开源软件名称：

开源软件地址：

开源编程语言：

开源软件介绍：

Collection of git hooks for Terraform to be used with pre-commit framework

Want to contribute? Check open issues and contributing notes.

Sponsors

Automated provisioning of Terraform workflows and Infrastructure as Code.

Cloud cost estimates for Terraform.

If you are using pre-commit-terraform already or want to support its development and many other open-source projects, please become a GitHub Sponsor!

Table of content

• Sponsors
• Table of content
• How to install
  • 1. Install dependencies
  • 2. Install the pre-commit hook globally
  • 3. Add configs and hooks
  • 4. Run
• Available Hooks
• Hooks usage notes and examples
  • All hooks: Usage of environment variables in --args
  • checkov (deprecated) and terraform_checkov
  • infracost_breakdown
  • terraform_docs
  • terraform_docs_replace (deprecated)
  • terraform_fmt
  • terraform_providers_lock
  • terraform_tflint
  • terraform_tfsec
  • terraform_validate
  • terraform_wrapper_module_for_each
  • terrascan
  • tfupdate
• Authors
• License
  • Additional information for users from Russia and Belarus

How to install

1. Install dependencies

• pre-commit
• checkov required for checkov hook.
• terraform-docs required for terraform_docs hook.
• terragrunt required for terragrunt_validate hook.
• terrascan required for terrascan hook.
• TFLint required for terraform_tflint hook.
• TFSec required for terraform_tfsec hook.
• infracost required for infracost_breakdown hook.
• jq required for infracost_breakdown hook.
• tfupdate required for tfupdate hook.
• hcledit required for terraform_wrapper_module_for_each hook.

TAG=latest
docker pull ghcr.io/antonbabenko/pre-commit-terraform:$TAG

git clone [email protected]:antonbabenko/pre-commit-terraform.git
cd pre-commit-terraform
# Install the latest versions of all the tools
docker build -t pre-commit-terraform --build-arg INSTALL_ALL=true .

docker build -t pre-commit-terraform \
    --build-arg PRE_COMMIT_VERSION=latest \
    --build-arg TERRAFORM_VERSION=latest \
    --build-arg CHECKOV_VERSION=2.0.405 \
    --build-arg INFRACOST_VERSION=latest \
    --build-arg TERRAFORM_DOCS_VERSION=0.15.0 \
    --build-arg TERRAGRUNT_VERSION=latest \
    --build-arg TERRASCAN_VERSION=1.10.0 \
    --build-arg TFLINT_VERSION=0.31.0 \
    --build-arg TFSEC_VERSION=latest \
    --build-arg TFUPDATE_VERSION=latest \
    --build-arg HCLEDIT_VERSION=latest \
    .

brew install pre-commit terraform-docs tflint tfsec checkov terrascan infracost tfupdate minamijoyo/hcledit/hcledit jq

sudo apt update
sudo apt install -y unzip software-properties-common
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt install -y python3.7 python3-pip
python3 -m pip install --upgrade pip
pip3 install --no-cache-dir pre-commit
python3.7 -m pip install -U checkov
curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E -m 1 "https://.+?-linux-amd64.tar.gz")" > terraform-docs.tgz && tar -xzf terraform-docs.tgz && rm terraform-docs.tgz && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E -m 1 "https://.+?tfsec-linux-amd64")" > tfsec && chmod +x tfsec && sudo mv tfsec /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E -m 1 "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz && tar -xzf terrascan.tar.gz terrascan && rm terrascan.tar.gz && sudo mv terrascan /usr/bin/ && terrascan init
sudo apt install -y jq && \
curl -L "$(curl -s https://api.github.com/repos/infracost/infracost/releases/latest | grep -o -E -m 1 "https://.+?-linux-amd64.tar.gz")" > infracost.tgz && tar -xzf infracost.tgz && rm infracost.tgz && sudo mv infracost-linux-amd64 /usr/bin/infracost && infracost register
curl -L "$(curl -s https://api.github.com/repos/minamijoyo/tfupdate/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.tar.gz")" > tfupdate.tar.gz && tar -xzf tfupdate.tar.gz tfupdate && rm tfupdate.tar.gz && sudo mv tfupdate /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/minamijoyo/hcledit/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.tar.gz")" > hcledit.tar.gz && tar -xzf hcledit.tar.gz hcledit && rm hcledit.tar.gz && sudo mv hcledit /usr/bin/

sudo apt update
sudo apt install -y unzip software-properties-common python3 python3-pip
python3 -m pip install --upgrade pip
pip3 install --no-cache-dir pre-commit
pip3 install --no-cache-dir checkov
curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E -m 1 "https://.+?-linux-amd64.tar.gz")" > terraform-docs.tgz && tar -xzf terraform-docs.tgz terraform-docs && rm terraform-docs.tgz && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E -m 1 "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz && tar -xzf terrascan.tar.gz terrascan && rm terrascan.tar.gz && sudo mv terrascan /usr/bin/ && terrascan init
curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E -m 1 "https://.+?tfsec-linux-amd64")" > tfsec && chmod +x tfsec && sudo mv tfsec /usr/bin/
sudo apt install -y jq && \
curl -L "$(curl -s https://api.github.com/repos/infracost/infracost/releases/latest | grep -o -E -m 1 "https://.+?-linux-amd64.tar.gz")" > infracost.tgz && tar -xzf infracost.tgz && rm infracost.tgz && sudo mv infracost-linux-amd64 /usr/bin/infracost && infracost register
curl -L "$(curl -s https://api.github.com/repos/minamijoyo/tfupdate/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.tar.gz")" > tfupdate.tar.gz && tar -xzf tfupdate.tar.gz tfupdate && rm tfupdate.tar.gz && sudo mv tfupdate /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/minamijoyo/hcledit/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.tar.gz")" > hcledit.tar.gz && tar -xzf hcledit.tar.gz hcledit && rm hcledit.tar.gz && sudo mv hcledit /usr/bin/

2. Install the pre-commit hook globally

Note: not needed if you use the Docker image

DIR=~/.git-template
git config --global init.templateDir ${DIR}
pre-commit init-templatedir -t pre-commit ${DIR}

3. Add configs and hooks

Step into the repository you want to have the pre-commit hooks installed and run:

git init
cat <<EOF > .pre-commit-config.yaml
repos:
- repo: https://github.com/antonbabenko/pre-commit-terraform
  rev: <VERSION> # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
  hooks:
    - id: terraform_fmt
    - id: terraform_docs
EOF

4. Run

Execute this command to run pre-commit on all files in the repository (not only changed files):

pre-commit run -a

Or, using Docker (available tags):

TAG=latest
docker run -v $(pwd):/lint -w /lint ghcr.io/antonbabenko/pre-commit-terraform:$TAG run -a

Execute this command to list the versions of the tools in Docker:

TAG=latest
docker run --entrypoint cat ghcr.io/antonbabenko/pre-commit-terraform:$TAG /usr/bin/tools_versions_info

Available Hooks

There are several pre-commit hooks to keep Terraform configurations (both *.tf and *.tfvars) and Terragrunt configurations (*.hcl) in a good shape:

Check the source file to know arguments used for each hook.

Hooks usage notes and examples

All hooks: Usage of environment variables in --args

All, except deprecated hooks: checkov, terraform_docs_replace

You can use environment variables for the --args section.
Note: You must use the ${ENV_VAR} definition, $ENV_VAR will not expand.

Config example:

- id: terraform_tflint
  args:
  - --args=--config=${CONFIG_NAME}.${CONFIG_EXT}
  - --args=--module

If for config above set up export CONFIG_NAME=.tflint; export CONFIG_EXT=hcl before pre-commit run, args will be expanded to --config=.tflint.hcl --module.

checkov (deprecated) and terraform_checkov

checkov hook is deprecated, please use terraform_checkov.

Note that terraform_checkov runs recursively during -d . usage. That means, for example, if you change .tf file in repo root, all existing .tf files in repo will be checked.

1. You can specify custom arguments. E.g.:

   - id: terraform_checkov
     args:
       - --args=--quiet
       - --args=--skip-check CKV2_AWS_8

   Check all available arguments here.

For deprecated hook you need to specify each argument separately:

- id: checkov
  args: [
    "-d", ".",
    "--skip-check", "CKV2_AWS_8",
  ]

infracost_breakdown

infracost_breakdown executes infracost breakdown command and compare the estimated costs with those specified in the hook-config. infracost breakdown parses Terraform HCL code, and calls Infracost Cloud Pricing API (remote version or self-hosted version).

Unlike most other hooks, this hook triggers once if there are any changed files in the repository.

1. infracost_breakdown supports all infracost breakdown arguments (run infracost breakdown --help to see them). The following example only shows costs:

   - id: infracost_breakdown
     args:
       - --args=--path=./env/dev
     verbose: true # Always show costs

   Output

   Running in "env/dev"
   
   Summary: {
   "unsupportedResourceCounts": {
       "aws_sns_topic_subscription": 1
     }
   }
   
   Total Monthly Cost:        86.83 USD
   Total Monthly Cost (diff): 86.83 USD

2. Note that spaces are not allowed in --args, so you need to split it, like this:

   - id: infracost_breakdown
     args:
       - --args=--path=./env/dev
       - --args=--terraform-var-file="terraform.tfvars"
       - --args=--terraform-var-file="../terraform.tfvars"

3. (Optionally) Define cost constrains the hook should evaluate successfully in order to pass:

   - id: infracost_breakdown
     args:
       - --args=--path=./env/dev
       - --hook-config='.totalHourlyCost|tonumber > 0.1'
       - --hook-config='.totalHourlyCost|tonumber > 1'
       - --hook-config='.projects[].diff.totalMonthlyCost|tonumber != 10000'
       - --hook-config='.currency == "USD"'

   Output

   Running in "env/dev"
   Passed: .totalHourlyCost|tonumber > 0.1         0.11894520547945205 >  0.1
   Failed: .totalHourlyCost|tonumber > 1           0.11894520547945205 >  1
   Passed: .projects[].diff.totalMonthlyCost|tonumber !=10000              86.83 != 10000
   Passed: .currency == "USD"              "USD" == "USD"
   
   Summary: {
   "unsupportedResourceCounts": {
       "aws_sns_topic_subscription": 1
     }
   }
   
   Total Monthly Cost:        86.83 USD
   Total Monthly Cost (diff): 86.83 USD

   • Only one path per one hook (- id: infracost_breakdown) is allowed.
   • Set verbose: true to see cost even when the checks are passed.
   • Hook uses jq to process the cost estimation report returned by infracost breakdown command
   • Expressions defined as --hook-config argument should be in a jq-compatible format (e.g. .totalHourlyCost, .totalMonthlyCost) To study json output produced by infracost, run the command infracost breakdown -p PATH_TO_TF_DIR --format json, and explore it on jqplay.org.
   • Supported comparison operators: <, <=, ==, !=, >=, >.
   • Most useful paths and checks:
     • .totalHourlyCost (same as .projects[].breakdown.totalHourlyCost) - show total hourly infra cost
     • .totalMonthlyCost (same as .projects[].breakdown.totalMonthlyCost) - show total monthly infra cost
     • .projects[].diff.totalHourlyCost - show the difference in hourly cost for the existing infra and tf plan
     • .projects[].diff.totalMonthlyCost - show the difference in monthly cost for the existing infra and tf plan
     • .diffTotalHourlyCost (for Infracost version 0.9.12 or newer) or [.projects[].diff.totalMonthlyCost | select (.!=null) | tonumber] | add (for Infracost older than 0.9.12)
   • To disable hook color output, set PRE_COMMIT_COLOR=never env var.

4. Docker usage. In docker build or docker run command:

   • You need to provide Infracost API key via -e INFRACOST_API_KEY=<your token>. By default, it is saved in ~/.config/infracost/credentials.yml
   • Set -e INFRACOST_SKIP_UPDATE_CHECK=true to skip the Infracost update check if you use this hook as part of your CI/CD pipeline.

terraform_docs

1. terraform_docs and terraform_docs_without_aggregate_type_defaults will insert/update documentation generated by terraform-docs framed by markers:

   <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
   
   <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
   

   if they are present in README.md.

2. It is possible to pass additional arguments to shell scripts when using terraform_docs and terraform_docs_without_aggregate_type_defaults.

3. It is possible to automatically:

   • create a documentation file
   • extend existing documentation file by appending markers to the end of the file (see item 1 above)
   • use different filename for the documentation (default is README.md)

   - id: terraform_docs
     args:
       - --hook-config=--path-to-file=README.md        # Valid UNIX path. I.e. ../TFDOC.md or docs/README.md etc.
       - --hook-config=--add-to-existing-file=true     # Boolean. true or false
       - --hook-config=--create-file-if-not-exist=true # Boolean. true or false

4. You can provide any configuration available in terraform-docs as an argument to terraform_doc hook, for example:

   - id: terraform_docs
     args:
       - --args=--config=.terraform-docs.yml

   Note: Avoid use recursive.enabled: true in config file, that can cause unexpected behavior.

5. If you need some exotic settings, it can be done too. I.e. this one generates HCL files:

   - id: terraform_docs
     args:
       - tfvars hcl --output-file terraform.tfvars.model .

terraform_docs_replace (deprecated)

DEPRECATED. Will be merged in terraform_docs. See #248 for details.

terraform_docs_replace replaces the entire README.md rather than doing string replacement between markers. Put your additional documentation at the top of your main.tf for it to be pulled in. The optional --dest argument lets you change the filename that gets created/modified.

Example:

- id: terraform_docs_replace
  args:
    - --sort-by-required
    - --dest=TEST.md

terraform_fmt

1. terraform_fmt supports custom arguments so you can pass supported flags. Eg:

    - id: terraform_fmt
      args:
        - --args=-no-color
        - --args=-diff
        - --args=-write=false

terraform_providers_lock

1. The hook requires Terraform 0.14 or later.

2. The hook invokes two operations that can be really slow:

   • terraform init (in case .terraform directory is not initialised)
   • terraform providers lock

   Both operations require downloading data from remote Terraform registries, and not all of that downloaded data or meta-data is currently being cached by Terraform.

3. terraform_providers_lock supports custom arguments:

    - id: terraform_providers_lock
      args:
         - --args=-platform=windows_amd64
         - --args=-platform=darwin_amd64

4. It may happen that Terraform working directory (.terraform) already exists but not in the best condition (eg, not initialized modules, wrong version of Terraform, etc.). To solve this problem, you can find and delete all .terraform directories in your repository:

   echo "
   function rm_terraform {
       find . \( -iname