search

hashicorp / terraform-config-inspect

A helper library for shallow inspection of Terraform configurations
Mozilla Public License 2.0
383 stars 76 forks source link

Support for reading terraform backend configuration #25

Closed burck1 closed 1 year ago

burck1 commented 5 years ago

I have a need to be able to read the terraform backend configuration as a validation step before executing terraform. Does it make sense for me to build that into this library?

Looking through the code, it looks like I would need to add to tfconfig/module.go:Module a string property to store the backend type (s3, consul, etc) and a map property to store the backend configuration settings. Then I would need to update tfconfig/load_hcl.go:loadModule and tfconfig/load_legacy.go:loadModuleLegacyHCL to support reading the values, and finally update main.go:showModuleMarkdown to display the values.

Does all that make sense? Am I missing anything?

teamterraform commented 5 years ago

Hi @burck1!

The scope of this library is reading the parts of a Terraform module that are relevant when it's being used as a child module, such as when distributed via a module registry. We didn't intend for it to expose the parts that live in the root module only and apply to the whole configuration. We're intentionally keeping the scope of this codebase minimal because it's essentially a forked subset of Terraform's own decoder and so the more that is implemented over here the more likely it is that the two implementations will diverge over time as the language changes.

Our longer-term goal here has been to replace the existing terraform show command with something more general that can produce JSON representations of various Terraform constructs, including provider schemas, configurations, etc.

We already defined the JSON representation of a loaded configuration as part of existing terraform show -json functionality, but in order to retain compatibility with that command we were forced to live within its constraints of only supporting JSON rendering of the current state or of a saved plan for now.

As far as we recall, there isn't an existing issue in the main Terraform repository covering the idea of having Terraform itself produce a detailed summary of configuration, so if you'd like to open an issue about this use-case over there that'd be much appreciated, and then we can use that issue to work through the design of such a command.

A tricky part of your specific request is that you want to look at the backend configuration in particular, and that's not currently part of the defined JSON format in Terraform either. However, if you mention that in your new issue we can think about how best to include it... it may require a specialized mode for whatever command we eventually implement to say that you are only interested in the backend configuration, since otherwise the command would probably require you to have already run terraform init first and would thus defeat the point of pre-validating the backend configuration.

sushant-pradhan commented 4 years ago

@teamterraform is there a way to validate if the terraform code is having a non local backend set? I understand we need to do a tf init to run a tf show but is it even possible to check what is the backend configured (as I need to disallow local backend in my pipeline)

yermulnik commented 1 year ago

@burck1 @sushant-pradhan Have you guys found a way to read TF backend config?

sushant-pradhan commented 1 year ago

@yermulnik I was able to achieve it using an external policy rule (opa). Basically run a init, then validate .terraform/terraform.tfstate for presence of non-local backend. There may be a better way now but I haven't explored this recently