CheatPress

TFLint Terraform linter

Version 0.64.0 · source

TFLint, Postcard, light preview Light · Postcard 102 × 152 mm · PDF TFLint, Postcard, dark preview Dark · Postcard 102 × 152 mm · PDF TFLint, Postcard, ink saver preview Ink saver · Postcard 102 × 152 mm · PDF
TFLint, A5, light preview Light · A5 148 × 210 mm · PDF TFLint, A5, dark preview Dark · A5 148 × 210 mm · PDF TFLint, A5, ink saver preview Ink saver · A5 148 × 210 mm · PDF
TFLint, A4, light preview Light · A4 210 × 297 mm · PDF TFLint, A4, dark preview Dark · A4 210 × 297 mm · PDF TFLint, A4, ink saver preview Ink saver · A4 210 × 297 mm · PDF
TFLint, A4 landscape, light preview Light · A4 landscape 297 × 210 mm · PDF TFLint, A4 landscape, dark preview Dark · A4 landscape 297 × 210 mm · PDF TFLint, A4 landscape, ink saver preview Ink saver · A4 landscape 297 × 210 mm · PDF
TFLint, A3, light preview Light · A3 297 × 420 mm · PDF TFLint, A3, dark preview Dark · A3 297 × 420 mm · PDF TFLint, A3, ink saver preview Ink saver · A3 297 × 420 mm · PDF
TFLint, A3 landscape, light preview Light · A3 landscape 420 × 297 mm · PDF TFLint, A3 landscape, dark preview Dark · A3 landscape 420 × 297 mm · PDF TFLint, A3 landscape, ink saver preview Ink saver · A3 landscape 420 × 297 mm · PDF
TFLint, Letter, light preview Light · Letter 8.5 × 11 in · PDF TFLint, Letter, dark preview Dark · Letter 8.5 × 11 in · PDF TFLint, Letter, ink saver preview Ink saver · Letter 8.5 × 11 in · PDF
TFLint, Tabloid, light preview Light · Tabloid 11 × 17 in · PDF TFLint, Tabloid, dark preview Dark · Tabloid 11 × 17 in · PDF TFLint, Tabloid, ink saver preview Ink saver · Tabloid 11 × 17 in · PDF

Start here

tflint --init
Install plugins
tflint
Lint this directory
tflint --recursive
Lint every module dir
tflint --chdir=<dir>
Lint another dir
tflint --format=compact
One line per issue
tflint --config=<file>
Use a config file
tflint --enable-rule=<rule>
Turn a rule on
tflint --fix
Auto-fix issues

Concepts

  1. .tflint.hcl plugins and rules
  2. Plugins rulesets on disk
  3. Rules run on your .tf files
  4. Issues error / warning / notice

Setup

brew install terraform-linters/tap/tflint
Install with Homebrew
tflint --version
Show version and loaded plugins
tflint --init
Install plugins from the config
tflint --recursive --init
Install plugins for all directories
docker run --rm -v $(pwd):/data -t ghcr.io/terraform-linters/tflint
Run the container image
export GITHUB_TOKEN=<token>
Avoid the --init rate limit
Unauthenticated --init is limited to 60 GitHub requests per hour per IP.

Running

tflint
Lint the current directory
tflint --chdir=<dir>
Lint a different directory
Config is then read from <dir>/.tflint.hcl; path.cwd stays the original directory.
tflint --recursive
Lint each directory below here
tflint --filter=<file>
Only report issues in this file or glob
tflint --fix
Apply automatic fixes
tflint --call-module-type=<all|local|none>
Choose which module calls to inspect
Default is local; all also downloads remote modules.
tflint --help
List all options

Output and exit codes

tflint --format=compact
One line per issue
tflint --format=json
Machine-readable output
tflint --format=sarif
SARIF for code scanning
tflint --no-color
Plain output
tflint --force
Exit 0 even if issues are found
Default exit codes: 0 clean, 1 error, 2 issues found.
tflint --minimum-failure-severity=<error|warning|notice>
Fail only at this severity or worse
Exit codes
Code Meaning
0 No issues
1 Error while running
2 Issues found

Rules

tflint --enable-rule=<rule>
Enable a rule for this run
tflint --disable-rule=<rule>
Disable a rule for this run
tflint --only=<rule>
Run just this rule
Rule priority, highest first
Source Where
1. --only CLI
2. --enable-rule / --disable-rule CLI
3. rule blocks Config file
4. preset terraform plugin config
5. disabled_by_default Config file

Config file

tflint --config=<file>
Use this config file
tflint --config=$(realpath .tflint.hcl) --recursive
Share one config across directories
With --recursive, relative config paths resolve inside each directory.
Config lookup order
Order File
1 --config
2 $TFLINT_CONFIG_FILE
3 ./.tflint.hcl
4 ./.tflint.json
5 ~/.tflint.hcl
6 ~/.tflint.json
plugin and rule blocks
plugin "aws" {  enabled = true  version = "0.4.0"  source  = "github.com/terraform-linters/tflint-ruleset-aws"}rule "terraform_typed_variables" {  enabled = true}
config block
config {  format              = "compact"  call_module_type    = "local"  disabled_by_default = false  varfile             = ["dev.tfvars"]  variables           = ["env=dev"]}
Plugin settings for the bundled ruleset
plugin "terraform" {  enabled = true  preset  = "recommended"}

Ignoring issues

Ignore one line
# tflint-ignore: <rule>instance_type = "t1.2xlarge"
Ignore with a reason
# tflint-ignore: <rule> # too new for TFLintinstance_type = "t1.2xlarge"
Ignore several rules or all
# tflint-ignore: <rule_a>, <rule_b># tflint-ignore: all
Ignore a whole file
# tflint-ignore-file: <rule>

Modules and variables

tflint --var-file=<file>
Load a tfvars file
terraform.tfvars and *.auto.tfvars load automatically.
tflint --var='<name>=<value>'
Set a variable
tflint --ignore-module=<source>
Skip a module by source
Use the module source, not its name in your code.

Recipes

First run in a repo
cat > .tflint.hcl <<'EOF'plugin "terraform" {  enabled = true  preset  = "recommended"}EOFtflint --inittflint --recursive
CI check with a report
tflint --inittflint --recursive --format=sarif > tflint.sarif# exit code 2 fails the job
Fail only on real problems
tflint --recursive --minimum-failure-severity=error