diff --git a/ec2api/api/ec2utils.py b/ec2api/api/ec2utils.py
index 4d604ee4..aa7d396f 100644
--- a/ec2api/api/ec2utils.py
+++ b/ec2api/api/ec2utils.py
@@ -163,7 +163,7 @@ def dict_to_xml(data_dict, root_tag):
     return root
 
 
-_ms_time_regex = re.compile('^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3,6}Z$')
+_ms_time_regex = re.compile(r'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3,6}Z$')
 
 
 def is_ec2_timestamp_expired(request, expires=None):
@@ -219,6 +219,7 @@ def change_ec2_id_kind(obj_id, new_kind):
     return '%(kind)s-%(id)s' % {'kind': new_kind,
                                 'id': obj_id.split('-')[-1]}
 
+
 NOT_FOUND_EXCEPTION_MAP = {
     'vpc': exception.InvalidVpcIDNotFound,
     'igw': exception.InvalidInternetGatewayIDNotFound,
@@ -502,9 +503,9 @@ def get_default_vpc(context):
 
 # NOTE(ft): following functions are copied from various parts of Nova
 
-_ephemeral = re.compile('^ephemeral(\d|[1-9]\d+)$')
+_ephemeral = re.compile(r'^ephemeral(\d|[1-9]\d+)$')
 
-_dev = re.compile('^/dev/')
+_dev = re.compile(r'^/dev/')
 
 
 def block_device_strip_dev(device_name):
diff --git a/ec2api/api/route_table.py b/ec2api/api/route_table.py
index 6d76b578..6cac372e 100644
--- a/ec2api/api/route_table.py
+++ b/ec2api/api/route_table.py
@@ -613,7 +613,7 @@ def _get_subnet_host_routes_and_gateway_ip(context, route_table, cidr_block,
         if 'gateway_id' in route:
             gateway_id = route['gateway_id']
             if gateway_id and gateway_id not in destinations:
-                    return '127.0.0.1'
+                return '127.0.0.1'
             return gateway_ip
         network_interface = destinations.get(route['network_interface_id'])
         if not network_interface:
diff --git a/ec2api/api/validator.py b/ec2api/api/validator.py
index e0a0d67b..c6e6cd7c 100644
--- a/ec2api/api/validator.py
+++ b/ec2api/api/validator.py
@@ -94,7 +94,7 @@ def validate_cidr_with_ipv6(cidr, parameter_name, **kwargs):
     return True
 
 
-_cidr_re = re.compile("^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$")
+_cidr_re = re.compile(r"^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$")
 
 
 def validate_cidr(cidr, parameter_name):
@@ -199,7 +199,7 @@ def validate_security_group_str(value, parameter_name, vpc_id=None):
     # NOTE(Alex) Amazon accepts any ASCII for EC2 classic;
     # for EC2-VPC: a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=&;{}!$*
     if vpc_id:
-        allowed = '^[a-zA-Z0-9\._\-:/\(\)#,@\[\]\+=&;\{\}!\$\*\ ]+$'
+        allowed = r'^[a-zA-Z0-9\._\-:/\(\)#,@\[\]\+=&;\{\}!\$\*\ ]+$'
     else:
         allowed = r'^[\x20-\x7E]+$'
     msg = ''
diff --git a/ec2api/cmd/api_metadata.py b/ec2api/cmd/api_metadata.py
index 3027a9d6..e373c923 100644
--- a/ec2api/cmd/api_metadata.py
+++ b/ec2api/cmd/api_metadata.py
@@ -35,5 +35,6 @@ def main():
     service.serve(server, workers=server.workers)
     service.wait()
 
+
 if __name__ == '__main__':
     main()
diff --git a/ec2api/cmd/api_s3.py b/ec2api/cmd/api_s3.py
index 5c4ae6b7..aacd703a 100644
--- a/ec2api/cmd/api_s3.py
+++ b/ec2api/cmd/api_s3.py
@@ -34,5 +34,6 @@ def main():
     service.serve(server)
     service.wait()
 
+
 if __name__ == '__main__':
     main()
diff --git a/ec2api/db/__init__.py b/ec2api/db/__init__.py
index 323b0cd3..ae15e1b6 100644
--- a/ec2api/db/__init__.py
+++ b/ec2api/db/__init__.py
@@ -16,4 +16,4 @@
 DB abstraction for EC2api
 """
 
-from ec2api.db.api import *
+from ec2api.db.api import *  # noqa: F401
diff --git a/ec2api/db/migration.py b/ec2api/db/migration.py
index b8581382..8b6427a1 100644
--- a/ec2api/db/migration.py
+++ b/ec2api/db/migration.py
@@ -56,6 +56,7 @@ class LazyPluggable(object):
         backend = self.__get_backend()
         return getattr(backend, key)
 
+
 IMPL = LazyPluggable('backend',
                      config_group='database',
                      sqlalchemy='ec2api.db.sqlalchemy.migration')
diff --git a/ec2api/hacking/checks.py b/ec2api/hacking/checks.py
index b6d3ad9f..f0dbd681 100644
--- a/ec2api/hacking/checks.py
+++ b/ec2api/hacking/checks.py
@@ -14,6 +14,8 @@
 
 import re
 
+from hacking import core
+
 
 _all_log_levels = {'critical', 'error', 'exception', 'info',
                    'warning', 'debug'}
@@ -28,6 +30,7 @@ _log_translation_hint = re.compile(
     })
 
 
+@core.flake8ext
 def no_translate_logs(logical_line, filename):
     """N537 - Don't translate logs.
 
@@ -46,7 +49,3 @@ def no_translate_logs(logical_line, filename):
     """
     if _log_translation_hint.match(logical_line):
         yield (0, "N537: Log messages should not be translated!")
-
-
-def factory(register):
-    register(no_translate_logs)
diff --git a/ec2api/tests/unit/__init__.py b/ec2api/tests/unit/__init__.py
index 6631babf..5efe9e24 100644
--- a/ec2api/tests/unit/__init__.py
+++ b/ec2api/tests/unit/__init__.py
@@ -27,5 +27,5 @@ setattr(builtins, '_', lambda x: x)
 
 # NOTE(ft): this is required by test_s3.S3APITestCase to switch execution
 # between test and server threads
-import eventlet
+import eventlet  # noqa: E402
 eventlet.monkey_patch(socket=True)
diff --git a/ec2api/tests/unit/fakes.py b/ec2api/tests/unit/fakes.py
index 3da0ab98..1f8a5972 100644
--- a/ec2api/tests/unit/fakes.py
+++ b/ec2api/tests/unit/fakes.py
@@ -45,6 +45,7 @@ def random_ec2_id(kind):
 #        OS - object is stored in OpenStack
 #    object_name - identifies the object
 
+
 # common constants
 ID_OS_USER = random_os_id()
 ID_OS_PROJECT = random_os_id()
@@ -949,6 +950,7 @@ class OSInstance_full(OSInstance):
         setattr(self, 'OS-EXT-SRV-ATTR:hostname',
                 instance_dict.get('hostname'))
 
+
 OS_INSTANCE_1 = {
     'id': ID_OS_INSTANCE_1,
     'flavor': {'id': 'fakeFlavorId'},
@@ -1415,7 +1417,6 @@ NOVA_SECURITY_GROUP_2 = {
 }
 EC2_NOVA_SECURITY_GROUP_1 = {
     'groupDescription': 'Group description',
-    'ipPermissions': None,
     'groupName': 'groupname',
     'ipPermissionsEgress': None,
     'ipPermissions':
@@ -1596,6 +1597,7 @@ class OSImage(object):
     def __getitem__(self, key):
         return self._image_dict.get(key)
 
+
 TIME_CREATE_IMAGE = ec2utils.isotime(None, True)
 
 EC2_IMAGE_1 = {
@@ -1645,7 +1647,6 @@ EC2_IMAGE_2 = {
     'name': None,
     'description': 'fake desc',
     'imageLocation': 'None (None)',
-    'architecture': None,
     'rootDeviceType': 'ebs',
     'rootDeviceName': ROOT_DEVICE_NAME_IMAGE_2,
     'architecture': 'x86_64',
@@ -1766,6 +1767,7 @@ class OSSnapshot(object):
     def update(self, *args, **kwargs):
         pass
 
+
 TIME_CREATE_SNAPSHOT_1 = ec2utils.isotime(None, True)
 TIME_CREATE_SNAPSHOT_2 = ec2utils.isotime(None, True)
 
@@ -1946,6 +1948,7 @@ class NovaAvailabilityZone(object):
             nova_availability_zone_dict['zoneState'] == 'available')}
         self.hosts = nova_availability_zone_dict['hosts']
 
+
 OS_AVAILABILITY_ZONE = {'zoneName': NAME_AVAILABILITY_ZONE,
                         'zoneState': 'available',
                         'hosts': {'host1': {'service1': {
diff --git a/ec2api/tests/unit/tools.py b/ec2api/tests/unit/tools.py
index a2df0fae..992e7120 100644
--- a/ec2api/tests/unit/tools.py
+++ b/ec2api/tests/unit/tools.py
@@ -172,7 +172,7 @@ def deepcopy_call_args_saver(destination):
     return side_effect
 
 
-_xml_scheme = re.compile('\sxmlns=".*"')
+_xml_scheme = re.compile(r'\sxmlns=".*"')
 
 
 def parse_xml(xml_string):
diff --git a/ec2api/utils.py b/ec2api/utils.py
index 425ed1ec..cef06390 100644
--- a/ec2api/utils.py
+++ b/ec2api/utils.py
@@ -29,6 +29,7 @@ def get_hash_str(base_str):
     """returns string that represents hash of base_str (in hex format)."""
     return hashlib.md5(base_str).hexdigest()
 
+
 if hasattr(hmac, 'compare_digest'):
     constant_time_compare = hmac.compare_digest
 else:
diff --git a/lower-constraints.txt b/lower-constraints.txt
index e3a634ae..6469c921 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -23,10 +23,8 @@ eventlet==0.20.0
 extras==1.0.0
 fasteners==0.14.1
 fixtures==3.0.0
-flake8==2.5.5
 future==0.16.0
 greenlet==0.4.13
-hacking==0.12.0
 httplib2==0.10.3
 idna==2.6
 imagesize==1.0.0
@@ -73,10 +71,7 @@ packaging==17.1
 Paste==2.0.3
 PasteDeploy==1.5.2
 pbr==3.1.1
-pep8==1.5.7
 prettytable==0.7.2
-pycparser==2.18
-pyflakes==0.8.1
 Pygments==2.2.0
 pyinotify==0.9.6
 pylint==1.4.5
diff --git a/test-requirements.txt b/test-requirements.txt
index 8138fa49..07d974ce 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,7 +1,7 @@
 # The order of packages is significant, because pip processes them in the order
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
-hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
+hacking>=3.0,<3.1.0 # Apache-2.0
 
 coverage>=4.5.1 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
diff --git a/tox.ini b/tox.ini
index 0ea0dfd2..e8679493 100644
--- a/tox.ini
+++ b/tox.ini
@@ -50,15 +50,19 @@ commands =
 #      in sqlalchemy.
 # TODO Hacking 0.6 checks to fix
 # H102  Apache 2.0 license header not found
-ignore = E121,E122,E123,E124,E126,E127,E128,E711,E712,H102,H303,H404,F403,F811,F841
+# W503 line break before binary operator
+# W504 line break after binary operator
+ignore = E121,E122,E123,E124,E126,E127,E128,E711,E712,H102,H303,H404,F403,F811,F841,W503,W504
 # H106: Don't put vim configuration in source files
 # H203: Use assertIs(Not)None to check for None
 enable-extensions=H106,H203
 exclude =  .venv,.git,.tox,dist,envname,*lib/python*,*egg,build,tools
 max-complexity=25
 
-[hacking]
-local-check-factory = ec2api.hacking.checks.factory
+[flake8:local-plugins]
+extension =
+    N537 = checks:no_translate_logs
+paths = ./ec2api/hacking
 
 [testenv:lower-constraints]
 deps =