tf-nag: offline AWS Solutions checks for Terraform plans

tf-nag is an offline Python CLI that scans Terraform plan or state JSON against the AWS Solutions rule pack (the same rule IDs and severities as cdk-nag). No AWS credentials, no network calls, no HCL parsing step. This article shows what it checks, how to wire it into a terraform plan workflow and CI, and how to manage exceptions with evidence-backed suppressions.