terraform fmt -check, so the diff is about intent

Infrastructure code is edited rarely and by different people each time, so it accumulates whitespace disagreements faster than application code.

$ terraform fmt -recursive -check -diff
main.tf
--- old/main.tf
+++ new/main.tf
-  instance_type="t3.medium"
+  instance_type = "t3.medium"

$ echo $?
3        # non-zero, so it gates a build

$ terraform validate      # and this, in the same job

The point is not tidiness but that a plan reviewed by somebody who does not work on this daily should show only the change — an eleven-line diff with two meaningful lines gets approved without being read. -check is the gate and the rewriting form belongs in an editor or a pre-commit hook, never in CI.