All Rules

llms.txt lists every page for an agent

The Terraform lexicon provides 45 rules: 1 lint rule and 44 post-synth checks.

Lint Rules

ID	Severity	Category	Description
`TF101`	error	correctness	terraformApply’s planFile must reference a preceding terraformPlan step.

Post-Synth Checks

Post-synth checks validate the serialized output after the build pipeline completes.

ID	Description
`TF001`	Root module declares no remote backend
`TF002`	A provider the root implies has no required_providers entry, or an incomplete one
`TF003`	Root module’s terraform block has no required_version
`TF004`	Registry-sourced module block has no version
`TF005`	Git/hg module source is unpinned, or pinned to a mutable ref
`TF006`	Sensitive variable declares a default value
`TF007`	Secret-shaped literal in a variable default or a locals value
`TF008`	Provider block configures a hardcoded credential
`TF009`	Credential-named variable is not marked sensitive
`TF010`	Variable declares no type constraint
`TF011`	Variable declares no description
`TF012`	Output declares no description
`TF013`	lifecycle ignore_changes is set to all
`TF014`	Child module configures a provider block
`TF015`	Child module declares a backend or cloud block
`TF016`	Attribute value is a quoted interpolation of a single expression
`TF017`	Module block uses depends_on
`TF018`	Output value is a whole resource or data source
`TF019`	Meta-argument explicitly set to its default of false
`TF020`	Declaration is never referenced in its module scope
`TF021`	count builds instance identities from count.index where for_each is safer
`TF022`	Credential-named resource attribute holds a plaintext literal
`TF024`	Live root declares a backend or cloud block, which choudoufu refuses
`TF025`	Live root references a non-default terraform.workspace, which choudoufu refuses
`TF026`	Live root declares delete: “never” but its policy leaves undeclared_tagged at “delete”
`TF027`	Live root’s policy block sets undeclared_untagged = “delete”, which deletes resources chant does not own
`TF028`	A live root is watched by a TerraformWatchOp built without live: true
`TF029`	Live root names its estate both in chant.config and in its own HCL
`TF030`	Security group rule allows unrestricted ingress on a sensitive port
`TF031`	IAM policy allows a wildcard Action or Resource
`TF032`	ECS container definition passes a credential as a plaintext environment value
`TF033`	RDS DB instance or cluster storage is not encrypted
`TF034`	SNS topic has no server-side encryption
`TF035`	SQS queue turns server-side encryption off
`TF036`	EBS volume does not ask for encryption
`TF037`	ECR repository allows mutable image tags
`TF038`	OCI module source has no tag or digest, or a mutable tag
`TF039`	Registry module version is a range, not an exact version
`TF040`	Root has no committed .terraform.lock.hcl
`TF041`	Terragrunt dependency lets mock_outputs stand in for apply
`TF042`	Terragrunt dependency sets skip_outputs together with mock_outputs
`TF043`	Terragrunt terraform.source names no version (git ref, tfr version or oci tag)
`TF044`	Terragrunt config keeps state in a local backend
`TF045`	No Terragrunt config sets terragrunt_version_constraint

chant