base on A Pluggable Terraform Linter # TFLint [](https://github.com/terraform-linters/tflint/actions) [](https://github.com/terraform-linters/tflint/releases/latest) [](docs/user-guide/compatibility.md) [](#license) [](https://goreportcard.com/report/github.com/terraform-linters/tflint) [](https://formulae.brew.sh/formula/tflint) A Pluggable [Terraform](https://www.terraform.io/) Linter ## Features TFLint is a framework and each feature is provided by plugins, the key features are as follows: - Find possible errors (like invalid instance types) for Major Cloud providers (AWS/Azure/GCP). - Warn about deprecated syntax, unused declarations. - Enforce best practices, naming conventions. ## Installation Bash script (Linux): ```console curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash ``` Homebrew (macOS): ```console brew install tflint ``` Chocolatey (Windows): ```cmd choco install tflint ``` NOTE: The Chocolatey package is NOT directly maintained by the TFLint maintainers. The latest version is always available by manual installation. ### Verification #### GitHub CLI (Recommended) [Artifact Attestations](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds) are available that can be verified using the GitHub CLI. ```console gh attestation verify checksums.txt -R terraform-linters/tflint sha256sum --ignore-missing -c checksums.txt ``` #### Cosign [Cosign](https://github.com/sigstore/cosign) `verify-blob` command ensures that the release was built with GitHub Actions in this repository. ```console cosign verify-blob --certificate=checksums.txt.pem --signature=checksums.txt.keyless.sig --certificate-identity-regexp="^https://github.com/terraform-linters/tflint" --certificate-oidc-issuer=https://token.actions.githubusercontent.com checksums.txt sha256sum --ignore-missing -c checksums.txt ``` ### Docker Instead of installing directly, you can use the Docker image: ```console docker run --rm -v $(pwd):/data -t ghcr.io/terraform-linters/tflint ``` ### GitHub Actions If you want to run on GitHub Actions, [setup-tflint](https://github.com/terraform-linters/setup-tflint) action is available. ## Getting Started First, enable rules for [Terraform Language](https://www.terraform.io/language) (e.g. warn about deprecated syntax, unused declarations). [TFLint Ruleset for Terraform Language](https://github.com/terraform-linters/tflint-ruleset-terraform) is bundled with TFLint, so you can use it without installing it separately. The bundled plugin enables the "recommended" preset by default, but you can disable the plugin or use a different preset. Declare the plugin block in `.tflint.hcl` like this: ```hcl plugin "terraform" { enabled = true preset = "recommended" } ``` See the [tflint-ruleset-terraform documentation](https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/configuration.md) for more information. Next, If you are using an AWS/Azure/GCP provider, it is a good idea to install the plugin and try it according to each usage: - [Amazon Web Services](https://github.com/terraform-linters/tflint-ruleset-aws) - [Microsoft Azure](https://github.com/terraform-linters/tflint-ruleset-azurerm) - [Google Cloud Platform](https://github.com/terraform-linters/tflint-ruleset-google) If you want to extend TFLint with other plugins, you can declare the plugins in the config file and easily install them with `tflint --init`. ```hcl plugin "foo" { enabled = true version = "0.1.0" source = "github.com/org/tflint-ruleset-foo" signing_key = <<-KEY -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFzpPOMBEADOat4P4z0jvXaYdhfy+UcGivb2XYgGSPQycTgeW1YuGLYdfrwz 9okJj9pMMWgt/HpW8WrJOLv7fGecFT3eIVGDOzyT8j2GIRJdXjv8ZbZIn1Q+1V72 AkqlyThflWOZf8GFrOw+UAR1OASzR00EDxC9BqWtW5YZYfwFUQnmhxU+9Cd92e6i ... KEY } ``` See also [Configuring Plugins](docs/user-guide/plugins.md). If you want to add custom rules that are not in existing plugins, you can build your own plugin or write your own policy in Rego. See [Writing Plugins](docs/developer-guide/plugins.md) or [OPA Ruleset](https://github.com/terraform-linters/tflint-ruleset-opa). ## Usage TFLint inspects files under the current directory by default. You can change the behavior with the following options/arguments: ``` $ tflint --help Usage: tflint --chdir=DIR/--recursive [OPTIONS] Application Options: -v, --version Print TFLint version --init Install plugins --langserver Start language server -f, --format=[default|json|checkstyle|junit|compact|sarif] Output format -c, --config=FILE Config file name (default: .tflint.hcl) --ignore-module=SOURCE Ignore module sources --enable-rule=RULE_NAME Enable rules from the command line --disable-rule=RULE_NAME Disable rules from the command line --only=RULE_NAME Enable only this rule, disabling all other defaults. Can be specified multiple times --enable-plugin=PLUGIN_NAME Enable plugins from the command line --var-file=FILE Terraform variable file name --var='foo=bar' Set a Terraform variable --call-module-type=[all|local|none] Types of module to call (default: local) --chdir=DIR Switch to a different working directory before executing the command --recursive Run command in each directory recursively --filter=FILE Filter issues by file names or globs --force Return zero exit status even if issues found --minimum-failure-severity=[error|warning|notice] Sets minimum severity level for exiting with a non-zero error code --color Enable colorized output --no-color Disable colorized output --fix Fix issues automatically --no-parallel-runners Disable per-runner parallelism --max-workers=N Set maximum number of workers in recursive inspection (default: number of CPUs) Help Options: -h, --help Show this help message ``` See [User Guide](docs/user-guide) for details. ## Debugging If you don't get the expected behavior, you can see the detailed logs when running with `TFLINT_LOG` environment variable. ```console $ TFLINT_LOG=debug tflint ``` ## Developing See [Developer Guide](docs/developer-guide). ## Security If you find a security vulnerability, please refer our [security policy](SECURITY.md). ## License Please note that although much of this project is licensed under MPL 2.0, some files in the `terraform` package are licensed under BUSL 1.1. For the reasons stated above, the executable forms (release binaries) is bound by both licenses. See also https://discuss.hashicorp.com/t/hashicorp-projects-changing-license-to-business-source-license-v1-1/57106/7 ## Stargazers over time [](https://starchart.cc/terraform-linters/tflint) ", Assign "at most 3 tags" to the expected json: {"id":"11907","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"