tflint: Configure Options for evaluating expressions within Terraform code

[ruparee]

I am creating a custom tflint rule tags_local_rule to check if the attribute tags is set to local.tags so that if the attribute is not set as required, the rule will emit an issue indicating that the tags attribute should be set to local.tags. This is a business driven pattern I need to enforce. Is there a way (regexp or otherwise) to check if tags=local.tags and even better convert cty.ObjectVal(map[string]cty.Value{"Module":cty.StringVal("lambda1")}) to a readable format?

Expected Behavior

Basically for a Terraform configuration containing multiple resource blocks, when I execute tags_local_rulerule, then the rule should traverse blocks to find the tags attribute and

1. For each resource block that contains the tags attribute, it should check if the value is set to local.tags.

   Result: Should not emit issue. Should print: local.tags matches pattern local.tags

2. If the tags attribute is not set to local.tags (e.g. tags = var.tags), the rule should emit an issue indicating that the tags attribute should be set to local.tags.

   Result: Should emit issue

   tflint    
   1 issue(s) found:
   
   Error: `var.tags` does not match valid pattern `local.tags` (tags_local_rule)
   
   on lambda.tf line 9:
       9:   tags = var.tags

3. The rule should pass if all resource blocks with the tags are set to local.tags.

Current Behaviour

1. For each resource block that contains the tags attribute, it should check if the value is set to local.tags.

   Result: Emits below error

   tflint
   1 issue(s) found:
   
    Error: `cty.ObjectVal(map[string]cty.Value{"Module":cty.StringVal("lambda1")})` does not match valid pattern local.tags (tags_local_rule)
   
      on lambda.tf line 9:
      9:   tags = local.tags 

2. If the tags attribute is not set to local.tags (e.g. tags = var.tags), the rule should emit an issue indicating that the tags attribute should be set to local.tags.

    tflint    
   1 issue(s) found:
   
    Error: `cty.MapVal(map[string]cty.Value{"Module":cty.StringVal("lambda1")})` does not match valid pattern local.tags (tags_local_rule)
   
     on lambda.tf line 9:
      9:   tags = var.tags 

Steps to Reproduce

tags_local_rule

package rules

import (
	"fmt"
	"regexp"

	"github.com/terraform-linters/tflint-plugin-sdk/hclext"
	"github.com/terraform-linters/tflint-plugin-sdk/logger"
	"github.com/terraform-linters/tflint-plugin-sdk/tflint"
	"github.com/zclconf/go-cty/cty"
)


type TagsLocalRule struct {
	tflint.DefaultRule

	attributeName string
	pattern       *regexp.Regexp
}

func NewTagsLocalRule() *TagsLocalRule {
	return &TagsLocalRule{
		attributeName: "tags",
		pattern: regexp.MustCompile(`^local.tags$`),
	}
}

func (rule *TagsLocalRule) Name() string {
	return "tags_local_rule"
}

func (rule *TagsLocalRule) Enabled() bool {
	return true
}

// Severity returns the rule severity
func (rule *TagsLocalRule) Severity() tflint.Severity {
	return tflint.ERROR
}


func (rule *TagsLocalRule) Check(runner tflint.Runner) error {
	
    resources, err := runner.GetResourceContent("aws_lambda_function", &hclext.BodySchema{
		Attributes: []hclext.AttributeSchema{
			{Name: "tags"},
		},
	}, &tflint.GetModuleContentOption{ModuleCtx: tflint.RootModuleCtxType, ExpandMode: tflint.ExpandModeExpand})
	if err != nil {
		return err
	}

	for _, resource := range resources.Blocks {
		attribute, exists := resource.Body.Attributes["tags"]
		if !exists {
			continue
		}

		if _, ok := resource.Body.Attributes["tags"]; ok {
			logger.Debug(fmt.Sprintf("Attribute : **************** -> %v", attribute.Expr))
			err := runner.EvaluateExpr(attribute.Expr, func(val cty.Value) error {
				if !rule.pattern.MatchString(val.GoString()) {
					runner.EmitIssue(
						rule,
						fmt.Sprintf("%s does not match valid pattern %s", val.GoString(), `local.tags`),
						attribute.Expr.Range(),
					)
				} else {
					logger.Debug(fmt.Sprintf("%s matches pattern %s", val, `local.tags`))
				}
				return nil
			}, nil)
			if err != nil {
				return err
			}
		}
	}

	return nil
}

variables.tf

variable "tags" {
  description = "A map of tags to assign to resources."
  type        = map(string)
  default     = {
    Module = "lambda1"
  }
}

main.tf

locals {
  tags = {
    Module = "lambda1"
  }
}

resource "aws_lambda_function" "this" {
  function_name                      = var.function_name
  tags = local.tags
  # Other attributes

}

[bendrucker]

Sounds like you don't want to actually evaluate the expression in question. Expression evaluation is the process of producing an actual value given a context. You just want to inspect syntax:

https://pkg.go.dev/github.com/hashicorp/hcl/v2/hclsyntax

There are some examples in the terraform ruleset of inspecting syntax and expression types rather than evaluating the expression to a cty.Value.

[ruparee]

@bendrucker thanks and I will take a look at examples in the terraform ruleset. Having said that, how can I correctly evaluate the expression? I am thinking this might be an option I can explore as well :-)

[wata727]

cty.Value is already a correctly evaluated value. To convert this to other Go value formats like map[string]string, change the argument type of EvaluateExpr.
https://pkg.go.dev/github.com/terraform-linters/[email protected]/tflint#Runner

That said, evaluating the expression would result in excessive complexity in your case. The SDK's terraform/lang package is a good option for working with references without evaluating expressions.
https://pkg.go.dev/github.com/terraform-linters/[email protected]/terraform/lang

[ruparee]

@wata727 and @bendrucker many thanks for your inputs. I am now exploring the options you have provided. Am good to close the discussion.