You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
TFLint is a [Terraform](https://www.terraform.io/)linter focused on possible errors, best practices, etc.
10
+
A Pluggable [Terraform](https://www.terraform.io/)Linter
11
11
12
-
## Why TFLint is required?
13
-
14
-
Terraform is a great tool for Infrastructure as Code. However, many of these tools don't validate provider-specific issues. For example, see the following configuration file:
15
-
16
-
```hcl
17
-
resource "aws_instance" "foo" {
18
-
ami = "ami-0ff8a91507f77f867"
19
-
instance_type = "t1.2xlarge" # invalid type!
20
-
}
21
-
```
22
-
23
-
Since `t1.2xlarge` is a nonexistent instance type, an error will occur when you run `terraform apply`. But `terraform plan` and `terraform validate` cannot find this possible error beforehand. That's because it's an AWS provider-specific issue and it's valid as a Terraform configuration.
12
+
## Features
24
13
25
-
TFLint finds such errors in advance:
14
+
TFLint is a framework and each feature is provided by plugins, the key features are as follows:
26
15
27
-
16
+
- Find possible errors (like illegal instance types) for Major Cloud providers (AWS/Azure/GCP).
17
+
- Warn about deprecated syntax, unused declarations.
18
+
- Enforce best practices, naming conventions.
28
19
29
20
## Installation
30
21
31
-
You can download the binary built for your architecture from [the latest release](https://github.com/terraform-linters/tflint/releases/latest). The following is an example of installation on macOS:
For Linux based OS, you can use the [`install_linux.sh`](https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh) to automate the installation process, or try the following oneliner to download latest binary for AMD64 architecture.
macOS users can also use [Homebrew](https://brew.sh) to install TFLint:
28
+
Homebrew (macOS):
50
29
51
30
```console
52
31
$ brew install tflint
53
32
```
54
33
55
-
### Chocolatey
56
-
57
-
Windows users can use [Chocolatey](https://chocolatey.org):
34
+
Chocolatey (Windows):
58
35
59
36
```cmd
60
37
choco install tflint
61
38
```
62
39
63
-
### Docker
64
-
65
-
You can also use [TFLint via Docker](https://hub.docker.com/r/wata727/tflint/).
40
+
Docker:
66
41
67
42
```console
68
43
$ docker run --rm -v $(pwd):/data -t wata727/tflint
69
44
```
70
45
71
-
## Features
72
-
73
-
700+ rules are available. See [Rules](docs/rules).
74
-
75
-
## Providers
76
-
77
-
TFLint supports multiple providers via plugins. The following is the Major Cloud support status.
46
+
Please note that this Docker image is not suitable for production CI/CD pipelines.
78
47
79
-
|name|status|description|
80
-
|---|---|---|
81
-
|[AWS](https://github.com/terraform-linters/tflint-ruleset-aws)|Available|Inspections for AWS resources are now built into TFLint. So, it is not necessary to install the plugin separately. In the future, these will be cut out to the plugin, but all are in progress.|
82
-
|[Azure](https://github.com/terraform-linters/tflint-ruleset-azurerm)|Experimental|Experimental support has been started. You can inspect Azure resources by installing the plugin.|
83
-
|[Google Cloud Platform](https://github.com/terraform-linters/tflint-ruleset-google)|Experimental|Experimental support has been started. You can inspect GCP resources by installing the plugin.|
48
+
## Getting Started
84
49
85
-
Please see the [documentation](docs/guides/extend.md) about the plugin system.
50
+
If you are using an AWS/Azure/GCP provider, it is a good idea to install the plugin and try it according to each usage:
86
51
87
-
## Limitations
52
+
-[Amazon Web Services](https://github.com/terraform-linters/tflint-ruleset-aws)
TFLint load configurations in the same way as Terraform v0.13. This means that it cannot inspect configurations that cannot be parsed on Terraform v0.13.
56
+
For AWS users, you can use the bundled plugin built into the TFLint binary without installing the plugin separately for backward compatibility.
90
57
91
-
See [Compatibility with Terraform](docs/guides/compatibility.md) for details.
58
+
Rules for the Terraform Language is built into the TFLint binary, so you don't need to install any plugins. Please see [Rules](docs/rules) for a list of available rules.
92
59
93
60
## Usage
94
61
95
-
TFLint inspects all configurations under the current directory by default. You can also change the behavior with the following options:
62
+
TFLint inspects files under the current directory by default. You can change the behavior with the following options/arguments:
96
63
97
64
```
98
65
$ tflint --help
@@ -111,12 +78,6 @@ Application Options:
111
78
--var-file=FILE Terraform variable file name
112
79
--var='foo=bar' Set a Terraform variable
113
80
--module Inspect modules
114
-
--deep Enable deep check mode
115
-
--aws-access-key=ACCESS_KEY AWS access key used in deep check mode
116
-
--aws-secret-key=SECRET_KEY AWS secret key used in deep check mode
117
-
--aws-profile=PROFILE AWS shared credential profile name used in deep check mode
118
-
--aws-creds-file=FILE AWS shared credentials file path used in deep checking
119
-
--aws-region=REGION AWS region used in deep check mode
120
81
--force Return zero exit status even if issues found
121
82
--no-color Disable colorized output
122
83
--loglevel=[trace|debug|info|warn|error] Change the loglevel (default: none)
@@ -125,25 +86,20 @@ Help Options:
125
86
-h, --help Show this help message
126
87
```
127
88
128
-
See [User guide](docs/guides) for each option.
129
-
130
-
## Exit Statuses
131
-
132
-
TFLint returns the following exit statuses on exit:
133
-
134
-
- 0: No issues found
135
-
- 2: Errors occurred
136
-
- 3: No errors occurred, but issues found
89
+
See [User Guide](docs/user-guide) for details.
137
90
138
91
## FAQ
92
+
139
93
### Does TFLint check modules recursively?
140
-
- No. TFLint always checks only the current root module (no recursive check)
94
+
No. TFLint always checks only the current root module (no recursive check). However, you can check calling child modules based on module arguments by enabling [Module Inspection](docs/user-guide/module-inspection.md). This allows you to check that you are not passing illegal values to the module.
95
+
96
+
Note that if you want to recursively inspect local modules, you need to run them in each directory. This is a limitation that occurs because Terraform always works for one directory. TFLint tries to emulate Terraform's semantics, so cannot perform recursive inspection.
141
97
142
98
### Do I need to install Terraform for TFLint to work?
143
-
-No. TFLint works as a single binary because Terraform is embedded as a library. Note that this means that the version of Terraform used is determined for each TFLint version. See also [Compatibility with Terraform](docs/guides/compatibility.md).
99
+
No. TFLint works as a single binary because Terraform is embedded as a library. Note that this means that the version of Terraform used is determined for each TFLint version. See also [Compatibility with Terraform](docs/user-guide/compatibility.md).
144
100
145
-
### TFLint causes a loading error in my code that is valid in Terraform. Why?
146
-
-First, check the version of Terraform you are using. Terraform v0.12 introduced a major syntax change, and unfortunately TFLint only supports that new syntax.
101
+
### TFLint reports a loading error in my code, but this is valid in Terraform. Why?
102
+
First, check the version of Terraform and TFLint you are using. TFLint loads files differently than the installed Terraform, so an error can occur if the version of Terraform supported by TFLint is different from the installed Terraform.
TFLint rules are provided by plugins. The plugin is launched as another process and communicates over RPC. Inspection requests and configuration file fetching, expression evaluation, etc. are performed by bi-directional communication, and the host process and plugin process act as both a server and a client.
6
+
7
+
The plugin system is implemented by [go-plugin](https://github.com/hashicorp/go-plugin). Since it uses a `net/rpc` based implementation, it uses [hashicorp/yamux](https://github.com/hashicorp/yamux) for communication multiplexing. See also [the go-plugin architecture description](https://github.com/hashicorp/go-plugin#architecture).
Go 1.15 or higher is required to build TFLint from source code. Clone the source code and run the `make` command. Built binary will be placed in `dist` directory.
If you change code, make sure that the tests you add and existing tests will be passed:
16
+
17
+
```console
18
+
$ make test
19
+
```
20
+
21
+
## Run E2E tests
22
+
23
+
You can check the actual CLI behavior by running the E2E tests. Since the E2E tests uses the installed `tflint` command, it is necessary to add the path into `$PATH` environment so that the binary built by `go install` can be referenced.
TFLint is just a thin wrapper of Terraform. Configuration loading and expression evaluation etc. depend on Terraform's internal API, and it only provides an interface to do them as a linter.
4
+
5
+
Rules are provided by plugins except some rules. Technically, the plugin is launched as another process, communicates via RPC, and receives inspection results from the plugin process.
6
+
7
+
There are important packages to understand its behavior:
8
+
9
+
-`tflint`
10
+
- This package is the core of TFLint as a wrapper for Terraform. It allows accesses to `terraform/configs.Config` and `terraform/terraform.BuiltinEvalContext` and so on.
11
+
-`plugin`
12
+
- This package provides the TFLint plugin system. Includes plugin discovery, a server implementation responding to requests from plugins.
If you want to add or change rules, you need to write plugins. When changing plugins, refer to the repository of each plugin and refer to how to build and install.
4
+
5
+
If you want to create a new plugin, please refer to [tflint-ruleset-template](https://github.com/terraform-linters/tflint-ruleset-template). The plugin can use [tflint-plugin-sdk](https://github.com/terraform-linters/tflint-plugin-sdk) to communicate with the host process. You can easily create a new repository from "Use this template".
0 commit comments