tofu-validate

tofu validate is the built-in OpenTofu command that checks whether a configuration is internally consistent and semantically valid, without reading any state or contacting any infrastructure. OpenTofu is the community-driven, MPL-2.0 licensed fork of Terraform hosted by the Linux Foundation.

It reports the errors that neither a formatter nor a rule-based linter can see: unsupported or missing arguments, wrong attribute types, references to undeclared variables, locals, resources or outputs, invalid expressions, and broken module input contracts.

Key Features:

Official Validator: Built into OpenTofu core, so the checks always match the version of OpenTofu you run
Open Source: OpenTofu stays under the MPL-2.0 license, unlike Terraform which moved to BUSL-1.1
Schema Aware: Validates resource and data source arguments against the real provider schemas
Expression Checking: Resolves variable, local, output and module references across the whole module
No Infrastructure Access: Never reads the state, never contacts a backend and never needs cloud credentials
Zero Configuration: Intentionally opinionated, with no configuration or ignore file to maintain

Analyzed files

By default this linter only analyzes .tofu files, the OpenTofu specific extension that Terraform does not recognize, exactly like tofu fmt. Nothing is validated in a repository that keeps its OpenTofu configuration in .tf files until you add the extension:

TERRAFORM_TOFU_VALIDATE_FILE_EXTENSIONS: [".tofu", ".tf"]

Keeping .tofu as the only default leaves .tf free for a future terraform validate linter, so enabling both would not validate the same repository twice.

Mind that the extensions select the directories to validate, not the files to report on. tofu validate always validates a whole module, so once a directory has been selected, every .tf and .tofu file it contains is parsed and can produce diagnostics.

Do not add .tfvars, even though tofu fmt does format those files. tofu validate ignores variable definition files entirely, including auto-loaded ones, so a .tfvars file can never produce a diagnostic here. Worse, a directory holding only .tfvars files is an empty directory for OpenTofu, and validate reports it as valid: adding the extension would run a pointless initialization in every variables folder and report a misleading success.

Module initialization

tofu validate can only run on an initialized directory: it needs the provider schemas and the installed child modules of the module it validates. MegaLinter therefore runs the following command once per analyzed directory, before validating it:

tofu -chdir=<directory> init -backend=false -input=false -no-color

-backend=false is what keeps this a linter: backend initialization is skipped entirely, so no state is read, no state lock is acquired and no cloud credentials are required. The linter works on reusable module repositories that declare no backend at all, and in CI jobs with no access to the infrastructure.

Initialization does need network access to resolve providers and remote module sources, and credentials when they come from a private registry. A module declaring neither provider nor external module is initialized offline.

Because initialization resolves dependencies, the analyzed repository has to be self-contained: a module block whose local source escapes the repository root, such as ../../modules/something, can not be installed and is reported as Unreadable module directory. Vendor those modules, address them through a git or registry source, or skip the directories concerned with TERRAFORM_TOFU_VALIDATE_FILTER_REGEX_EXCLUDE.

Initialization arguments

Use TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS to change the arguments sent to tofu init. Adding -lockfile=readonly turns an out-of-sync .terraform.lock.hcl into a reported error, instead of letting the initialization update it:

TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS:
  - "-backend=false"
  - "-input=false"
  - "-no-color"
  - "-lockfile=readonly"

Initialization writes a .terraform directory in every analyzed module directory, as any OpenTofu run does. Add .terraform to EXCLUDED_DIRECTORIES when your repository vendors modules there and you do not want their configuration validated as modules of their own.

tofu-validate documentation

Version in MegaLinter: 1.12.6
Visit Official Web Site
See How to disable tofu-validate rules in files
See Index of problems detected by tofu-validate

Configuration in MegaLinter

Enable tofu-validate by adding TERRAFORM_TOFU_VALIDATE in ENABLE_LINTERS variable
Disable tofu-validate by adding TERRAFORM_TOFU_VALIDATE in DISABLE_LINTERS variable

Variable	Description	Default value
TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS	Arguments sent to tofu init before validating each directory. Keep `-backend=false` unless you really want MegaLinter to initialize your backend and access your state.	`-backend=false -input=false -no-color`
TERRAFORM_TOFU_VALIDATE_ARGUMENTS	User custom arguments to add in linter CLI call Ex: `-s --foo "bar"`
TERRAFORM_TOFU_VALIDATE_COMMAND_REMOVE_ARGUMENTS	User custom arguments to remove from command line before calling the linter Ex: `-s --foo "bar"`
TERRAFORM_TOFU_VALIDATE_FILTER_REGEX_INCLUDE	Custom regex including filter Ex: `(src\\|lib)`	Exclude no file
TERRAFORM_TOFU_VALIDATE_FILTER_REGEX_EXCLUDE	Custom regex excluding filter Ex: `(test\\|examples)`	Exclude no file
TERRAFORM_TOFU_VALIDATE_CLI_LINT_MODE	Override default CLI lint mode - `list_of_files`: Call the linter with the list of files as argument	`list_of_files`
TERRAFORM_TOFU_VALIDATE_FILE_EXTENSIONS	Allowed file extensions. `"*"` matches any extension, `""` matches empty extension. Empty list excludes all files Ex: `[".py", ""]`	`[".tofu"]`
TERRAFORM_TOFU_VALIDATE_FILE_NAMES_REGEX	File name regex filters. Regular expression list for filtering files by their base names using regex full match. Empty list includes all files Ex: `["Dockerfile(-.+)?", "Jenkinsfile"]`	Include every file
TERRAFORM_TOFU_VALIDATE_PRE_COMMANDS	List of bash commands to run before the linter	None
TERRAFORM_TOFU_VALIDATE_POST_COMMANDS	List of bash commands to run after the linter	None
TERRAFORM_TOFU_VALIDATE_UNSECURED_ENV_VARIABLES	List of env variables explicitly not filtered before calling TERRAFORM_TOFU_VALIDATE and its pre/post commands	None
TERRAFORM_TOFU_VALIDATE_DISABLE_ERRORS	Run linter but consider errors as warnings	`false`
TERRAFORM_TOFU_VALIDATE_DISABLE_ERRORS_IF_LESS_THAN	Maximum number of errors allowed	`0`
TERRAFORM_TOFU_VALIDATE_TIMEOUT_SECONDS	Maximum duration in seconds of the linter run, after which the linter process and its child processes are killed and reported as an error (exit code 124). Overrides LINTER_TIMEOUT_SECONDS. 0 disables the timeout	`300`
TERRAFORM_TOFU_VALIDATE_CLI_EXECUTABLE	Override CLI executable	`['tofu']`

IDE Integration

Use tofu-validate in your favorite IDE to catch errors before MegaLinter !

	IDE	Extension Name	Install
	IDEA	Terraform and HCL
	Visual Studio Code	OpenTofu

MegaLinter Flavors

This linter is available in the following flavors

Flavor	Description	Embedded linters
all	Default MegaLinter Flavor	133
cupcake	MegaLinter for the most commonly used languages	100
terraform	Optimized for TERRAFORM based projects	58

Behind the scenes

How are identified applicable files

File extensions: .tofu

How the linting is performed

tofu-validate is called once with the list of files as arguments (list_of_files CLI lint mode)

Example calls

tofu -chdir=mymodule init -backend=false -input=false -no-color

tofu -chdir=mymodule validate -no-color

Help content

Usage: tofu [global options] <subcommand> [args]

The available commands for execution are listed below.
The primary workflow commands are given first, followed by
less common or more advanced commands.

Main commands:
  init          Prepare your working directory for other commands
  validate      Check whether the configuration is valid
  plan          Show changes required by the current configuration
  apply         Create or update infrastructure
  destroy       Destroy previously-created infrastructure

All other commands:
  console       Try OpenTofu expressions at an interactive command prompt
  fmt           Reformat your configuration in the standard style
  force-unlock  Release a stuck lock on the current workspace
  get           Install or upgrade remote OpenTofu modules
  graph         Generate a Graphviz graph of the steps in an operation
  import        Associate existing infrastructure with a OpenTofu resource
  login         Obtain and save credentials for a remote host
  logout        Remove locally-stored credentials for a remote host
  metadata      Metadata related commands
  output        Show output values from your root module
  providers     Show the providers required for this configuration
  refresh       Update the state to match remote systems
  show          Show the current state or a saved plan
  state         Advanced state management
  taint         Mark a resource instance as not fully functional
  test          Execute integration tests for OpenTofu modules
  untaint       Remove the 'tainted' state from a resource instance
  version       Show the current OpenTofu version
  workspace     Workspace management

Global options (use these before the subcommand, if any):
  -chdir=DIR    Switch to a different working directory before executing the
                given subcommand.
  -help         Show this help output, or the help for a specified subcommand.
  -version      An alias for the "version" subcommand.

Installation on mega-linter Docker image

Dockerfile commands :

# renovate: datasource=docker depName=ghcr.io/opentofu/opentofu
ARG TERRAFORM_TOFU_FMT_VERSION=1.12.6-minimal
FROM ghcr.io/opentofu/opentofu:${TERRAFORM_TOFU_FMT_VERSION} AS opentofu
COPY --link --from=opentofu /usr/local/bin/tofu /usr/bin/

Known errors and resolutions

When this linter fails for a known non-lint reason (remote service unavailable, malformed config, missing credentials, etc.), MegaLinter detects the pattern below in the linter output and surfaces the matching guidance.