tflint

TFLint catches Terraform mistakes that terraform validate misses: invalid instance types, deprecated syntax, unused declarations, and provider-specific errors that would otherwise blow up at apply time. It's a linter built specifically for Terraform, open source and free.

It runs as a single binary, locally or in CI, and it's extensible through plugins, one per cloud provider, that add rules specific to AWS, Azure, or GCP resources. Setup is the binary plus the provider plugin you need. It's fast and focused on correctness and best practices rather than security posture.

Fully free, no paid tier. It's not a security scanner, so it complements rather than replaces Checkov or KICS. Run TFLint to catch Terraform errors and style issues, and run a security scanner alongside it for misconfigurations. Together they cover different halves of the problem.

The catch: it only knows Terraform. It won't touch your CloudFormation, Kubernetes, or other IaC, and it's not looking for security issues. Scope it correctly: it makes your Terraform cleaner and catches provider errors early, but it's one tool in a larger IaC quality stack.