A Terraform configuration can be valid yet still contain an unused provider declaration, missing version constraint, or inconsistent conventions. TFLint checks configuration without running it. It is a static-analysis linter: it flags errors and policy violations, but it does not establish whether the infrastructure logic is right. section 7.3.3
TFLint gets its rules from plugins. In the project-root `.tflint.hcl`, enable the Terraform plugin explicitly; it is installed alongside TFLint but is not enabled by default. Its `recommended` preset selects a subset of rules. Choose `all` for broader checks, or enable and disable individual rules to match the project’s conventions. Rules can, for example, require descriptions on variables and outputs and types on variables. section 7.3.3
Run a local lint check
A Makefile target can run `tflint --init` followed by `tflint`. One example run reports a missing Terraform `required_version` and an AWS provider declared in `required_providers` but unused by the module. Review each finding rather than treating every warning as a change to make automatically. section 7.3.3
Listing 7.21 TFLint usage
$ make test_tflint #1
tflint --init #2
tflint #3
2 issue(s) found:
Warning: terraform "required_version" attribute is required (
terraform_required_version) #4
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/
blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: provider 'aws' is declared in required_providers but not used by
the module (terraform_unused_required_providers) #5
on providers.tf line 3:
3: aws = {
4: source = "hashicorp/aws"
5: version = "~> 5.0"
6: }
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/
blob/v0.5.0/docs/rules/terraform_unused_required_providers.md
make: *** [test_lint] Error 2 #6
#1 Call out to the Make target to run tflint.
#2 Since this command is really fast we run it every time.
#3 Now Make runs tflint.
#4 I never set a minimum Terraform version in my module.
#5 Since this was a brand-new module with no resources, TFLint detected that the AWS provider was declared but not used.
#6 Make exited with an error after TFLint returned its own failure.
The command output shows how TFLint names a violated rule and points to the relevant configuration when source is available. section 7.3.3
For provider-specific checks, enable the AWS, Azure, or Google plugin as needed. A rule that is unsuitable for a particular configuration can be disabled in `.tflint.hcl`; a local exception can use an inline `tflint-ignore` comment. Custom policies are also possible through the OPA plugin and Rego. That route is most appropriate for teams already using OPA: the plugin is experimental, and learning Rego adds work. section 7.3.3 section 7.5.1
Run `tflint --fix` only after inspecting ordinary lint results and deciding which violations to address. Many, but not all, rules support autofix. A fix can reformat a file, and a mechanically valid change may be wrong for an application that intentionally uses a deprecated feature. Record justified exceptions first, then review the resulting edits. section 7.6.3
Listing 7.40 TFLint on GitHub Actions
name: Lint
on: #1
push:
pull_request:
jobs:
tflint:
runs-on: ubuntu-latest
steps:
- name: Checkout source code #2
uses: actions/checkout@v4 #3
- name: Setup TFLint
uses: terraform-linters/setup-tflint@v4 #4
- name: Run TFLint
run: make test_tflint #5
This GitHub Actions workflow checks out the code, installs TFLint, and runs the Makefile lint target on pushes and pull requests. section 7.7.2
Running the same lint target in continuous integration makes findings visible on the associated pull request. A failing step fails the workflow, so teams can catch configuration-quality problems before merging. section 7.7.2
