Validate, lint, audit, or plan Terraform/.tf/HCL files; runs tflint, checkov, terraform validate.

Terraform Validator Comprehensive toolkit for validating, linting, and testing Terraform configurations with automated workflows for syntax validation, security scanning, and intelligent documentation lookup. ⚠️ Critical Requirements Checklist STOP: You MUST complete these steps in order. Do NOT skip any REQUIRED step. Step Action Required 1 Run bash scripts/extract tf info wrapper.sh <path ✅ REQUIRED 2 Context7 lookup for ALL providers (explicit AND implicit); WebSearch fallback if not found ✅ REQUIRED 3 READ references/security checklist.md ✅ REQUIRED 4 READ references/best practices.md ✅ REQUIRED 5 Run terraform fmt ✅ REQUIRED 6 Run tflint (or note as skipped if unavailable) Recommended 7 Run terraform init (if not initialized) ✅ REQUIRED 8 Run terraform validate ✅ REQUIRED 9 Run bash scripts/run checkov.sh <path ✅ REQUIRED 10 Cross reference findings with security checklist.md sections ✅ REQUIRED 11 Generate report citing reference files ✅ REQUIRED 12 Run regression tests ( bash tests/test regression.sh ) ✅ REQUIRED 13 Run lightweight CI checks ( bash n , py compile , smoke) ✅ REQUIRED IMPORTANT: Steps 3 4 (reading reference files) must be completed BEFORE running security scans. The reference files contain remediation patterns that MUST be cited in your report. Context7 Fallback: If Context7 does not have a provider (common for: random, null, local, time, tls), use WebSearch: "terraform provider {name} hashicorp documentation" When to Use This Skill Working with Terraform files ( .tf , .tfvars , .tfstate ) Validating Terraform configuration syntax and structure Linting and formatting HCL code Performing dry run testing with terraform plan Debugging Terraform errors or misconfigurations Understanding custom Terraform providers or modules Security validation of Terraform configurations External Documentation Tool Documentation Terraform [developer.hashicorp.com/terraform](https://developer.hashicorp.com/terraform/docs) TFLint [github.com/terraform linters/tflint](https://github.com/terraform linters/tflint) Checkov [checkov.io](https://www.checkov.io/1.Welcome/Quick%20Start.html) Trivy [aquasecurity.github.io/trivy](https://aquasecurity.github.io/trivy) Validation Workflow IMPORTANT: Follow this workflow in order. Each step is REQUIRED unless explicitly marked optional. Required Reference File Reading You MUST read these reference files during validation: When Reference File Action Before security scan references/security checklist.md Read to understand security checks and remediation patterns During validation references/best practices.md Read to validate project structure, naming, and patterns If errors occur references/common errors.md Read to find solutions for specific error messages If using Terraform 1.10+ references/advanced features.md Read to understand ephemeral values, actions, list resources Required Script Usage You MUST use these wrapper scripts instead of calling tools directly: Task Script Command Extract provider/module info extract tf info wrapper.sh bash scripts/extract tf info wrapper.sh <path Run security scan run checkov.sh bash scripts/run checkov.sh <path Install checkov (if missing) install checkov.sh bash scripts/install checkov.sh install Note: extract tf info wrapper.sh automatically handles the python hcl2 dependency. If system Python lacks python hcl2 , it creates/reuses a cached virtual environment under ~/.cache/terraform validator/ by default. Script Run Context (REQUIRED) Default working directory: devops skills plugin/skills/terraform validator If running from elsewhere, use absolute script paths: bash /absolute/path/to/terraform validator/scripts/extract tf info wrapper.sh <path bash /absolute/path/to/terraform validator/scripts/run checkov.sh <path bash /absolute/path/to/terraform validator/scripts/install checkov.sh install Context7 Provider Documentation Lookup (REQUIRED) For EVERY provider detected, you MUST lookup documentation via Context7: Example for AWS provider: Context7 Fallback to WebSearch (REQUIRED) If Context7 does not find a provider, you MUST fall back to WebSearch: WebSearch Fallback Example: Note: HashiCorp utility providers (random, null, local, time, tls, archive, external, http) may not be indexed in Context7. Always fall back to WebSearch for these. Detecting Implicit Providers (REQUIRED) IMPORTANT: Providers can be used without being declared in required providers . You MUST detect ALL providers: Detection Methods 1. Explicit Providers: Listed in required providers block (from extract tf info wrapper.sh output) 2. Implicit Providers: Inferred from resource type prefixes Common Implicit Provider Patterns Resource Type Prefix Provider Name Context7 Lookup random random terraform provider random null null terraform provider null local local terraform provider local tls tls terraform provider tls time time terraform provider time archive archive terraform provider archive http (data source) http terraform provider http external (data source) external terraform provider external Workflow for Complete Provider Detection Example If extract tf info wrapper.sh returns: You MUST lookup BOTH: terraform provider aws (explicit) terraform provider random (implicit detected from random id resource) Quick Reference Commands Format and Lint TFLint Configuration: See [TFLint Ruleset documentation](https://github.com/terraform linters/tflint/blob/master/docs/user guide/plugins.md) for plugin setup. Validate Configuration Security Scanning MUST use wrapper script: Detailed Security Scanning: You MUST read references/security checklist.md before running security scans to understand the checks and remediation patterns. Security Finding Cross Reference (REQUIRED) When reporting security findings, you MUST cite specific sections from security checklist.md : Cross Reference Mapping Checkov Check Pattern security checklist.md Section CKV AWS 24 (SSH open) "Overly Permissive Security Groups" CKV AWS 260 (HTTP open) "Overly Permissive Security Groups" CKV AWS 16 (RDS encryption) "Encryption at Rest" CKV AWS 17 (RDS public) "RDS Databases" CKV AWS 130 (public subnet) "Network Security" CKV AWS 53 56 (S3 public access) "Public S3 Buckets" CKV AWS (IAM) "IAM Security" CKV AWS 79 (IMDSv1) "ECS/EKS" Hardcoded passwords "Hardcoded Credentials" Sensitive outputs "Sensitive Output Exposure" Report Template for Security Findings Example Cross Referenced Report hcl variable "admin cidr" { description = "CIDR block for admin access" type = string } resource "aws security group" "app" { ingress { description = "SSH from admin network only" from port = 22 to port = 22 protocol = "tcp" cidr blocks = [var.admin cidr] } } Dry Run Testing Plan Output Symbols: + Resources to be created Resources to be destroyed ~ Resources to be modified /+ Resources to be replaced Handling Missing Tools When validation tools are not installed, follow this recovery workflow: Recovery Workflow (REQUIRED) Tool Specific Recovery If checkov is missing: If tflint is missing: If python hcl2 is missing: Required tools: terraform fmt , terraform init , terraform validate Required for full security validation: checkov Optional but recommended: tflint Scripts Script Purpose Usage extract tf info wrapper.sh Parse Terraform files for providers/modules (auto handles dependencies) bash scripts/extract tf info wrapper.sh <path extract tf info.py Core parser (requires python hcl2) Use wrapper instead run checkov.sh Wrapper for Checkov scans with enhanced output bash scripts/run checkov.sh <path install checkov.sh Install Checkov in isolated venv bash scripts/install checkov.sh install Reference Documentation MUST READ during validation workflow: Reference When to Read Content references/security checklist.md Before security scan Security validation, Checkov/Trivy usage, common policies, remediation patterns references/best practices.md During validation Project structure, naming conventions, module design, state management references/common errors.md When errors occur Error database with causes and solutions references/advanced features.md If Terraform = 1.10 Ephemeral values (1.10+), Actions (1.14+), List Resources (1.14+) Workflow Examples Example 1: Validate Single File Example 2: Full Module Validation Example 3: Production Dry Run Advanced Features Terraform 1.10+ introduces ephemeral values for secure secrets management. Terraform 1.14+ adds Actions for imperative operations and List Resources for querying infrastructure. MUST READ: references/advanced features.md when: Terraform version = 1.10 is detected Configuration uses ephemeral blocks Configuration uses action blocks Configuration uses .tfquery.hcl files Integration with Other Skills k8s yaml validator For Terraform Kubernetes provider validation helm validator When Terraform manages Helm releases k8s debug For debugging infrastructure provisioned by Terraform Notes Always run validation in order: extract info → lookup docs → read refs → format → lint → validate → security → plan MUST use wrapper scripts for extract tf info and checkov MUST run bash tests/test regression.sh after script changes MUST run lightweight CI checks: bash n scripts/ .sh and python3 m py compile scripts/ .py MUST read reference files before relevant validation steps MUST lookup provider docs via Context7 for ALL providers MUST offer recovery/rerun when tools are missing Never commit without running terraform fmt Always review plan output before applying Use version constraints for all providers and modules Use remote state for team collaboration Enable state locking to prevent concurrent modifications Done Criteria Validation instructions are executable end to end with one deterministic command path. Wrapper scripts behave predictably in both success and failure paths (including propagated non zero exits). Regression tests cover parser error handling, implicit provider detection, wrapper argument handling, and checkov exit code behavior. Lightweight CI checks ( bash n , py compile , smoke checks) pass before final reporting.

terraform-validator