terraform-linters / tflint-ruleset-aws

TFLint ruleset for terraform-provider-aws
Mozilla Public License 2.0
327 stars 71 forks source link

Support Provider aliases #331

Closed suzuki-shunsuke closed 2 years ago

suzuki-shunsuke commented 2 years ago

Problem

Terraform supports defining multiple configurations for the same provider, and select which one to use on a per-resource or per-module basis.

https://www.terraform.io/language/providers/configuration#alias-multiple-provider-configurations

But tflint doesn't support this, so even if multiple configurations are defined only one configuration is used. This raises a problem in Deep Checking.

How to reproduce

$ tflint -v
TFLint version 0.35.0
+ ruleset.aws (0.13.2)

.tflint.hcl

plugin "aws" {
  enabled = true
  version = "0.13.2"
  source  = "github.com/terraform-linters/tflint-ruleset-aws"

  deep_check = true
}

main.tf

terraform {
  required_version = ">= 0.15"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "4.0.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

provider "aws" {
  region = "us-east-1"
  alias  = "us-east-1"
}

resource "aws_instance" "reverse_proxy_a01" {
  ami           = "ami-088da9557aae42f39"
  instance_type = "t3.micro"
  key_name      = "bootstrap"
}
$ tflint
2 issue(s) found:

Error: "ami-088da9557aae42f39" is invalid AMI ID. (aws_instance_invalid_ami)

  on main.tf line 21:
  21:   ami           = "ami-088da9557aae42f39"

Error: "bootstrap" is invalid key name. (aws_instance_invalid_key_name)

  on main.tf line 23:
  23:   key_name      = "bootstrap"

This error occurs even if Key Pair and AMI exist in the region ap-northeast-1, because tflint gets resources from us-east-1 using the alias us-east-1.

Solution

I tried to implement this, but it doesn't work well yet.

https://github.com/terraform-linters/tflint-ruleset-aws/pull/332

I'll appreciate if you help me. It is difficult to debug because I don't know how to output the plugin log.

Reference

wata727 commented 2 years ago

It is difficult to debug because I don't know how to output the plugin log.

You can use a custom logger for debugging. https://pkg.go.dev/github.com/terraform-linters/tflint-plugin-sdk@v0.10.1/logger

Logs via this logger are forwarded to TFLint. Depending on the log level, you can filter by TFLINT_LOG.

suzuki-shunsuke commented 2 years ago

Oh, I see. Thank you. I can see the log.

suzuki-shunsuke commented 2 years ago

Solved by https://github.com/terraform-linters/tflint-ruleset-aws/pull/342