TFLint is not evaluating any rule.

[Omarawad]

Hi, I've been trying to setup TFLint for an Azure Terraform project but couldn't make it run so far. While experimenting I noticed the following behaviours:

• Rules by default all are not working (Terraform + Azure).
• When enabling rules explicitly its ignoring Azure rules.
• I got some rules working like "terraform_naming_convention" but other terraform rules that should be enabled by default doesnt work.
• TFLint is not throwing any error or complaint of the setup.

My setup is in Azure pipelines as the following (assume project root is $(workDir)):

• Install TFLint to $(workDir)
• Install TFLint Azure plugin to $(workDir)/.tflint.d/plugins/tflint-ruleset-azurerm.exe
• Create .tflint.hcl configuration file in $(workDir) that has: plugin "azurerm" { enabled = true }
• Run in $(workDir) the following command: .\tflint.exe --config ".tflint.hcl" .

Even i tried hard to break my terraform rules intentionaly, TFLint always run with no errors or complaints. Any guidance or sample working setup that I can rely on to set this up properly?

[wata727]

Hi @Omarawad, thank you for your feedback.

It seems to work fine in my environment, but something may be wrong. Can you show me the log obtained by adding the environment variable TFLINT_LOG?

TFLINT_LOG=debug tflint -c .tflint.hcl

[Omarawad]

Hi @wata727, Thank you for looking into this. I attached my LOG file to this post TFLint_LOG.txt

[Omarawad]

As an addition, my Terraform files really a mix of resources that I wrote to intentially fail TFLint like the following:

resource "azurerm_resource_group" "camelCase" { name = "test" location = var.location }

resource "azurerm_storage_account" "camelCase" { name = "storageaccountname" resource_group_name = azurerm_resource_group.test-group.name location = azurerm_resource_group.test-group.location account_tier = "Omar" account_replication_type = "GRS"

tags = { environment = "staging" } }

[wata727]

Umm, looking at the logs, everything seems to be working correctly.

• azurerm plugin seems to be running correctly
• The terraform_naming_convention rule is not enabled, so it is ignored.
• The enabled rules by default like the terraform_pinned_module are working correctly.

Can you share the expected/actual behaviors and the contents of .tflint.hcl with the logs?

[Omarawad]

Hi @wata727 Regarding the terrafomr rules It wasnt working with me and I assume because I was using a SSH remote module in the terraform files but I couldn't replicate the case. Anyway I did get the terraform rules working properly in local modules but still TFLint is not evaluating rules against remote modules I reference within my code. Also, the Azure rules are not working still. I attached few files from my test case that shows a sample set of resources that I would expect it will make TFLint fail some rules like:

• azurerm_storage_account_network_rules_invalid_default_action
• azurerm_storage_account_invalid_access_tier

I hope you can find the below use case useful!

user_case.zip

[wata727]

Umm, got it. There are some problems.

• First, tflint only inspects the current directory. So, in this case, only main.tf is inspected.
• Second, module inspection detects issues that depend on module arguments.
  • So, even if there is a problem in terraform/service-principal/main.tf, if it doesn't occur by arguments of module calls from main.tf, it will be ignored here.
  • See https://github.com/terraform-linters/tflint/blob/master/docs/guides/advanced.md#module-inspection
• Finally, maybe you need to run terraform init before running tflint.

[Omarawad]

Oh I see.. I do run terraform init before but as you said the problem is its not scanning inside the referenced modules. Is there any plans to support deep scaning for referenced modules? My experience with Terraform within different teams we tended to modulerize the application components and use one infrastructure pipeline to assemble all components together. It will be a great feature if TFLint support referenced modules.

Thank you for looking into the issue, appreciated :)

[wata727]

I think you should run TFLint on the module directory in the case. The inspection on the top-level directory is checking the arguments injected into the module, assuming the module is valid.

If you want to check whether there is a problem with the module, you need to run the following command additionally.

$ cd terraform/service-principal
$ terraform init # If the module depends other modules
$ tflint

[Omarawad]

Yeah that works for local modules. Thank you @wata727 !