Recursive module check fails with Invalid provider configuration reference

[kayman-mk]

Just found another problem in my pipeline, but I don't have a minimal version for that. My job reports

Failed to check ruleset; failed to check "aws_resource_missing_tags" rule: modules/account_setup/dns/certificate.tf:28,14-33: Invalid provider configuration reference; The provider argument requires a provider type name, optionally followed by a period and then a configuration alias.

terraform apply is fine and the resource definition is unspectacular:

terraform {
  required_providers {
    aws = {
      source                = "hashicorp/aws"
      version               = ">= 2.47"
      configuration_aliases = [aws.product_account]
    }
  }

  required_version = ">= 0.13"
}

resource "aws_acm_certificate" "this" {
  count = var.create_tls_certificate ? 1 : 0

  # ... left out

  provider = aws.product_account
}

Terraform/TfLint/AWS ruleset: newest version

Any idea?

[wata727]

Thank you for reporting this.

This seems to be a bug that occurs when using the count meta-argument. The error is occurring here:

tflint-ruleset-aws/aws/decode.go

Lines 60 to 65 in 06ab7f6

	diags = append(diags, &hcl.Diagnostic{
	Severity: hcl.DiagError,
	Summary: "Invalid provider configuration reference",
	Detail: fmt.Sprintf("The %s argument requires a provider type name, optionally followed by a period and then a configuration alias.", argName),
	Subject: expr.Range().Ptr(),
	})

This means that aws.product_account is not parsed correctly (an expression like this would return two traversers. This error occurs for expressions like "" or aws.production_account.foo).

The reason it doesn't parse correctly is because the expression in the body that contains the count meta-argument returns hclext.BoundExpr. See terraform-linters/tflint-plugin-sdk#205 for more on "bound expression". Since hcl.AbsTraversalForExpr doesn't know the hclext.BoundExpr, it returns an empty traversal and raises this error.

Perhaps a better approach is to implement UnwrapExpression on the hclext.BoundExpr. hcl.AbsTraversalForExpr implicitly unwraps the expression if it implements UnwrapExpression.
https://github.com/hashicorp/hcl/blob/v2.17.0/expr_unwrap.go#L6-L8