Error when var file includes undeclared variables

[rpdelaney]

Introduction

Terraform gives appropriate warnings for values found in tfvars without a corresponding variable in the configuration:

Proposal

tflint should also raise errors for the same problem.

References

N/A

[bendrucker]

Duplicate of #1877
Resolved #1941

tflint --var 'foo=bar'

Failed to parse variables; <value for var.foo>:1,1-1: Value for undeclared variable; A variable named "foo" was assigned, but the root module does not declare a variable of that name.:

Error: Value for undeclared variable

  on <value for var.foo> line 1:
  (source code not available)

A variable named "foo" was assigned, but the root module does not declare a variable of that name.

[rpdelaney]

@bendrucker I'm sorry, but I'm not sure I understand how this is a solution for me. As a user I want to use tflint in CI to scan for tfvars settings that do not have a corresponding variable. Adding extra command-line switches does not help because that would require me to do the analysis myself, wouldn't it?

[rpdelaney]

Reading the tickets you mentioned, they seem to describe a very different issue than the new feature I'm proposing.

[bendrucker]

Hmm, I looked at --var as a shortcut but it turns out --var-file behaves differently and does not error.

echo 'foo = "bar"' > terraform.tfvars
tflint --var-file terraform.tfvars
# nothing...

#1941 says:

Note that the environment variables TF_VAR_* are not subject to this check. This is the same behavior as Terraform.

Given that the goal is to error in the cases where Terraform prints a warning, this is looking more like a bug/inconsistency.

[wata727]

See https://github.com/hashicorp/terraform/blob/v1.9.0/internal/backend/backendrun/unparsed_value.go#L58-L61

Reading the above comment, it seems like Terraform intentionally makes this a warning rather than an error. There is room for discussion on whether TFLint should actively raise an error or conservatively keep the same behavior as Terraform.

Personally, I think it might be better to provide it as a rule that can be enabled when needed.

[rpdelaney]

If tflint returns a message with the same log level for this as e.g. when a local variable is declared but unused, that would feel internally consistent, no?

[wata727]

It's consistent, but I'm not sure if it helps. Unlike Terraform warnings, TFLint logs are intended for debugging, so they may not be useful for finding typos or other problems.

In your use case, does this help?

[bendrucker]

Hmm ok, definitely not a bug on a third pass...

terraform plan -var foo=bar

│ Error: Value for undeclared variable
│
│ A variable named "foo" was assigned on the command line, but the root module
│ does not declare a variable of that name. To use this value, add a "variable"
│ block to the configuration.

terraform plan -var-file <(echo foo=bar)

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and
found no differences, so no changes are needed.

TFLint is consistent with Terraform.

As far as a rule, the struggle will be referencing the tfvars files. Because they are not part of the module, you'd have to enumerate every tfvars file in the rule config. And then your config is only valid a specific module.

[velkovb]

Just upgraded my Terragrunt version which includes a newer TFLint version and this is a breaking behaviour. We inject a lot of automatic variables that not all modules have, especially third party ones. This really should be a rule that can be toggled.

[velkovb]

I am a bit confused with var-file and TF_VAR_ I can provide values for already declared variables. My issues is that they are not declared and I cannot declare them dynamically.

I rarely use Terraform directly so hadn't really tested it but I see that it is a warning only if I pass a .tfvars files with values for undeclared variables.

But Terragrunt uses the TF_VAR_* approach, not sure why now it is throwing those errors.

[velkovb]

I think I get it now. Terragrunt does the following:
tflint --config ./.terragrunt-cache/ellCj9USNaAqucT2-U5SmL6rf1A/Gu7P37gZ1L3NBihh7GJE9nHhW38/.tflint.hcl --chdir ./.terragrunt-cache/ellCj9USNaAqucT2-U5SmL6rf1A/Gu7P37gZ1L3NBihh7GJE9nHhW38 --var=test=foo

and before the upgrade it was on TFLint 0.47.0 and this functionality was introduced in 0.50.0. Will open an issue on Terragrunt repo to see what can be done about it. Thank you for you time :)

[bendrucker]

Sure! It sounds like moving to passing variables as TF_VAR environment variables from Terragrunt would work. Depending on when the integration was added, it's possible that feature didn't exist yet.

The idea behind matching Terraform behavior is that in the ideal case things "just work" when users call TFLint ahead of a terraform plan in CI. A config option would get the job done but users would have to know to look for it.

[velkovb]

Yes, now I understand it is not a TFLint issue but rather a Terragrunt one :) gruntwork-io/terragrunt#3669

[bendrucker]

Great, feel free to mention me in that issue or a corresponding PR if you need input