Find what is declared and never used, and what is used and never declared. One of these costs money on every plan, and one of them is a breaking change to delete.
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Check. Nothing leaves this tab.
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
The data source is the expensive one: an API call on every plan for nothing
variable "unused" {
type = string
}
data "aws_ami" "ubuntu" {
most_recent = true
}
resource "aws_s3_bucket" "logs" {
bucket = "my-logs"
}Fails at plan, and in a real module the declaration may just be in another file
variable "declared" {
type = string
}
resource "aws_s3_bucket" "a" {
bucket = var.declared
tags = var.missing
}Nothing consumes it, and unlike a variable there is no interface to preserve
locals {
used = "a"
unused = "b"
}
output "o" {
value = local.used
}These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
It is part of the module's published interface. Every caller setting it breaks on the next upgrade, with an error about an undeclared variable in a module they did not change.
Instead:Deprecate it in the description, and remove it on a major version.
It is still read on every plan and apply, still counts against the provider's rate limit, and still fails the plan if it cannot be read.
Instead:Delete it, or move it inside the check block that needs it if it is there to probe something.
Terraform treats every .tf file in the directory as one module, so a variable used elsewhere in the same module looks unused.
Instead:Concatenate the module's files before checking, or verify each finding against the whole directory.
It is an API call on every plan and every apply, it counts against the provider's rate limit, and if it cannot be read the plan fails. Dead weight with a running cost.
In a root module it is dead configuration that everybody setting values still has to reason about, so delete it. In a module other people call, that variable is part of the published interface: removing it breaks every caller that sets it, which makes it a major version rather than a tidy-up.
There is no interface to preserve. They accumulate when an expression is factored out of one place and the original is left behind, and they are the cheapest thing on this page to delete.
Terraform reads it on every plan whether or not anything uses it. On an account near a rate limit that is a plan that fails intermittently, for a value nobody consumes. If it is there to probe something, a check block is where it belongs, because a failure there is a warning rather than a failed plan.
Terraform's message is clear enough on its own. It appears here because in a module split across files the declaration may be in a file you did not paste, which is the same reason this page cannot be trusted on a partial module.
An output exists to be consumed by something outside the module, so nothing inside it refers to one. "Unused" is not a thing that can be determined from the module, and reporting them all would be noise.
A module is every .tf file in its directory and Terraform does not care which file anything is in. So a variable used in a file you did not include looks unused here. Concatenate the directory before trusting a finding that looks wrong.