This article follows the official documentation. We haven’t tested this tool for a hands-on review.
When a coding agent edits Terraform files, it can run TFLint to check them for common mistakes before anyone runs a full Terraform plan. TFLint is a linter: a tool that examines code and reports issues. Its rules can flag outdated syntax, unused declarations, naming problems, and provider-specific errors such as invalid cloud resource settings.
TFLint’s built-in Terraform rules work without a separate plugin. TFLint also supports provider plugins, which add rules for services such as AWS, Azure, and Google Cloud. After editing Terraform, an agent can run TFLint, use its findings to decide what to correct, and run it again. The official TFLint repository documents installation, configuration, plugins, and output formats.
Install TFLint
On macOS with Homebrew, the TFLint README installs a cask from the project’s own tap. Then check that the command is available:
brew install --cask terraform-linters/tap/tflint
tflint --version
For other operating systems, use the installation method listed in the official repository. It lists release archives with checksums for Linux and a WinGet package for Windows. It also describes a Docker image. TFLint does not require an account login to run its bundled ruleset, and the example below does not send Terraform files to a service.
Run a local check
From a Terraform module’s directory, run:
cd /path/to/terraform/module
tflint --format=compact
Replace /path/to/terraform/module with the directory that contains the Terraform files you want to check. TFLint inspects the files in the current directory by default. --chdir=DIR points it at another directory, and --recursive runs it in each directory below. The command reads the local configuration and prints any findings in compact format. TFLint’s bundled Terraform ruleset enables its recommended preset by default, so a basic check does not require a plugin configuration or tflint --init.
An agent can also request JSON output when another tool needs to parse findings:
tflint --format=json
The official CLI supports formats including default, json, checkstyle, junit, compact, and sarif. Choose a format that matches the next step: compact text for a person or agent reading terminal output, or JSON when a script needs structured output. The commands above are read-only checks; they do not edit Terraform files or create a plan. TFLint also has a --fix flag that fixes issues automatically and changes the files, so the agent should only use it when you ask for it. TFLint exits with a non-zero status when it finds issues, unless you pass --force.
A coding agent can use TFLint in a repeatable sequence: edit a module, run TFLint, inspect each reported file and line, make a justified correction, and run the same command again. A useful prompt is: “Update the Terraform module to meet the requested change. Run tflint --format=compact in the module directory, fix relevant findings without changing unrelated resources, and report any findings you leave unresolved.”
Add provider rules when needed
The bundled ruleset checks Terraform language and common practices. To check provider-specific details, such as cloud resource arguments, configure a TFLint plugin in the project’s .tflint.hcl file and run tflint --init. That command downloads and installs the configured plugins, so it needs network access. Review the plugin configuration and its source before asking an agent to initialize it.
Provider plugins extend the checks TFLint can make, but coverage depends on the provider and its ruleset. A clean TFLint run does not establish that a provider will accept every argument or that a change is safe to deploy. When you need to check provider schemas or evaluate proposed infrastructure changes, run Terraform validation and planning. Review the changes as part of that assessment.
Know what the findings mean
TFLint helps catch repeatable Terraform issues early, but it does not enforce cloud permissions or guarantee secure infrastructure. A finding tells the agent what a configured rule detected; the agent still needs to judge whether a proposed fix matches the requested change.
The bundled Terraform ruleset is built into the TFLint program, so a TFLint update can also change which rules run. Pin TFLint to a project-approved version and review new findings when updating it, so a version change does not silently alter the lint baseline. The configuration documentation describes a required_version setting in .tflint.hcl that restricts which TFLint versions can run the project’s checks.