- Run `terraform fmt -recursive` before every commit to canonicalize HCL indentation and alignment — use `terraform fmt -check -recursive` in CI to fail on unformatted files.
- Configure TFLint with a `.tflint.hcl` file and enable the provider-specific ruleset plugin (e.g., `plugin "aws" { source = "github.com/terraform-linters/tflint-ruleset-aws" }`).
- Enforce `terraform validate` in CI pipelines to catch missing required arguments and invalid attribute references before plan.
- Use Checkov (`checkov -d .`) or tfsec (`tfsec .`) for security policy scanning alongside TFLint linting.