compatibility.md

Compatibility with Terraform

TFLint interprets the Terraform language with its own parser which is a fork of the Terraform's native one. This allows it to be parsed correctly even if Terraform is not installed at runtime.

The parser supports Terraform v1.x syntax and semantics. The language compatibility on Terraform v1.x is defined by Compatibility Promises. TFLint follows this promise. New features are only supported in newer TFLint versions, and bug and experimental features compatibility are not guaranteed.

Input Variables

Like Terraform, TFLint supports the --var, --var-file options, environment variables (TF_VAR_*), and automatically loading variable definitions (terraform.tfvars and *.auto.tfvars) files. See Input Variables.

Input variables are evaluated just like in Terraform:

variable "instance_type" {
  default = "t2.micro"
}

resource "aws_instance" "foo" {
  instance_type = var.instance_type # => "t2.micro"
}

Unknown variables (e.g. no default) are ignored:

variable "instance_type" {}

resource "aws_instance" "foo" {
  instance_type = var.instance_type # => ignored
}

Sensitive variables are ignored. This is to avoid unintended disclosure.

variable "instance_type" {
  sensitive = true
  default   = "t2.micro"
}

resource "aws_instance" "foo" {
  instance_type = var.instance_type # => ignored
}

Local Values

TFLint supports Local Values.

variable "foo" {
  default = "variable value"
}

locals {
  static   = "static value"
  variable = var.foo
  local    = local.static
  resource = aws_instance.main.arn
}

local.static   # => "static value"
local.variable # => "variable value"
local.local    # => "static value"
local.resource # => ignored (unknown)

The count and for_each Meta-Arguments

TFLint supports the count and for_each meta-arguments.

resource "aws_instance" "foo" {
  count = 0

  instance_type = "invalid" # => ignored because ths resource is not created
}

resource "aws_instance" "foo" {
  count = 2

  instance_type = "t${count.index}.micro" # => "t0.micro" and "t1.micro"
}

Note that this behavior may differ depending on a rule. Rules like terraform_deprecated_syntax will check resources regardless of the meta-argument values.

If the meta-arguments are unknown, the resource/module is ignored:

variable "count" {}

resource "aws_instance" "foo" {
  count = var.count

  instance_type = "invalid" # => ignored
}

The path.* and terraform.workspace Values

TFLint supports filesystem and workspace info.

• path.module
• path.root
• path.cwd
• terraform.workspace.

Unsupported Named Values

The values below are state-dependent and cannot be determined statically, so TFLint resolves them to unknown values.

• <RESOURCE TYPE>.<NAME>
• module.<MODULE NAME>
• data.<DATA TYPE>.<NAME>
• self

Built-in Functions

Built-in Functions are fully supported.

Dynamic Blocks

Dynamic blocks work just like normal blocks:

resource "aws_instance" "static" {
  ebs_block_device {
    encrypted = false # => Must be encrypted
  }
}

resource "aws_instance" "dynamic" {
  dynamic "ebs_block_device" {
    for_each = var.block_devices
    content {
      encrypted = false # => Must be encrypted
    }
  }
}

Note that iterator evaluation is not supported.

resource "aws_instance" "dynamic" {
  dynamic "ebs_block_device" {
    for_each = var.block_devices
    content {
      encrypted = ebs_block_device.value["encrypted"] # => ignored
    }
  }
}

Modules

Resources contained within modules are ignored by default, but when the Module Inspection is enabled, the arguments of module calls are inspected.

resource "aws_instance" "static" {
  ebs_block_device {
    encrypted = false # => Must be encrypted
  }
}

module "aws_instance" {
  source = "./module/aws_instance"

  encrypted = false # => Must be encrypted
}

Environment Variables

The following environment variables are supported:

• TF_VAR_name
• TF_DATA_DIR
• TF_WORKSPACE