TFLint

Import TFLint reports in JSON format. TFLint lints Terraform configuration using its core ruleset plus any enabled provider plugins, such as the AWS, Azure or Google rulesets.

Generate a report with:

tflint --format json > tflint.json

Severity Mapping#

TFLint attaches a severity to each rule, and DefectDojo maps that scale as follows:

The errors array in a TFLint report holds problems TFLint hit while running (an unparseable file, a missing plugin) rather than problems with the configuration, so it is not imported.

Sample Scan Data#

Sample TFLint scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• vuln_id_from_tool
• file_path
• line