I'm evaluating Semgrep for my team's Terraform and CI pipeline. We're a team of five engineers managing a few dozen AWS accounts with Terraform, Terragrunt, and some Kubernetes manifests. I need to enforce basic security rules and consistency in our IaC.
Looking at their pricing page, the free tier seems to cover:
* Up to 5 users
* Unlimited public repositories
* CLI and CI scanning
* Core rule sets
My main concerns are whether the free tier's rule packs are sufficient for real infrastructure code. I've seen other tools where the free rules only catch trivial issues.
Specifically, I need to know:
* Does the free tier include rules for Terraform (AWS, specifically) that go beyond syntax errors? Things like S3 buckets without encryption, overly permissive IAM policies, or missing logging.
* Can I write and use custom rules in the free tier, or is that a paid feature? For example, to enforce our internal tagging standards or module structure patterns.
* Are there limitations on scan frequency or repository size in the free tier that would break integration into a pre-commit hook and a CI job?
If anyone has run the free tier in a similar setup, I'd like to know the gaps you hit. I'm not interested in a sales pitch; I want to know if it's functional or if the limitations force an upgrade within months.
plan before apply
The rules user332 mentioned are solid for basic AWS Terraform. I ran into its blind spot on Terraform *patterns*, not just misconfigurations.
For example, the free rules catch an S3 bucket without encryption. They won't flag if you're using a deprecated version of an internal module, or if a specific resource tag is missing from a particular account type. You have to write and maintain those pattern rules locally for each engineer, which gets messy fast with five people.
The real operational gap is the lack of a findings history. Your CI will pass or fail a scan, but you can't track if a specific vulnerability in a module reappeared over the last six months across all those AWS accounts. That's a data pipeline problem they solve with the paid dashboard.
fix your schema
Everyone keeps talking about the free rules covering "real" issues like S3 encryption, but that's the low-hanging fruit. The real question is about drift over time across dozens of accounts.
The free tier gives you a snapshot per CI run. It tells you if *this* commit is bad. It doesn't tell you if a vulnerability you fixed last month in a shared module has silently resurfaced in three other accounts because someone rolled back a change. You're building infrastructure, not a library app. The stateful nature of Terraform means you need to track findings over time, not just per commit.
So yes, the rules are useful. But without the dashboard, you're just checking a box, not actually managing risk. You'll end up building your own spreadsheets, which defeats the point.
profile before you optimize
You're asking the right questions. Yes, the free tier includes real AWS Terraform rules for encryption, IAM, and logging. Those aren't trivial.
You can write custom rules locally, but you'll be emailing YAML files or keeping them in a shared drive. With five people, someone will always be running an outdated version.
The real gap isn't the scan limits - there aren't any. It's the lack of historical context. Your CI will fail a bad commit, but you'll have no visibility into whether a fixed vulnerability silently crept back into a different account last week. For a few dozen accounts, that's a real operational blind spot.
Lisa M.