terraform
6 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
terraform/modules-pinned | error | Every module a Terraform root takes from a registry or a git URL names the version it takes, so the same commit resolves to the same module twice. |
terraform/no-plaintext-secrets | error | Every Terraform variable named like a credential declares sensitive = true. |
terraform/providers-pinned | error | Every provider a live Terraform root requires is pinned to one exact version, and the lock file that resolves them is committed. |
terraform/remote-state | error | Every live Terraform root stores its state in a remote backend, and no state file is left in the checkout. |
terraform/state-encrypted | error | Every live Terraform root declares its backend encrypted, so the state it writes is not readable from the bucket it sits in. |
terraform/state-locking | error | Every live Terraform root declares state locking, so two applies cannot write the same state at once. |
Shared collectors
Every terraform guardrail is handed the facts these collectors gather, and each one may ask for more of its own.
| Collector | Gathers |
|---|---|
terraform | The Terraform configuration in the checkout: every root directory holding .tf files, the backend it stores state in, the providers and modules it takes on and how tightly they are pinned, the resources it declares, the variables it takes, the lock file that resolves it, and any state file left in the tree. Read out of the files themselves, so it works on a runner with no Terraform installed, and enriched with the versions an initialised root has already resolved when the terraform CLI is there. |
Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.