一个可插拔的 Terraform Linter
A Pluggable Terraform Linter
TFLint is a framework and each feature is provided by plugins, the key features are as follows:
Download the appropriate archive from the latest release, verify it, and install the binary:
curl -sSLO https://github.com/terraform-linters/tflint/releases/latest/download/tflint_linux_amd64.zip
curl -sSLO https://github.com/terraform-linters/tflint/releases/latest/download/checksums.txt
gh attestation verify checksums.txt -R terraform-linters/tflint
sha256sum --ignore-missing -c checksums.txt
unzip tflint_linux_amd64.zip
sudo install -c -v tflint /usr/local/bin/
Homebrew (macOS):
brew install terraform-linters/tap/tflint
WinGet (Windows):
winget install -e --id TerraformLinters.tflint
Go:
go install github.com/terraform-linters/tflint@latest
Artifact Attestations are available that can be verified using the GitHub CLI.
gh attestation verify checksums.txt -R terraform-linters/tflint
sha256sum --ignore-missing -c checksums.txt
[!WARNING] Cosign signatures are now deprecated. Please use GitHub CLI.
Cosign verify-blob command ensures that the release was built with GitHub Actions in this repository.
cosign verify-blob --certificate=checksums.txt.pem --signature=checksums.txt.keyless.sig --certificate-identity-regexp="^https://github.com/terraform-linters/tflint" --certificate-oidc-issuer=https://token.actions.githubusercontent.com checksums.txt
sha256sum --ignore-missing -c checksums.txt
Instead of installing directly, you can use the Docker image:
docker run --rm -v $(pwd):/data -t ghcr.io/terraform-linters/tflint
To download plugins, you can override the entrypoint to a shell (sh) to run --init and the main command in a single docker run command:
docker run --rm -v $(pwd):/data -t --entrypoint /bin/sh ghcr.io/terraform-linters/tflint -c "tflint --init && tflint"
If you want to run on GitHub Actions, setup-tflint action is available.
First, enable rules for Terraform Language (e.g. warn about deprecated syntax, unused declarations). TFLint Ruleset for Terraform Language is bundled with TFLint, so you can use it without installing it separately.
The bundled plugin enables the "recommended" preset by default, but you can disable the plugin or use a different preset. Declare the plugin block in .tflint.hcl like this:
plugin "terraform" {
enabled = true
preset = "recommended"
}
See the tflint-ruleset-terraform documentation for more information.
Next, If you are using an AWS/Azure/GCP provider, it is a good idea to install the plugin and try it according to each usage:
If you want to extend TFLint with other plugins, you can declare the plugins in the config file and easily install them with tflint --init.
plugin "foo" {
enabled = true
version = "0.1.0"
source = "github.com/org/tflint-ruleset-foo"
}
See also Configuring Plugins.
You can discover plugins from other organizations on GitHub via the tflint-ruleset topic.
If you want to add custom rules that are not in existing plugins, you can build your own plugin or write your own policy in Rego. See Writing Plugins or OPA Ruleset.
TFLint inspects files under the current directory by default. You can change the behavior with the following options/arguments:
…
See User Guide for details.
If you don't get the expected behavior, you can see the detailed logs when running with TFLINT_LOG environment variable.
$ TFLINT_LOG=debug tflint
See Developer Guide.
If you find a security vulnerability, please refer our security policy.
Please note that although much of this project is licensed under MPL 2.0, some files in the terraform package are licensed under BUSL 1.1.
For the reasons stated above, the executable forms (release binaries) is bound by both licenses.
暂无开放 Issues，或尚未同步最近议题。