IaC rules
No rules match. Clear the filters or try another search.
| Rule | Category | Introduced |
|---|---|---|
IaC conditional-resource-presence Prefer stable Terraform resource presence or an explicit review justification. | maintainability | |
IaC expression-complexity Limit Terraform statement and variable-validation expression complexity. | maintainability | |
IaC no-boolean-enable-variable Require a retirement date and removal plan, or a permanent rationale, for Boolean inputs. | maintainability | |
IaC no-comment-cruft Commented-out HCL declarations or decorative divider comments must be removed; retain comments that explain constraints or rationale. | maintainability | |
IaC no-dead-environment-input Find undeclared tfvars assignments and potentially redundant scalar values across discovered Terraform environments. | maintainability | |
IaC no-duplicate-deployment-literal Share repeated cloud deployment values through variables, locals or resource references. | maintainability | |
IaC no-environment-conditional Warn when Terraform chooses behavior from deployment-identity comparisons; prefer explicit typed capabilities or values. | architecture | |
IaC no-hardcoded-deployment-location Pass cloud deployment regions, zones and locations through explicit configuration inputs. | architecture | |
IaC no-managed-service-account-key Disallow Terraform-managed Google service-account keys. | security | |
IaC no-mocked-terraform-test-oracle Warn when a Terraform assertion directly reasserts the same literal injected by a module override. | testing | |
IaC no-nested-conditional Prefer a named value or explicit input over chained Terraform conditional selections. | maintainability | |
IaC no-plaintext-secret-env A secret-named container environment variable should come from a secret reference, not a plain value. | security | |
IaC no-project-basic-privilege Disallow proven project IAM Owner and Editor grants. | security | |
IaC no-project-secret-access-for-service-account Grant service accounts Secret Manager access per secret, not on the project. | security | |
IaC no-redundant-variable-validation Flag Terraform variable validations already guaranteed by the declared type or nullability. | maintainability | |
IaC no-restated-comment Flag a short comment attached to an HCL declaration when it only repeats that declaration's kind, label, or attribute name. | maintainability | |
IaC no-terraform-comments Express Terraform intent through names and descriptions, with optional concise module summaries. | style | |
IaC no-terraform-data-condition Disallow lifecycle conditions attached to terraform_data guard resources. | maintainability | |
IaC no-terraform-guard-blocks Ban Terraform validation, precondition, postcondition, and check blocks. | maintainability | |
IaC require-deletion-protection Require a curated stateful Terraform resource to declare a proven provider-native deletion guard or literal lifecycle destroy guard. | correctness | |
IaC require-prevent-destroy-on-irreplaceable Require a curated durable-data container to declare a literal provider-side deletion guard or Terraform lifecycle destroy guard. | correctness |