hashicorp / hashicorp/terraform

Update `terraform validate` to identify when `replace_triggered_by` references an attribute that's not in a resource's schema

Open
#38,017 1 comment 0 reactions 0 assignees View on GitHub
enhancement new
Dominant language
Go
Stars
49.7k
Forks
10.6k
Avg merge
21h 30m
Merged PRs (30d)
100

Description

### Terraform Version

```shell
Terraform v1.15.0-dev
on darwin_arm64
```

### Use Cases

Users that habitually check the validity of their config using `terraform validate` should be able to detect when a `replace_triggered_by` attribute references an attribute that doesn't exist in that reference's schema. Updating the `validate` command would allow errors like this to be fixed before they cause disruption to a plan-apply workflow.

### Attempted Solutions

There isn't really a work around for this FR other than proceeding with plan-apply workflows and waiting for an error to occur, following the new error detection in the PR mentioned above.

### Proposal

This FR follows https://github.com/hashicorp/terraform/issues/36740. That issue, and the PR that closed it, allow users to detect this issue when creating a plan (either in plan or apply). This means users would only realise that there is a defect in their configuration when that defect would impact a plan, not when it first enters the configuration. Also, the logic detecting bad `replace_triggered_by` references during plan would only be triggered if the resource referenced via `replace_triggered_by` is changed in a plan, so it's possible for a defect to be undetected until several plan-apply cycles have passed.

I propose that the `terraform validate` command should be updated to perform similar validation as in the PR that closed the issue above. This would allow users that habitually check the validity of their config to detect the defect early.

### References

- https://github.com/hashicorp/terraform/issues/36740
- https://github.com/hashicorp/terraform/pull/38010

Implementation wise, I believe this the code for validation would be in:

https://github.com/hashicorp/terraform/blob/c36c81431a0a6ee58e64b4fa70b82d8f0766ac56/internal/terraform/node_resource_validate.go#L283

The `validate` command constructs a graph and walks the 'validatable nodes' within that graph. That logic above is used when validating resources.

Contributor guide

Open the contributing guide

Research direction

Start at internal/terraform/node_resource_validate.go around the referenced validation logic, then compare it with the detection added in PR #38010 and the validatable-node graph used by terraform validate. The work is done when validate reports replace_triggered_by references to attributes absent from the referenced resource schema, before plan or apply.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.