terraform
6 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
terraform/modules-pinned | error | Every module a Terraform root pulls from a registry or a git URL names a version, so the same commit always resolves to the same module code. |
terraform/no-plaintext-secrets | error | Every Terraform variable named like a credential declares sensitive = true. |
terraform/providers-pinned | error | Every provider a live Terraform root requires is pinned to one exact version, and the lock file that resolves them is committed. |
terraform/remote-state | error | Every live Terraform root stores its state in a remote backend, and no state file is left in the checkout. |
terraform/state-encrypted | error | Every live Terraform root declares an encrypted backend, so its state isn't stored in the clear in its bucket. |
terraform/state-locking | error | Every live Terraform root declares state locking, so two applies cannot write the same state at once. |
Shared collectors
Every terraform guardrail receives the facts these collectors gather. Individual guardrails can ask for more collectors of their own.
| Collector | Gathers |
|---|---|
terraform | The Terraform configuration in the checkout: every root directory holding .tf files, the backend it stores state in, the providers and modules it takes on and how tightly they are pinned, the resources it declares, the variables it takes, the lock file that resolves it, and any state file left in the tree. Everything is read from the files themselves, so it works on a runner with no Terraform installed. When the terraform CLI is there, the versions an initialised root has already resolved are added. |
You configure every guardrail in this category the same way, in the guardrails.checks array of buildnote.json. Configuring guardrails lists every option, and Guardrails lets you search the whole library.