Terraform Best-Practices Checker

The Terraform Best-Practices Checker scans pasted .tf for hard-coded secrets, encourages the use of variables, and flags resources missing tags or labels. It is a fast, private first-pass governance check that catches the mistakes teams most often make before they reach a remote state. Hard-coding a password or access key into a resource block is one of the most common ways sensitive data leaks into version control, and once a secret is committed it must be rotated and purged from history. Likewise, resources without tags become ungoverned: they cannot be cost-allocated, owned, or cleaned up reliably, which leads to drift and surprise bills. This tool applies a set of heuristic rules to the parsed configuration so you get immediate, actionable feedback without installing anything. It is not a replacement for a dedicated secret scanner in CI, but it is the quickest way to catch obvious problems while you are still writing the code, long before a plan runs in a shared workspace. The analysis runs entirely in your browser using a client-side HCL parser, so your infrastructure code never leaves your machine and no network request is made at any point. You can iterate on a configuration and re-check it as many times as you like, then export the report to share with a teammate or attach to a pull request. Because the check is deterministic and local, the same input always produces the same report, which makes it easy to track remediation over time. The checker is intentionally lightweight: it focuses on the highest-impact, lowest-false-positive signals rather than trying to be a complete linter, so you get a short, trustworthy list instead of noise.

• Secrets - flags hard-coded passwords, keys and tokens by name.
• Variables - flags literal values that should be variables.
• Tagging - flags cloud resources missing tags or labels.
• Severity - HIGH and WARN findings are grouped clearly by risk.
• Heuristics - tuned to minimize false positives on common infrastructure code.
• Private - parsed locally, nothing uploaded or transmitted.
• Stats row - shows resource and finding counts after every check.
• Copy / Download / Print - export a Markdown report for your team.
• Wrap toggle - wrap long report lines for easy reading on any screen.
• Clear errors - an alert panel lists exactly what to fix.
• Fast - instant local scan on every run.
• Deterministic - the same input yields the same report.
• Zero install - no binaries, no CLI, no login required.
• Low noise - focuses on high-impact signals only, not trivia.
• Grouped output - findings sorted by severity for triage.

1. Paste your .tf configuration into the input box on the left.
2. Click Check to run the governance heuristics across the parsed blocks.
3. Review the findings grouped by HIGH and WARN severity in the report.
4. Read the stats row to see how many resources were scanned and how many findings appeared.
5. Use the Wrap button if any finding line is too long to read on a narrow screen.
6. Copy, download as Markdown, or print the report to share it.
7. Fix the issues in your configuration and paste it again to re-check.
8. Track remediation by re-running the check after each fix to watch the finding count drop.

Example - a block containing password = "hunter2" is flagged as a HIGH hard-coded secret-like value, while an aws_instance without a tags argument is flagged as a WARN for missing tags. The report lists each finding by resource address so you can jump straight to the offending line. The heuristic also catches keys named access_key, secret_key, token and similar, and it ignores values that already reference var. so legitimate variable usage is not flagged. After fixing both issues and re-checking, the report shows "No best-practice issues detected" and the stats row reflects zero findings.

• Fast - instant local scan as you write code.
• No secrets sent - everything stays in the browser at all times.
• Clear report - grouped, actionable findings you can act on.
• Governance - encourages variables and tagging discipline across a team.
• Shareable - export for pull requests and review.
• Educational - learn common Terraform pitfalls quickly.
• Repeatable - deterministic checks support steady remediation.
• Secure by design - sensitive code is never transmitted anywhere.