terraform-linters / tflint-ruleset-aws

TFLint ruleset for terraform-provider-aws
Mozilla Public License 2.0
336 stars 72 forks source link

aws_iam_role_invalid_path should allow empty string #50

Closed unacceptable closed 3 years ago

unacceptable commented 3 years ago

Problem statement

When writing a terraform module with a var.path as the IAM Role path the following error is thrown:

2 issue(s) found:

Error: path must be 1 characters or higher (aws_iam_role_invalid_path)

  on iam.tf line 38:
  38:   path               = var.path

Error: "" does not match valid pattern ^(\x{002F})|(\x{002F}[\x{0021}-\x{007F}]+\x{002F})$ (aws_iam_role_invalid_path)

  on iam.tf line 38:
  38:   path               = var.path

I believe that the regex pattern should be something like: (^(\x{002F})|(\x{002F}[\x{0021}-\x{007F}]+\x{002F})$|^$) to account for modules with variables that default to empty strings (which the provider will really default to /).

Version

TFLint version 0.23.1
+ ruleset.aws (0.1.2-bundled)
unacceptable commented 3 years ago

I'd be happy to put in a PR for this if someone could point me in the right direction. In the mean time I just updated my .tflint.hcl in my module like so:

# null path will default to "/" (Optional)
#    https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role#path
rule "aws_iam_role_invalid_path" {
  enabled = false
}
bendrucker commented 3 years ago

If you intend for the value to be unset and for a provider or upstream default to be used, it's better to use null. You can have a look at how the roles in this repo are generated. A change would have broader implications and wouldn't just apply to this one rule.

unacceptable commented 3 years ago

@bendrucker,

I didn't know that was a thing. I will have to give that a try. Thanks for the information.

Respectfully, Robert J.