TFLint Rules: Enabling and Disabling Checks
TFLint rules are toggled individually with rule blocks in .tflint.hcl or suppressed inline with tflint-ignore comments.
Not every rule fits every repo. TFLint lets you disable a noisy rule globally in config, run a single rule, or silence one finding on one line without turning the rule off everywhere.
What it does
A rule "name" { enabled = false } block in .tflint.hcl turns a specific rule off (or on). The --only flag runs exactly one rule. An inline # tflint-ignore: rule_name comment above a block suppresses that rule for the following resource only, which keeps a justified exception local.
Common usage
# .tflint.hcl: disable one core rule globally
rule "terraform_unused_declarations" {
enabled = false
}Inline ignore
# tflint-ignore: aws_instance_invalid_type
resource "aws_instance" "legacy" {
instance_type = "t2.micro"
}Options
| Mechanism | What it does |
|---|---|
| rule "<name>" { enabled = false } | Disable a rule for the whole config |
| --only <rule> | Run only the named rule |
| --enable-rule / --disable-rule <name> | Toggle a rule from the command line |
| # tflint-ignore: <rule> | Suppress a rule for the next block only |
| # tflint-ignore-file: <rule> | Suppress a rule for the whole file |
In CI
Prefer inline # tflint-ignore with a nearby comment over disabling a rule globally, so the exception is visible in review and scoped to the one resource. Keep .tflint.hcl in the repo so local and CI runs apply the same rule set.
Common errors in CI
"Rule not found: <name>" means a typo in a rule block or an ignore comment, or the rule lives in a plugin that is not enabled. An ignore comment that does not silence a finding is usually misplaced; it must sit on the line directly above the flagged block. Disabling a rule in config but still seeing it means a different config file was loaded; check --config.