azurerm plugin 0.18.0 with tflint 0.40.0 disallowing blank and null resource_group_name on resources

[tspearconquest]

Hi,

I've got a module written for internal use wherein we have added 2 resources: 1 resource group, and 1 storage account.

With any version of tflint before 0.40.0, and azurerm provider before 0.18.0, this code passes tflint checks.

With the aforementioned versions, the checks fail. I believe the check doesn't take into account particular usage of the azurerm_resource_group code in the case of a module wherein the resource group name might be passed from external code, and so we would want to leave the default value blank or as an empty string.

Below is my main.tf code:

resource "azurerm_resource_group" "default" {
  name     = var.rg_name
  location = var.region

  count = var.create_rg ? 1 : 0

  tags = merge(local.common_tags)
  lifecycle {
    ignore_changes = [
      tags["createdDate"]
    ]
  }
}

resource "azurerm_storage_account" "default" {
  name                = var.name
  location            = var.region
  resource_group_name = var.rg_name

  account_tier             = var.tier
  account_replication_type = var.replication_type

  enable_https_traffic_only = true
  min_tls_version           = "TLS1_2"

  tags = merge(local.common_tags)
  lifecycle {
    ignore_changes = [
      tags["createdDate"]
    ]
  }
}

Below is the variable definition for var.rg_name:

variable "rg_name" {
  description = "Storage Resource Group name"
  type        = string
  nullable    = false

  validation {
    condition     = var.rg_name != ""
    error_message = "Must define a name for this storage resource group."
  }
}

By specifying nullable=false on the variable, and including a validation to prevent an empty string being passed (admittedly I can make it more complex, but this is an example).

This code forces terraform to prompt for a resource group name if it is not provided by the code that calls this module, which is what we want.

In older versions of the azurerm tflint plugin, the rule azurerm_storage_account_invalid_resource_group_name did not fail against this code, however now I have to disable the rule and I would like to avoid disabling it.

Disable rule code in .tflint.hcl:

rule "azurerm_storage_account_invalid_resource_group_name" {
  enabled = false
}

Can we please allow blank and null in the rule name for this case? It's a bit niche, I know, but we know what we're doing by setting it up this way and we also run tflint on the other project where the calling code uses this module. When we run tflint there, the module is already initialized and downloaded, and the tfvars have properly populated the value so, any incorrect resource group name coming from the calling code or tfvars will be picked up by tflint in the input to the resource group name on that project where it actually matters.

The point here is that having the resource group name be null or blank is not always fatal and so IMHO it should not cause tflint to fail.

[wata727]

I was not able to reproduce the issue in my environment.

In this case var.rg_name is neither blank nor null and is marked as an unknown value internally. Unknown values are already allowed and do not return an error.

[tspearconquest]

Hi, sorry for the delay in responding to this.

Can you share the code used for your test? I'll try to see if I can spot any difference in how you pass input to the module from how I am doing it and see if I can make the error stop.

[wata727]

Confirmed against the below:

variable "rg_name" {
  description = "Storage Resource Group name"
  type        = string
  nullable    = false

  validation {
    condition     = var.rg_name != ""
    error_message = "Must define a name for this storage resource group."
  }
}

resource "azurerm_storage_account" "default" {
  resource_group_name = var.rg_name
}

plugin "terraform" {
    enabled = false
}

plugin "azurerm" {
    enabled = true
    version = "0.18.0"
    source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
}

$ tflint -v
TFLint version 0.41.0
+ ruleset.azurerm (0.18.0)
$ tflint
# no errors

[tspearconquest]

Disregard, I deleted my comment

[tspearconquest]

I will test and get back to you