Reference

Built-in rules

Generated from the source tree by cmd/docsgen. Do not edit: your change would be overwritten on the next run, and the point of this page is that it cannot disagree with the binary.

These ship in the binary and need no adoption. They are generated from the rule registry rather than scraped from the source, which matters more than it sounds: the source also contains unit-test fixtures and convention ids that share the same namespace, and a scraped list would publish them as product features.

`budget.*`

Rule	What it checks
`budget.threshold`	Estimated monthly cost exceeds the configured threshold.

`cfn.*`

Rule	What it checks
`cfn.cross_stack_wiring`	An Fn::ImportValue names an export no template in the repo produces.
`cfn.export_naming`	A stack export does not follow the repo's derived export-naming convention.

`convention.*`

Rule	What it checks
`convention.unpinned_module_source`	A remote module source is not pinned to a version or ref.

`crossplane.*`

Rule	What it checks
`crossplane.claim_group_mismatch`	A claim's API group does not match its XRD.
`crossplane.claim_kind_mismatch`	A claim's kind does not match its XRD.
`crossplane.composite_mismatch`	A Composition's compositeTypeRef does not match its XRD.
`crossplane.envconfig_missing`	A Composition references an EnvironmentConfig that does not exist.
`crossplane.invalid_yaml`	A manifest could not be parsed.
`crossplane.missing_label`	A claim omits a label this repo applies everywhere else.
`crossplane.mr_labels_missing`	A composed managed resource carries none of the repo's standard labels.
`crossplane.mr_prod_deletion`	A production managed resource has a deletion policy that deletes.
`crossplane.namespace_not_allowed`	A claim targets a namespace this repo does not use.
`crossplane.naming`	A claim name does not follow the repo's derived naming convention.
`crossplane.plaintext_secret`	A literal secret value in a manifest.
`crossplane.prod_deletion_delete`	A production claim sets deletionPolicy: Delete.
`crossplane.rds_unencrypted`	A composed database declares no encryption.
`crossplane.s3_no_versioning`	A composed bucket has versioning off.
`crossplane.s3_public_access`	A composed bucket permits public access.
`crossplane.s3_unencrypted`	A composed bucket declares no encryption.
`crossplane.schema_missing_required`	A manifest omits a field the provider CRD requires.
`crossplane.schema_unknown_field`	A manifest sets a field the provider CRD does not define.
`crossplane.storage_bounds`	A claim's storage size falls outside the range this repo uses.
`crossplane.unknown_provider_resource`	A managed resource kind no pinned provider schema defines.

`destructive.*`

Rule	What it checks
`destructive.count_shift`	A count change renumbers instances, recreating resources.
`destructive.no_prevent_destroy`	A stateful resource has no prevent_destroy lifecycle guard.
`destructive.recreate`	A change forces replacement of an existing resource.
`destructive.removed`	A resource is removed from configuration.
`destructive.rename_without_moved`	A rename with no moved block destroys and recreates.

`plan.*`

Rule	What it checks
`plan.blast_radius`	The plan changes more resources than this repo's changes usually do.
`plan.stateful_destroy`	The plan destroys a stateful resource.
`plan.stateful_replace`	The plan replaces a stateful resource.

`reliability.*`

Rule	What it checks
`reliability.cache_no_failover`	A cache cluster has no failover configured.
`reliability.rds_no_backups`	A database retains no automated backups.
`reliability.rds_single_az`	A production database is single-AZ.

`renderdiff.*`

Rule	What it checks
`renderdiff.immutable_field_changed`	A field the provider treats as immutable changed between two renders, forcing replacement.

`secops.*`

Rule	What it checks
`secops.alb_http_only`	A load balancer listener serves plain HTTP.
`secops.count_on_stateful`	count on a stateful resource, where a shift renumbers and recreates.
`secops.ebs_unencrypted`	An EBS volume declares no encryption.
`secops.hardcoded_secret`	A literal credential in configuration rather than a reference.
`secops.missing_required_version`	No required_version constraint, so any Terraform version may apply this.
`secops.open_egress_data_tier`	A data-tier security group allows unrestricted egress.
`secops.provider_creds_inline`	Provider credentials inline in the provider block.
`secops.public_ingress`	An ingress rule admits 0.0.0.0/0.
`secops.rds_no_deletion_protection`	A database has deletion protection off.
`secops.rds_public`	A database is publicly accessible.
`secops.rds_unencrypted`	A database declares no storage encryption.
`secops.root_credentials`	Use of root or account-wide credentials.
`secops.s3_public_acl`	A bucket ACL grants public access.
`secops.s3_unencrypted`	A bucket declares no server-side encryption.
`secops.wildcard_iam`	An IAM policy grants Action or Resource "*".

51 built-in rules across 9 families.