Purpose

Enforce Terraform code quality and security standards across the terraform/ directory through automated checks.

What it checks (9 checks):

1. •Hardcoded secrets (passwords, API keys, AWS keys, GitHub PATs) - HIGH
2. •Security issues (RBAC wildcards, open security groups, encryption, public access) - HIGH
3. •Missing version constraints (providers, modules, git refs) - HIGH
4. •Resource lifecycle (prevent_destroy, Helm timeouts, deletion protection) - HIGH
5. •Deprecated syntax (old interpolation, list(), map(), count vs for_each) - HIGH
6. •Module structure (README, required files, backend) - MEDIUM
7. •Dependency issues (excessive depends_on, circular deps) - MEDIUM
8. •Missing descriptions (variables, outputs) - LOW
9. •Naming conventions (snake_case enforcement) - LOW

Running Checks

Full audit (all checks):

node .claude/skills/terraform-audit/scripts/run_all_checks.mjs

Generate report (all checks + markdown report):

node .claude/skills/terraform-audit/scripts/generate_report.mjs

Report saved to: reports/YYYY-MM-DD/terraform-audit.md

Individual checks:

node .claude/skills/terraform-audit/scripts/check_hardcoded_secrets.mjs
node .claude/skills/terraform-audit/scripts/check_security_issues.mjs
node .claude/skills/terraform-audit/scripts/check_missing_versions.mjs
node .claude/skills/terraform-audit/scripts/check_resource_lifecycle.mjs
node .claude/skills/terraform-audit/scripts/check_deprecated_syntax.mjs
node .claude/skills/terraform-audit/scripts/check_module_structure.mjs
node .claude/skills/terraform-audit/scripts/check_dependency_issues.mjs
node .claude/skills/terraform-audit/scripts/check_missing_descriptions.mjs
node .claude/skills/terraform-audit/scripts/check_naming_conventions.mjs

Quality Rules

1. Hardcoded Secrets (HIGH)

RULE: Never hardcode sensitive values. Exposed secrets = compromised infrastructure.

Violations:

• •password = "mysecretpassword"
• •api_key = "sk-1234567890"
• •access_key = "AKIA..."
• •github_token = "ghp_..."
• •Any _pat, _token, _secret, _key with literal value

Fix: Use var.password, random_password.db.result, or secrets manager.

2. Security Issues (HIGH)

RULE: Follow least-privilege principle. Over-permissive = security breach waiting to happen.

Violations:

• •"Action": "*" or "Resource": "*" in IAM policies
• •verbs = ["*"], resources = ["*"], api_groups = ["*"] in K8s RBAC
• •cidr_blocks = ["0.0.0.0/0"] - open to internet
• •encrypted = false - unencrypted data at rest
• •publicly_accessible = true - database exposed
• •privileged = true - container running as root
• •skip_final_snapshot = true - data loss on delete
• •deletion_protection = false - accidental deletion risk

Fix: Use specific permissions, restrict CIDR blocks, enable encryption, protect resources.

3. Missing Version Constraints (HIGH)

RULE: Pin versions for reproducibility. Unpinned = CI/CD failures + breaking changes in production.

Violations:

• •Provider without version in required_providers
• •Module from registry without version
• •GitHub/Git module without ?ref= or ?tag=
• •Missing required_version for Terraform itself

Fix: Add version = "~> 2.0" to providers and modules.

4. Resource Lifecycle (HIGH)

RULE: Protect critical resources. No protection = data loss + downtime.

Violations:

• •Database/storage without lifecycle { prevent_destroy = true }
• •Helm release without timeout (infinite hang possible)
• •RDS/database without deletion_protection = true
• •RDS with skip_final_snapshot = true
• •EKS/GKE cluster without lifecycle protection

Fix: Add lifecycle blocks and deletion protection to critical resources.

5. Deprecated Syntax (HIGH)

RULE: Use modern Terraform syntax. Deprecated syntax = upgrade blockers + state corruption risk.

Violations:

• •"${var.name}" instead of var.name (unnecessary interpolation)
• •list("a", "b") instead of ["a", "b"] (deprecated function)
• •map("key", "value") instead of { key = "value" } (deprecated function)
• •count = length(var.x) instead of for_each (index-based state = corruption risk)
• •element(list, count.index) instead of list[count.index]
• •terraform.workspace usage (anti-pattern)

Fix: Update to modern HCL syntax before Terraform upgrades.

6. Module Structure (MEDIUM)

RULE: Follow standard module structure for maintainability.

Required files:

• •variables.tf, outputs.tf, versions.tf, README.md

Violations:

• •Missing required files
• •Root module without backend configuration
• •Too many .tf files (>10) - split into modules

Fix: Add missing files, configure backend, refactor large modules.

7. Dependency Issues (MEDIUM)

RULE: Use implicit dependencies. Explicit depends_on = maintenance nightmare.

Violations:

• •

  5 depends_on in one file (over-reliance)

• •depends_on with data sources (usually unnecessary)
• •null_resource provisioner without depends_on or triggers

Fix: Use resource references for implicit dependencies.

8. Missing Descriptions (LOW)

RULE: Document all variables and outputs for usability.

Violations:

• •variable "name" { type = string } (no description)
• •output "id" { value = ... } (no description)

Fix: Add description = "..." to all variables and outputs.

9. Naming Conventions (LOW)

RULE: Use snake_case everywhere for consistency.

Violations:

• •camelCase: myResourceName
• •kebab-case: my-resource-name

Fix: Rename to my_resource_name.

Safety

• •Read-only operation (except report generation)
• •No Terraform state modifications
• •No infrastructure changes