Static Code Analysis
Lint a Terraform root module with bundled rules
tflint is an offline Terraform linter using the bundled recommended ruleset.
overview
What tflint does
Lint one Terraform root module with bundled Terraform recommended rules and emit native TFLint JSON. No provider plugins, init, plan, apply or module downloads.
Analyze top-level .tf and .tf.json files with a fixed configuration and return native JSON issues and errors. Findings include rule names, severity, messages and source ranges. Findings are successful report data; invalid HCL or operational analysis failures fail without a success report.
Up to 200 nonhidden source files, 10 MiB and 10000 directory entries are accepted, with a 180-second analysis limit and 16 MiB per output stream. Repository .tflint configuration, .tfvars, nested modules and .terraform are ignored. Symlinks and special files are rejected.
Packaged version: 0.64.0. Upstream license: MPL-2.0.
source github.com/terraform-linters/tflint/tree/15c65a33b322750f6131e286cd9597896299ba32
use cases
Where tflint fits
Find unused declarations
Locate variables that the bundled rules mark as unused.
Retain source ranges
Receive filename, line and column information with each issue.
Keep analysis offline
Lint one root module without downloading plugins or traversing modules.
reference
tflint inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| source | FOLDER | --source | One root module with top-level .tf/.tf.json files, up to 200 files and 10 MiB. Submodules, .tfvars and repository TFLint config ignored. |
Showing key inputs. tflint exposes 1 inputs in total.
example
Run tflint
python3 /app/run.py --source ./source ./output{
"issues": [
{
"rule": {
"name": "terraform_unused_declarations",
"severity": "warning",
"link": "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.15.0/docs/rules/terraform_unused_declarations.md"
},
"message": "variable \"unused_example\" is declared but not used",
"range": {
"filename": "main.tf",
"start": {
"line": 4,
"column": 1
},
"end": {
"line": 4,
"column": 26
}
},
"callers": [],
"fixable": true,
"fixed": false
}
],
"errors": []
}guidance
Choosing tflint
Use tflint for the bundled Terraform recommended lint rules. It installs no provider plugins, runs no Terraform binary, and performs no init, plan, apply or cloud checks. A formatter changes layout; these findings describe lint issues. Native paths refer to the temporary project.
faq
tflint questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
malcontent-scan
A package coordinate in, behavior findings out.
osv-malicious
A package coordinate in, malware advisory rows out.
Run tflint yourself
The downloaded synthetic verifier retained the native JSON object below. It reports an unused variable in main.tf at line 4. JSON whitespace is reformatted for display; no new run was performed. The command shows the container entrypoint with example paths.
Facts on this page come from the live Trickest tool library.