Rules Playground Pick a module, pick some operational rules, and see the exact diff the registry would serve - the real rules engine against the real upstream module, no account and no terraform init.
Previews run on a reviewed set of 15 modules, each at one pinned version, and anonymous callers get six new builds a minute from one address. A rule set that has already been previewed is served from the cache and does not count.
Module terraform-aws-modules/s3-bucket/aws @ 5.15.4 terraform-aws-modules/acm/aws @ 6.3.1 terraform-aws-modules/autoscaling/aws @ 9.2.1 terraform-aws-modules/dynamodb-table/aws @ 5.5.0 terraform-aws-modules/ec2-instance/aws @ 6.4.0 terraform-aws-modules/ecs/aws @ 7.6.0 terraform-aws-modules/eks/aws @ 21.25.0 terraform-aws-modules/iam/aws @ 6.8.0 terraform-aws-modules/kms/aws @ 4.2.0 terraform-aws-modules/lambda/aws @ 8.8.1 terraform-aws-modules/rds/aws @ 7.2.0 terraform-aws-modules/rds-aurora/aws @ 10.2.0 terraform-aws-modules/secrets-manager/aws @ 2.1.0 terraform-aws-modules/security-group/aws @ 6.0.0 terraform-aws-modules/vpc/aws @ 6.6.1 pinned at 6.4.0; the public route serves this version only
Preview changes What the selected rules do to this module, before you run terraform init. 1 rule selected. Run the preview to see the exact diff against ec2-instance@6.4.0.
error 5 Refuses or rewrites configuration that violates the rule. lifecycle_prevent_destroy_data error Prevent accidental destruction of data-storage resources (S3, RDS instances and clusters, DynamoDB, EFS, ElastiCache replication groups) default scope aws_s3_bucket aws_db_instance aws_rds_cluster aws_dynamodb_table aws_efs_file_system aws_elasticache_replication_group lifecycle_prevent_destroy_encryption error Prevent destruction of KMS keys and Secrets Manager secrets default scope aws_kms_key aws_secretsmanager_secret resource_restrict_instance_types error Restrict EC2 instance types to cost-effective options fixed scope aws_instance resource_set_deletion_protection error Turn on deletion protection for databases and load balancers that leave it unset, so a stray destroy cannot remove them fixed scope aws_db_instance aws_rds_cluster aws_dynamodb_table aws_lb variable_allowed_regions error Restrict the module's region variable to an org-approved allowlist default scope aws_*
warning 11 Changes what Terraform does on the next apply. lifecycle_create_before_destroy warning Stand up the replacement before destroying the old resource, so a security group still attached to an ENI or a certificate still bound to a listener can be replaced without a failed apply or an outage default scope aws_security_group aws_acm_certificate lifecycle_ignore_ami_changes warning Ignore AMI changes on EC2 instances to prevent unnecessary replacements default scope aws_instance aws_launch_template lifecycle_ignore_autoscaling_changes warning Ignore autoscaling-managed capacity on DynamoDB tables to prevent drift default scope aws_dynamodb_table lifecycle_ignore_deployed_artifacts warning Ignore the artifact pointer a deployment pipeline rewrites on Lambda functions and ECS services, so the next Terraform run stops rolling the deployed version back. Assumes something other than Terraform deploys the code: do not enable it where Terraform builds the artifact (create_package = true) or builds the container image default scope aws_lambda_function aws_ecs_service lifecycle_ignore_scaling_changes warning Ignore the capacity attribute an external autoscaler owns on ASGs, EKS node groups and ECS services, so Terraform stops reverting the scaler default scope aws_autoscaling_group aws_eks_node_group aws_ecs_service lifecycle_ignore_secret_rotation warning Ignore the database credential attribute so a value that changes between plans - a regenerated random_password, a rotated secrets-manager or Vault data source, a variable supplied differently per runner - stops showing as a perpetual diff default scope aws_db_instance aws_rds_cluster lifecycle_ignore_tag_keys warning Ignore drift on specific resource tag keys (e.g. an external scanner tag) via lifecycle ignore_changes, without exposing an arbitrary lifecycle value default scope aws_s3_bucket lifecycle_ignore_tags warning Ignore tag changes in lifecycle to prevent Terraform drift on managed resources default scope aws_* provisioner_remove_blocks warning Remove provisioner blocks which are an anti-pattern in reusable modules s3_lifecycle_abort_incomplete_uploads warning Require an enabled S3 lifecycle rule that aborts incomplete multipart uploads, so parts that are billed but never listed stop accumulating fixed scope aws_s3_bucket_lifecycle_configuration source_sanitize_content warning Remove politically offensive content from Terraform modules info 3 Documentation and content only. No infrastructure effect. doc_add_compliance_notice info Add compliance.tf processing notice to module documentation files README.md doc_remove_political_section info Remove politically charged content sections from module documentation files README.md doc_remove_swu_banner info Remove Stand With Ukraine banner from module documentation files README.md
19 rules from pofix 0.22.0 路 1 selected Clear selection