Terraform Collector
Parse Terraform and OpenTofu configuration files to extract configuration data. Writes file validity and full parsed HCL JSON for downstream policy analysis of providers, modules, backends, resources, and infrastructure security posture.
terraform to your lunar-config.yml:uses: github://earthly/lunar-lib/collectors/terraform@v1.0.5
What This Integration Collects
This integration includes 2 collectors that gather metadata from your systems.
terraform
Parses every Terraform/OpenTofu HCL file in the repository (.tf, .tofu) and collects:
- File validity and parse errors (.iac.files[])
- Normalized modules with resources and analysis (.iac.modules[])
- Full parsed HCL JSON for terraform-specific policy (.iac.native.terraform.files[])
- Source tool metadata (.iac.source)
cicd
Records every terraform command executed in CI pipelines along with the Terraform CLI version. Writes command strings and version info to .iac.native.terraform.cicd for audit trails and build reproducibility.
How Collectors Fit into Lunar
Lunar watches your code and CI/CD systems to collect SDLC data from config files, test results, IaC, deployment configurations, security scans, and more.
Collectors are the automatic data-gathering layer. They extract structured metadata from your repositories and pipelines, feeding it into Lunar's centralized database where guardrails evaluate it to enforce your engineering standards.
Learn How Lunar Works →Example Collected Data
This collector writes structured metadata to the Component JSON. Here's an example of the data it produces:
{
"iac": {
"source": {"tool": "hcl2json", "version": "0.6.8"},
"files": [
{"path": "deploy/terraform/main.tf", "valid": true},
{"path": "deploy/terraform/variables.tf", "valid": true}
],
"modules": [
{
"path": "deploy/terraform",
"resources": [
{"type": "aws_db_instance", "name": "main", "category": "datastore", "has_prevent_destroy": true},
{"type": "aws_s3_bucket", "name": "logs", "category": "datastore", "has_prevent_destroy": false},
{"type": "aws_lb", "name": "api", "category": "network", "has_prevent_destroy": false, "internet_facing": true},
{"type": "aws_instance", "name": "web", "category": "compute", "has_prevent_destroy": false},
{"type": "aws_wafv2_web_acl", "name": "main", "category": "security"},
{"type": "aws_wafv2_web_acl_association", "name": "api", "category": "security"}
],
"analysis": {
"internet_accessible": true,
"has_waf": true
}
}
],
"native": {
"terraform": {
"files": [
{
"path": "deploy/terraform/main.tf",
"hcl": {
"terraform": [{"required_providers": [{"aws": {"source": "hashicorp/aws", "version": "~> 5.0"}}]}],
"resource": {"aws_db_instance": {"main": [{"engine": "postgres"}]}}
}
}
],
"cicd": {
"cmds": [
{"cmd": "terraform init", "version": "1.9.8"},
{"cmd": "terraform plan -out=tfplan", "version": "1.9.8"},
{"cmd": "terraform apply -auto-approve tfplan", "version": "1.9.8"}
],
"source": {"tool": "terraform", "integration": "ci"}
}
}
}
}
}Documentation
View on GitHubTerraform Collector
Parses Terraform and OpenTofu configuration files and collects IaC configuration data for policy analysis.
Overview
This collector finds all .tf and .tofu files in a repository and parses them using hcl2json. It writes file validity status and the full parsed HCL JSON, enabling downstream policies to analyze providers, modules, backend configuration, resource inventory, and infrastructure security posture.
OpenTofu precedence. Where a directory holds both <base>.tf and <base>.tofu, OpenTofu uses the .tofu file and ignores the .tf, and this collector does the same. Without that rule a policy would be evaluating configuration that is never applied.
The JSON syntax variants (.tf.json, .tofu.json) are not parsed yet.
Collected Data
This collector writes to the following Component JSON paths:
| Path | Type | Description |
|---|---|---|
.iac.source |
object | Tool metadata (tool, version) |
.iac.files[] |
array | File validity: {path, valid, error?} |
.iac.modules[] |
array | Normalized modules: {path, resources[], analysis} |
.iac.native.terraform.files[] |
array | Full parsed HCL per file: {path, hcl} |
.iac.native.terraform.cicd |
object | CI command tracking: {cmds[], source} |
Collectors
This integration provides the following collectors (use include to select a subset):
| Collector | Description |
|---|---|
terraform |
Parses .tf files, writes validity and full HCL JSON |
cicd |
Records every terraform command run in CI with the CLI version |
Installation
Add to your lunar-config.yml:
collectors:
- uses: github://earthly/lunar-lib/collectors/terraform@main
on: ["domain:your-domain"] # Or use tags like [infra, terraform]
include:
- terraform # Parses .tf files
- cicd # terraform commands in CI
Open Source
This collector is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.
Common Use Cases
Explore guardrails that use data from Terraform Collector.
Ready to Automate Your Standards?
See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 300+ built-in guardrails.
AI agent rules & prompt files
Post-mortem action items
Security & compliance policies
Testing & quality requirements