Terraform

The terraform check group covers Terraform operations that can destroy infrastructure or modify state without review.

Terraform checks

Apply with auto-approve

ID	terraform:apply_with_auto_approve
Severity	Critical
Alternative	terraform plan -out=plan.tfplan && terraform apply plan.tfplan -- review the plan first, then apply from the saved plan file

The -auto-approve flag skips the interactive confirmation that Terraform normally requires. This is the most dangerous Terraform command because it applies changes without any review.

# Triggers
terraform apply -auto-approve
terraform apply -auto-approve -var="env=production"

State move / replace-provider

ID	terraform:state
Severity	High
Filter	NotContains -dry-run
Alternative	terraform state <cmd> -dry-run -- preview the state change before actually modifying state

# Triggers
terraform state mv aws_instance.old aws_instance.new
terraform state replace-provider hashicorp/aws registry.example.com/aws

# Does NOT trigger
terraform state mv -dry-run aws_instance.old aws_instance.new

Workspace delete with force

ID	terraform:workspace_delete_with_force_flag
Severity	High

# Triggers
terraform workspace delete -force staging

Workspace delete without lock

ID	terraform:workspace_delete_without_lock
Severity	High

# Triggers
terraform workspace delete -lock=false staging

Force unlock

ID	terraform:force_unlock_with_force_flag
Severity	High

Manually unlocking state without confirmation can lead to state corruption if another operation is in progress.

# Triggers
terraform force-unlock -force LOCK_ID

Summary table

ID	Command	Severity	Filter	Alternative
terraform:apply_with_auto_approve	terraform apply -auto-approve	Critical	--	Plan + apply from plan file
terraform:state	terraform state mv/replace-provider	High	NotContains -dry-run	-dry-run flag
terraform:workspace_delete_with_force_flag	terraform workspace delete -force	High	--	--
terraform:workspace_delete_without_lock	terraform workspace delete -lock=false	High	--	--
terraform:force_unlock_with_force_flag	terraform force-unlock -force	High	--	--

Best practices with shellfirm

1. Never use -auto-approve in interactive sessions. Use terraform plan -out=plan.tfplan followed by terraform apply plan.tfplan. shellfirm catches this at Critical severity.

2. Always dry-run state modifications. The NotContains -dry-run filter means terraform state mv -dry-run passes through without a challenge, encouraging the safe workflow.

3. Combine with team policies. In a .shellfirm.yaml, you can deny terraform:apply_with_auto_approve outright:

version: 1
deny:
  - terraform:apply_with_auto_approve

This prevents anyone on the team from using -auto-approve in the project directory, regardless of their personal settings.