Terraform Advanced — TFLint & tfsec

Static analysis catches issues before you run terraform plan.

---

TFLint

# Install
brew install tflint

# Initialize with AWS ruleset
cat > .tflint.hcl <<EOF
plugin "aws" {
  enabled = true
  version = "0.30.0"
  source  = "github.com/terraform-linters/tflint-ruleset-aws"
}
EOF

tflint --init
tflint

What TFLint Catches

# ❌ TFLint catches invalid instance types
resource "aws_instance" "app" {
  instance_type = "t2.superxlarge"  # Error: invalid instance type
}

# ❌ Catches deprecated arguments
resource "aws_s3_bucket" "data" {
  acl = "private"  # Warning: use aws_s3_bucket_acl resource instead
}

---

tfsec (Now Trivy)

# Install
brew install tfsec

# Scan
tfsec .

What tfsec Catches

# ❌ tfsec flags security issues
resource "aws_s3_bucket" "data" {
  bucket = "my-data"
  # HIGH: S3 bucket does not have encryption enabled
  # HIGH: S3 bucket does not have versioning enabled
  # MEDIUM: S3 bucket does not have logging enabled
}

---

.tfsec Config

Suppress known false positives:

# .tfsec/config.yml
exclude:
  - AWS002  # S3 logging not needed for temp buckets

Or inline:

resource "aws_s3_bucket" "temp" {
  bucket = "temp-processing"
  #tfsec:ignore:AWS002
}

---

What’s Next?

Use Terraform’s built-in test framework.

← Testing Pyramid Terraform Test Framework →