Static analysis checks source code without deploying or running the software it defines. For infrastructure as code (IaC), it provides early feedback on syntax, formatting, conventions, and security problems—locally and in CI. Because IaC is highly declarative, checks such as cyclomatic complexity and test coverage are less useful than they are for imperative code. section 6.3.6
A practical Terraform feedback loop separates three kinds of checks:
- Run Terraform CLI validation and formatting checks; correct syntax errors and apply canonical formatting. section 6.3.6
- Run Tflint for deprecations, cloud-provider parameters, best practices, and naming conventions. Configure its AWS plugin when checking AWS resources. section 6.3.6
- Run Trivy’s config scan against Terraform files, then correct reported security problems. section 6.3.6
plugin "terraform" {
enabled = true
preset = "all"
}
plugin "aws" {
enabled = true
version = "0.30.0"
source = "github.com/terraform-linters/tflint-ruleset-aws"
}
This Tflint configuration enables Terraform checks and an AWS ruleset, making the linting step specific to the cloud provider in use. section 6.3.6
Check a Terraform change before deployment
For a main.tf containing a VPC and an ingress rule open to 0.0.0.0/0 across ports 0–65535, validate and format the file, clear Tflint warnings, and scan it with Trivy. Treat the findings as changes to make and recheck, not as a substitute for testing the deployed configuration. section 6.3.6 section 6.3.3
In an infrastructure pipeline, static analysis belongs in CI before deployment to the first test environment. A Terraform plan then shows expected changes; after apply, tests can compare actual configuration with the desired state. Recurring tests serve a different purpose: detecting drift from manual changes. section 6.3.3 section 6.4.4
