How to evaluate optional() defaults

[matt-FFFFFF]

Hi!

I am trying to evaluate an expression that contains a reference to a variable of type object({ value = optional(string, "foo" }).

I have the following config:

variable "test" {
  type = object({
    value = optional(string, "baz")
  })
  default = {}
}

resource "foo" "example" {
  bar = var.test.value
}

I am using runner.EvaluateExpr on the value of foo_example.bar but receive an error:

Unsupported attribute; This object does not have an attribute named "value".

Is there any way to correctly evaluate the optional() function to ensure that var.test has a value of { value = "baz" }?

Here is the function I am using to perform the check:

func (r *StringRule) Check(runner tflint.Runner) error {
	resources, err := runner.GetResourceContent(r.resourceType, &hclext.BodySchema{
		Attributes: []hclext.AttributeSchema{
			{Name: r.attributeName},
		},
	}, nil)
	if err != nil {
		return err
	}

	for _, resource := range resources.Blocks {
		attribute, exists := resource.Body.Attributes[r.attributeName]
		if !exists {
			continue
		}
		err := runner.EvaluateExpr(attribute.Expr, func(val string) error {
			found := false
			for _, item := range r.expectedValues {
				if item == val {
					found = true
				}
			}
			if !found {
				runner.EmitIssue(
					r,
					fmt.Sprintf("\"%s\" is an invalid attribute value of `%s` - expecting (one of) %s", val, r.attributeName, r.expectedValues),
					attribute.Expr.Range(),
				)
			}
			return nil
		}, nil)
		if err != nil {
			return err
		}
	}

	return nil
}

[wata727]

Hmm, there shouldn't be anything special that a plugin should consider when evaluating optional() defaults.
I also tested it with the template ruleset, and it was evaluated successfully:

$ tflint -v
TFLint version 0.50.3
+ ruleset.template (0.1.0)

.tflint.hcl

plugin "terraform" {
  enabled = false
}

plugin "template" {
  enabled = true
}

main.tf

variable "test" {
  type = object({
    value = optional(string, "baz")
  })
  default = {}
}

resource "aws_instance" "main" {
  instance_type = var.test.value
}

The template ruleset code is terraform-linters/tflint-ruleset-template@7d00c11. The rule implementation is probably not much different from what you wrote: https://github.com/terraform-linters/tflint-ruleset-template/blob/7d00c1180789d0770e540a3313a46f49ccb9e7a9/rules/aws_instance_example_type.go#L62

output

$ tflint
1 issue(s) found:

Error: instance type is baz (aws_instance_example_type)

  on main.tf line 9:
   9:   instance_type = var.test.value

We recommend that you first confirm that the above steps do not cause the problem, and then check the differences. It may be an issue with the SDK or TFLint version.

[matt-FFFFFF]

I appreciate the response. Thank you!

[matt-FFFFFF]

Hi @wata727 The issue seems to be in the test framework rather than the implementation.

When I write a test using helper.TestRunner() I supply the following content:

{
	name: "traversal with optional func",
	rule: attrvalue.NewStringRule("foo", "bar", []string{"baz", "bat"}),
	content: `
variable "test" {
type = object({
	value = optional(string, "baz")
})
default = {}
}
resource "foo" "example" {
bar = var.test.value
}`,
	expected: helper.Issues{},
},

This fails with the Unsupported attribute; This object does not have an attribute named "value". error.

[matt-FFFFFF]

Should I raise an issue?

[wata727]

Understood. The test runner is not fully compatible with the real runner, and this is a documented behavior.
https://pkg.go.dev/github.com/terraform-linters/tflint-plugin-sdk@v0.19.0/helper#Runner.EvaluateExpr

Since the test runner only supports simple evaluation, we recommend that you only ensure that your unit tests can evaluate with EvaluateExpr. Plugins shouldn't have to do much to evaluate complex expressions, so you can think of it as the SDK's responsibility.

If you still need to test complex cases, we recommend implementing integration tests. Below is an example implementation of integration testing in AWS ruleset.
https://github.com/terraform-linters/tflint-ruleset-aws/tree/v0.30.0/integration

[matt-FFFFFF]

Thank you so much for your help 👍