360 Secure SkillHub
360 安全技能中心

Terraform Module Linter

核心功能：针对Terraform的.tf文件及模块，提供结构、命名、安全、最佳实践四大类共24条规则检查，支持按类别单独检测。典型场景：开发阶段规范Terraform代码，排查安全风险、结构缺陷。输入为.tf文件或模块目录，通过命令行指定检查类型与输出格式，支持文本、JSON、摘要三种输出形式，以不同退出码标识结果状态。

charlie-morrison
charlie-morrison
热度 54.45
最近更新 2026-05-11 17:42:55
分类：开发依赖：代码执行 / 读写文件应用场景：DevOps / 代码审查

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add terraform-module-linter
Metadata
name
terraform-module-linter
description
Lint Terraform modules and configurations (.tf files) for structure, naming, security, and best practices. 24 rules across structure, naming, security, and best practices categories. Supports HCL syntax parsing.

Terraform Module Linter

Lint Terraform .tf files and modules for structure, naming conventions, security issues, and best practices.

Commands

# Lint a Terraform directory (all rules)
python3 scripts/terraform_module_linter.py lint path/to/module/

# Check security issues only
python3 scripts/terraform_module_linter.py security path/to/module/

# Check naming conventions
python3 scripts/terraform_module_linter.py naming path/to/module/

# Validate module structure
python3 scripts/terraform_module_linter.py validate path/to/module/

# Lint a single file
python3 scripts/terraform_module_linter.py lint path/to/main.tf

# JSON output
python3 scripts/terraform_module_linter.py lint path/to/module/ --format json

# Summary only
python3 scripts/terraform_module_linter.py lint path/to/module/ --format summary

Rules (24)

Structure (6)

  • Missing main.tf, variables.tf, or outputs.tf
  • Missing terraform block with required_version
  • Missing required_providers block
  • Empty variable/output blocks
  • Unused variables (declared but not referenced)
  • Missing variable descriptions

Naming (6)

  • Resource names must be snake_case
  • Variable names must be snake_case
  • Output names must be snake_case
  • Module names must be snake_case
  • Local names must be snake_case
  • Data source names must be snake_case

Security (6)

  • Hardcoded credentials/secrets in values
  • Overly permissive IAM policies (*)
  • Missing encryption configuration
  • Public access enabled (public_access, publicly_accessible)
  • Hardcoded IP addresses (0.0.0.0/0)
  • Sensitive variables without sensitive flag

Best Practices (6)

  • Missing variable type constraints
  • Missing variable default values
  • Missing output descriptions
  • Using deprecated resource attributes
  • Missing lifecycle blocks for stateful resources
  • Missing tags on taggable resources

Output Formats

  • text (default): Human-readable with colors and severity icons
  • json: Machine-readable with file, line, rule, severity, message
  • summary: Counts by severity only

Exit Codes

  • 0: No issues (or warnings only)
  • 1: Errors found
  • 2: Invalid input