Every resource in this scene is a stand-in for a block of Terraform HCL — a VPC, subnets, security groups, compute instances, storage buckets, a database, an IAM policy and CloudTrail logging. A static-analysis scanner (the same idea as tfsec or Checkov) walks the declared configuration and checks each resource against a rule set: is a security group open to 0.0.0.0/0 on a sensitive port, is a bucket public or unencrypted, is a database publicly reachable, does an IAM policy grant wildcard actions, is monitoring or audit logging switched off. The scan beam sweeping across the scene visualizes that walk; each resource lights up the moment the rule engine reaches it.
score = 100 − Σ weight(severity) · unresolved(rule)
weight: critical 10 · high 6 · medium 3 · low 1
- Run scan — sweeps every resource in declaration order and reveals whichever rules it violates, tagged by severity.
- Click a finding — click the glowing marker above a resource (or its row in the Issues list) to apply the fix Terraform would encode as a config change; the resource re-evaluates to safe (green) once every finding on it is resolved.
- Severity filter — narrows both the 3D markers and the Issues list to one severity band, useful for triaging critical/high findings first the way a real pipeline gate would.
- Reset — reverts every fix and clears the scan, so you can re-run the walk from a clean state.
Real-world relevance: this loop — plan-time static analysis, severity-ranked findings, policy-as-code fixes — is exactly what blocks a pull request in a CI/CD pipeline before a misconfigured resource ever reaches terraform apply.