TFLint

Visit Website

Introduction

TFLint is a framework for linting Terraform code. Its README lists three aims: find possible errors such as invalid instance types for major cloud providers, warn about deprecated syntax and unused declarations, and enforce best practices and naming conventions.

Much of its value comes from plugins. Rulesets for AWS, Azure and Google Cloud know provider details, so TFLint can flag an EC2 instance type that does not exist before terraform plan ever talks to the cloud. The bundled Terraform ruleset covers language-level issues, and teams can write custom rulesets in Go or use policy plugins.

TFLint runs from a .tflint.hcl configuration, supports recursive scanning of module trees, and outputs formats such as JSON, Checkstyle, JUnit and SARIF for CI and code scanning. In the quality loop it is a fast pre-merge check that sits before security scanners and real deployment tests.

The source code is at terraform-linters/tflint on GitHub under the MPL-2.0 licence, with about 5,900 stars; the most recent commit was on 8 November 2026.

Features

1. Provider rulesets: AWS, Azure and Google Cloud plugins for provider-specific errors.
2. Terraform ruleset: Deprecated syntax, unused declarations and naming rules.
3. Custom rules: Write rulesets in Go via the plugin SDK.
4. Recursive scanning: Lint every module in a repository.
5. CI outputs: JSON, Checkstyle, JUnit, SARIF and compact formats.
6. Inline ignores: Suppress specific findings with comments.

Pros

1. Fast feedback: Runs in seconds without cloud credentials for most rules.
2. Free to use: Open source under the MPL-2.0 licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 8 November 2026.
4. Community: About 5,900 GitHub stars.

Cons

1. Not a security scanner: Pair it with Checkov, KICS or Trivy for misconfiguration checks.
2. Plugin setup: Provider rulesets must be declared and initialised.
3. Static only: It cannot prove the infrastructure works once deployed.

Usage and Links (Example)

# .tflint.hcl
plugin "aws" {
  enabled = true
  version = "0.40.0"
  source  = "github.com/terraform-linters/tflint-ruleset-aws"
}

tflint --init
tflint --recursive --format compact

Pin plugin versions so CI results do not change unexpectedly.

Resources:

• TFLint website

Pricing

TFLint is free and open source under the MPL-2.0 licence.

Recommended for?

1. Terraform teams that want quick, provider-aware checks on every pull request.
2. Module authors enforcing naming and documentation conventions.
3. Pipelines that run lint before security scans and plans.

Conclusion

TFLint catches the class of Terraform mistakes that only show up at plan or apply time, and does it in seconds.

It is a cheap first gate; combine it with a security scanner and, for critical modules, real deployment tests.

On CheckOps, TFLint is filed under the Release & CI gates stage. Related tools listed here include Terratest, Test Kitchen, Molecule, Goss, Chef InSpec and terraform-compliance. A short trial on a real project, with your own code, data and pipeline, is usually the fastest way to choose between them, because fit matters more than feature lists. Facts here come from the official site, documentation and repository, checked on 11 November 2026.