# Terraform / HCL Studio

Paste a .tf or drop several files to list resources, variables, modules and providers, and to flag strings written directly into password-like attributes, SSH and RDP open to 0.0.0.0/0, unpinned provider and module versions, undefined var., local. and module. references, and duplicate definitions, each with a line number. It can also format HCL, but the result is not identical to terraform fmt, and it does not run plan or apply. For Kubernetes YAML use Kubernetes Studio, and for CI files use GitHub Actions Studio.

- URL: https://tools.itlibra.com/en/terraform-studio
- On-device・No upload
- Last updated: 2026-10-31

## How to use

1. Paste a .tf, or drop files (several allowed; “Choose file” works too). “Try a sample” shows how it works.
2. Open “Structure” for the block list, variables (type, default, sensitive), module source and version, and provider versions.
3. Open “Findings” for a list ordered by severity, with file names and line numbers. Secret-looking values themselves are not shown. If variables live in another file, add that file too.
4. Use “Format” to copy or save the .tf with aligned indentation and =. Nothing is formatted when there is a syntax error.

## Use cases

- Check before committing that passwords or access keys are not written directly in a .tf
- Check whether a security group allows SSH or RDP from 0.0.0.0/0
- See at a glance whether provider and module versions are pinned
- Find the line of an HCL syntax error where you cannot run terraform

## What it does

### Its own HCL parser

Reads ${ } interpolation in strings, \<\<EOT and \<\<-EOT heredocs, #, // and /\* \*/ comments, lists and objects. Anything it cannot parse is reported with a line number.

### Only findings with a basis

Checks strings written into secret-like attributes, secret-like variables without sensitive, unpinned versions, 0.0.0.0/0 access to ports 22 and 3389 in aws\_security\_group and similar, public-read style S3 ACLs, undefined references and duplicates.

### Secret values stay off the screen

Findings show attribute names only, never a value written in the file, and the variable table hides defaults of secret-like variables. The Format output tidies the .tf as it is, so it does contain the values.

### Formatting close to terraform fmt

Uses a 2-space indent and aligns = across consecutive one-line attributes. Heredoc bodies are left alone. It is not identical to terraform fmt.

### Several files at once

Reads main.tf, variables.tf and others together, and matches variable, local and module definitions across files.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Reading .tf (HCL) and listing blocks (several files) | Supported | — |
| Hardcoded secrets, sensitive and unpinned versions | Partial | Only items judged by name and shape. No finding does not mean safe |
| SSH and RDP from 0.0.0.0/0 in aws\_security\_group and similar, S3 ACLs | Partial | Only some AWS resources. Ports given by a variable are not judged |
| Undefined var., local. and module. references, and duplicate definitions | Supported | — |
| Formatting indentation and = alignment | Partial | The result is not identical to terraform fmt |
| Reading plan, apply or state files | Not supported | Nothing is run and no state is read |
| Validating against provider schemas (attribute names and types) | Not supported | Misspelled attributes and wrong types are not flagged |
| Validating .tf.json (JSON syntax) and .tfvars | Not supported | Only text written in the .tf syntax is read |

## Limits & notes

- Input is limited to 400,000 characters in total, 30 files and 300 KB per file. Anything beyond is not read, and you are told.
- Provider schemas are not available, so misspelled attributes, missing required attributes and wrong value types are not flagged.
- Findings are judged from the strings and names as written. Values built with variables or functions, and the inside of other modules, are not followed.
- Undefined references are searched only within what you pasted. They are not checked when there is a syntax error.

## Privacy & safety

Pasted .tf text and dropped files are processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

## FAQ

### Is the output the same as terraform fmt?

Not exactly. This page uses a 2-space indent and aligns = across consecutive attributes, but it may handle comments and expressions differently. Run terraform fmt before you commit.

### Why is SSH from 0.0.0.0/0 a problem?

It lets anyone on the internet try to connect to port 22. Limiting it to a bastion address or your own address range is the usual approach. This page flags lines written that way.

### Does sensitive = true make a secret safe?

It hides the value in plan output and similar screens, but the value stays in the state file in plain text, so the state still has to be protected. This page only checks whether sensitive is set.

### How do I pin a provider version?

Write source and version in required\_providers inside the terraform block. For example, \~\> 5.0 means 5.0 or newer but below 6.0. The .terraform.lock.hcl file records the selected version, but this page does not read it.

### It reports an undefined reference, but I did define it.

If it is defined in another file, add that file as well. This page searches only within what you provide.