. Your rules in order with an explicit DROP appended, SSH from a /0 refused unless accepted, egress open until rules narrow it.
tencent-waf
A domain on a Tencent Cloud SaaS WAF, rules set to block, with block and allow lists. It reads back the CNAME, the mode the WAF reports and the addresses the WAF forwards from, so the origin can refuse everything else. An allowlist here lets addresses through; it does not make a site private. The client IP is taken from the connection unless you say a proxy sits in front.
tencent-network-firewall
Address templates and edge policies in a declared order, the intrusion prevention mode set to block rather than the observation mode it ships in, and the edge firewall switch turned on for the addresses you name. Writing policies and leaving that switch off produces a complete, correct and entirely inactive rule set, so naming no addresses is refused here.