tflint fails to find any issues if it fails to check a rule

[tbutler-qontigo]

Summary

In a reusable module, the path to a config file is defined as a variable with a default of null

variable "lb_details_path" {
  default     = null
}

There is no "sensible" default this could have - null or empty string both produce the same result.

a local then tries to use this to decode a file

jsondecode(file("${path.root}/${var.lb_details_path}"))

which is then used to create a resource - see the terraform configuration below
When running tflint on the module folder, no value is supplied for lb_details_path so the file cannot be read, resulting in an application error:

Failed to check ruleset; Failed to check `azurerm_lb_probe_invalid_protocol` rule: main.tf:6,53-72: Invalid template interpolation value; The expression result is null. Cannot include a null value in a string template.

and tflint does not proceed any further and so does not detect any of the other issues.
If I create a dummy file. lb.json which just contains an empty array, [] and run tflint with this:

tflint --var='lb_details_path=lb.json' .

then it gets past this issue and correctly reports all the other problems with the file

Our use of tflint is in configured CI builds which won't necessarily have any specific knowledge of a given module so wouldn't be able to pass such a fake file at the command line.

It seems like tflint should be able to handle the case where it is unable to check a rule and then carry on checking the other rules - so in this case it would report that it failed to check the azurerm_lb_probe_invalid_protocol rule but would also carry on and report all the other issues like no type or description for the variable, no version constraints, no outputs file etc.

Command

tflint .

Terraform Configuration

variable "lb_details_path" {
  description = "Path of the file definining Load Balancer Rules"
  default     = null
}

locals {
  lb_details_file = jsondecode(file("${path.root}/${var.lb_details_path}"))
  lb_details = { for idx, lb_detail in local.lb_details_file : lb_detail.name => {
    idx : idx,
    lb_detail : lb_detail,
    }
  }
}

resource "azurerm_lb_probe" "lb_probe" {
  for_each            = local.lb_details
  name                = lower("${each.value.lb_detail.name}-probe")
  resource_group_name = var.resource_group_name
  loadbalancer_id     = azurerm_lb.lb.id
  port                = each.value.lb_detail.port

  timeouts {
    create = "60m"
    update = "2h"
    delete = "2h"
  }
}

TFLint Configuration

plugin "terraform" { 
  enabled = true
  preset  = "all"
}

plugin "azurerm" {
  enabled = true
  version = "0.20.0"
  source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
}

Output

Failed to check ruleset; Failed to check `azurerm_lb_probe_invalid_protocol` rule: main.tf:6,53-72: Invalid template interpolation value; The expression result is null. Cannot include a null value in a string template.

TFLint Version

0.44.1

Terraform Version

1.3.7

Operating System

• Linux
• macOS
• Windows

[wata727]

In this case, it is recommended to remove the default value:

variable "lb_details_path" {
  description = "Path of the file definining Load Balancer Rules"
}

Variables without defaults are treated as unknown values and TFLint does not raise an error.

[tbutler-qontigo]

Thanks - I will need to validate if we can do that in this specific case (I don't know why it was set as default null tbh) but I think the general point is valid anyway though right? Not being able to process one rule, as in this case, should not prevent tflint from processing all the other rules, or indeed the same rule somewhere else in the file.

[wata727]

Agreed. Being able to handle multiple errors is a valid feature request. This will be put in the backlog.