iac.htora.dev · security templates

Home/Using the templates/How templates are checked

How templates are checked

Every template runs through the same checks on every change, and again once a week.

The weekly run matters more than it sounds. Providers retire arguments and change defaults, so a template that passed in March can fail in June with nobody touching it. The weekly run is how that gets noticed.

Terraform

CheckWhat it catchesCommand
FormattingThe code is formatted the standard way, so diffs stay readable.terraform fmt -check -diff
ValidTerraform can read it and every reference resolves.terraform init -backend=false && terraform validate
LintUnused declarations, untyped variables, missing version constraints, and deprecated syntax.tflint --minimum-failure-severity=warning
Security scanNo public storage, no missing encryption, no firewall rules open to everyone.checkov -d . --framework terraform

Ansible and Argo CD

Ansible

CheckWhat it catchesCommand
Ansible lintSteps that are not safe to run twice, retired module names, missing names on tasks.ansible-lint
SyntaxAnsible can read the playbook and every module referenced exists.ansible-playbook --syntax-check

Argo CD

CheckWhat it catchesCommand
Kubernetes schemaEvery manifest matches the schema for the kind it claims to be.kubeconform -strict -summary
BuildsThe folder produces valid output before Argo CD ever sees it.kustomize build

Three that need nothing installed

These run in seconds without Terraform, Ansible, or a cluster, so they work as a pre-commit hook or in a locked-down environment.

CheckWhat it catchesCommand
parseEvery file parses. Runs without Terraform installed.python tools/parsecheck.py outcomes
refcheckEvery setting used is declared, every setting declared is used, and quick-start templates stay one file.python tools/refcheck.py outcomes
registrycheckThe site and the repo agree, and every template with code carries its explanation: what you need, what it creates, what catches people, and how to undo it.python tools/registrycheck.py registry/templates.yml

How a template earns its label

Ready means every check for its tool passed on the main branch. The label is changed by hand after someone reads the green run, so it cannot flip on its own by accident.

Draft means the code exists and at least one check has not run or has not passed. Planned means there is no code yet.

The registry check also refuses a template that has code and no explanation. A page here always tells you what you need first, what gets created, what catches people, and how to undo it.

What the checks cannot tell you

They show the code is well formed, uses settings that exist, and creates nothing obviously unsafe. They say nothing about your account, your permissions, or your policies. The check at the end of each template page is there for that.

Registry 0.6.0. Built 2026-09-22.

Made by Habibullah Tora. Code under the MIT licence, writing under CC BY 4.0.