More powerful error message generation with custom variable validation

[Nevon]

Current Terraform Version

Terraform v0.12.20

Use-cases

When validating lists, sets or maps using custom variable validation, it would be helpful to be able to reference which item in the collection is invalid from within the error message. Imagine adding a new validation to a list with 20 items and trying to figure out which one is invalid.

Attempted Solutions

I thought that I could essentially re-do the validation inside a string interpolation block, such as this:

validation {
  condition     = length([for topic in var.topics : topic.name if length(topic.acls) == 0]) == 0
  error_message = "Topics must have at least one ACL attached. Invalid topic(s): ${join(", ", [for topic in var.topics : topic.name if length(topic.acls) == 0])}"
}

But this yielded the error message:

Error: Function calls not allowed

  on ../../modules/confluent-cloud/kafka/variables.tf line 92, in variable "topics":
  92:     error_message = "Topics must have at least one ACL attached. Invalid topic(s): ${join(", ", [for topic in var.topics : topic.name if length(topic.acls) == 0])}"

Functions may not be called here.

Proposal

Allow function calls within the error message so that we can generate more helpful errors.

[apparentlymart]

Thanks for the feedback, @Nevon!

It seems reasonable that error_message could be evaluated in the same constrained way that condition is evaluated, where functions are allowed and references to the variable itself are allowed but no other global references are allowed. I think all of the infrastructure to support that evaluation should already be present in order to support evaluating condition.

Since this ability could be added later without a breaking change we may save implementing it until after the feature leaves experimental status, but we'll see how that plays out in relation to other work.

Thanks again!

[Nevon]

Would you be open to accepting a PR implementing this, in case I find myself very bored at some point, or should the feature go through some sort of acceptance process before any implementation would be accepted?

[joeaawad]

@apparentlymart it looks like this feature has been out of experimental mode for two major releases. In my experience, this issue is a substantial pain point and I am really interested in getting this fixed. I believe #28044 is ready for merging and I'm happy to do anything I can to help push it across the finish line.

[gwvandesteeg]

Being able to actually see the value that is causing the error is just simply required when debugging validation issues.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.