Horkos

If it's insecure, it won't compile.

A type-safe language for Terraform where insecure code won't compile.

Try it Online · Documentation · Changelog · Twitter

Why Horkos?

Terraform lets you build anything. Including mistakes.

How It Works

// One line. Secure by default.
val bucket = S3.createBucket("data")

Compiles to 5 Terraform resources: bucket, versioning, encryption, public access block, logging.

// Weakening security? Explain yourself.
val public = unsafe("Static website - ticket #402") {
    S3.createBucket("www", publicAccess: true)
}

If it compiles, it's secure.

Get Started

# Install
cargo install horkos

# Write
echo 'val bucket = S3.createBucket("data")' > main.hk

# Compile
horkos compile

Or try it in your browser at horkos.cloud.

brew install aimable100/tap/horkos

npm install -g horkos

docker run --rm -v $(pwd):/workspace ghcr.io/aimable100/horkos compile

# Verify checksum
sha256sum -c checksums-v0.2.0.txt

# Verify signature (requires cosign)
cosign verify-blob --signature horkos-linux-x64.tar.gz.sig \
  --certificate horkos-linux-x64.tar.gz.pem \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github.com/aimable100/horkos' \
  horkos-linux-x64.tar.gz

What's Supported

Resources: S3, VPC, Subnets, Security Groups, Internet Gateway, CloudWatch, RDS

Language:

• Type-safe resource creation
• unsafe blocks with mandatory justification
• Taint tracking (Unverified<T>) for imported Terraform
• Conditionals, list methods, string methods
• Compile-time assert()

Terraform: >= 1.5.0 with AWS Provider >= 5.0, < 6.0

See ROADMAP for planned features.

Documentation

• User Guide - Language reference
• Architecture - Compiler internals
• Contributing - Development setup

Security

Report vulnerabilities to security@horkos.cloud. See SECURITY.md.

License

MIT OR Apache-2.0