All Rules

The Terraform lexicon provides 26 rules: 1 lint rule and 25 post-synth checks.

Lint Rules

ID	Severity	Category	Description
`TF101`	error	correctness	terraformApply’s planFile must reference a preceding terraformPlan step.

Post-Synth Checks

Post-synth checks validate the serialized output after the build pipeline completes.

ID	Description
`TF001`	Root module declares no remote backend
`TF002`	A provider the root implies has no required_providers entry, or an incomplete one
`TF003`	Root module’s terraform block has no required_version
`TF004`	Registry-sourced module block has no version
`TF005`	Git/hg module source is unpinned, or pinned to a mutable ref
`TF006`	Sensitive variable declares a default value
`TF007`	Secret-shaped literal in a variable default or a locals value
`TF008`	Provider block configures a hardcoded credential
`TF009`	Credential-named variable is not marked sensitive
`TF010`	Variable declares no type constraint
`TF011`	Variable declares no description
`TF012`	Output declares no description
`TF013`	lifecycle ignore_changes is set to all
`TF014`	Child module configures a provider block
`TF015`	Child module declares a backend or cloud block
`TF016`	Attribute value is a quoted interpolation of a single expression
`TF017`	Module block uses depends_on
`TF018`	Output value is a whole resource or data source
`TF019`	Meta-argument explicitly set to its default of false
`TF020`	Declaration is never referenced in its module scope
`TF021`	count builds instance identities from count.index where for_each is safer
`TF022`	Credential-named resource attribute holds a plaintext literal
`TF024`	Live root declares a backend or cloud block, which choudoufu refuses
`TF025`	Live root references a non-default terraform.workspace, which choudoufu refuses
`TF026`	Live root declares delete: “never” but its policy leaves undeclared_tagged at “delete”