github.com/terraform-linters/tflint@v0.51.2-0.20240520175844-3750771571b6/docs/user-guide/compatibility.md (about)

     1  # Compatibility with Terraform
     2  
     3  TFLint interprets the [Terraform language](https://developer.hashicorp.com/terraform/language) with its own parser which is a fork of the Terraform's native one. This allows it to be parsed correctly even if Terraform is not installed at runtime.
     4  
     5  The parser supports Terraform v1.x syntax and semantics. The language compatibility on Terraform v1.x is defined by [Compatibility Promises](https://developer.hashicorp.com/terraform/language/v1-compatibility-promises). TFLint follows this promise. New features are only supported in newer TFLint versions, and bug and experimental features compatibility are not guaranteed.
     6  
     7  The latest supported version is Terraform v1.8.
     8  
     9  ## Input Variables
    10  
    11  Like Terraform, TFLint supports the `--var`,` --var-file` options, environment variables (`TF_VAR_*`), and automatically loading variable definitions (`terraform.tfvars` and `*.auto.tfvars`) files. See [Input Variables](https://developer.hashicorp.com/terraform/language/values/variables).
    12  
    13  Input variables are evaluated just like in Terraform:
    14  
    15  ```hcl
    16  variable "instance_type" {
    17    default = "t2.micro"
    18  }
    19  
    20  resource "aws_instance" "foo" {
    21    instance_type = var.instance_type # => "t2.micro"
    22  }
    23  ```
    24  
    25  Unknown variables (e.g. no default) are ignored:
    26  
    27  ```hcl
    28  variable "instance_type" {}
    29  
    30  resource "aws_instance" "foo" {
    31    instance_type = var.instance_type # => ignored
    32  }
    33  ```
    34  
    35  Sensitive variables are ignored. This is to avoid unintended disclosure.
    36  
    37  ```hcl
    38  variable "instance_type" {
    39    sensitive = true
    40    default   = "t2.micro"
    41  }
    42  
    43  resource "aws_instance" "foo" {
    44    instance_type = var.instance_type # => ignored
    45  }
    46  ```
    47  
    48  ## Local Values
    49  
    50  TFLint supports [Local Values](https://developer.hashicorp.com/terraform/language/values/locals).
    51  
    52  ```hcl
    53  variable "foo" {
    54    default = "variable value"
    55  }
    56  
    57  locals {
    58    static   = "static value"
    59    variable = var.foo
    60    local    = local.static
    61    resource = aws_instance.main.arn
    62  }
    63  
    64  local.static   # => "static value"
    65  local.variable # => "variable value"
    66  local.local    # => "static value"
    67  local.resource # => ignored (unknown)
    68  ```
    69  
    70  ## The `count` and `for_each` Meta-Arguments
    71  
    72  TFLint supports the [`count`](https://developer.hashicorp.com/terraform/language/meta-arguments/count) and [`for_each`](https://developer.hashicorp.com/terraform/language/meta-arguments/for_each) meta-arguments.
    73  
    74  ```hcl
    75  resource "aws_instance" "foo" {
    76    count = 0
    77  
    78    instance_type = "invalid" # => ignored because ths resource is not created
    79  }
    80  ```
    81  
    82  ```hcl
    83  resource "aws_instance" "foo" {
    84    count = 2
    85  
    86    instance_type = "t${count.index}.micro" # => "t0.micro" and "t1.micro"
    87  }
    88  ```
    89  
    90  Note that this behavior may differ depending on a rule. Rules like `terraform_deprecated_syntax` will check resources regardless of the meta-argument values.
    91  
    92  If the meta-arguments are unknown, the resource/module is ignored:
    93  
    94  ```hcl
    95  variable "count" {}
    96  
    97  resource "aws_instance" "foo" {
    98    count = var.count
    99  
   100    instance_type = "invalid" # => ignored
   101  }
   102  ```
   103  
   104  ## The `path.*` and `terraform.workspace` Values
   105  
   106  TFLint supports [filesystem and workspace info](https://developer.hashicorp.com/terraform/language/expressions/references#filesystem-and-workspace-info).
   107  
   108  - `path.module`
   109  - `path.root`
   110  - `path.cwd`
   111  - `terraform.workspace`.
   112  
   113  ## Unsupported Named Values
   114  
   115  The values below are state-dependent and cannot be determined statically, so TFLint resolves them to unknown values.
   116  
   117  - `<RESOURCE TYPE>.<NAME>`
   118  - `module.<MODULE NAME>`
   119  - `data.<DATA TYPE>.<NAME>`
   120  - `self`
   121  
   122  ## Functions
   123  
   124  [Built-in Functions](https://developer.hashicorp.com/terraform/language/functions) are fully supported. However, functions such as [`plantimestamp`](https://developer.hashicorp.com/terraform/language/functions/plantimestamp) whose return value cannot be determined statically will return an unknown value.
   125  
   126  [Provider-defined functions](https://www.hashicorp.com/blog/terraform-1-8-adds-provider-functions-for-aws-google-cloud-and-kubernetes) always return unknown values, except for `provider::terraform::*` functions.
   127  
   128  ## Dynamic Blocks
   129  
   130  TFLint supports [dynamic blocks](https://developer.hashicorp.com/terraform/language/expressions/dynamic-blocks).
   131  
   132  ```hcl
   133  resource "aws_instance" "dynamic" {
   134    dynamic "ebs_block_device" {
   135      for_each = toset([
   136        { size = 10 },
   137        { size = 20 }
   138      ])
   139      content {
   140        volume_size = ebs_block_device.value["size"] # => 10 and 20
   141      }
   142    }
   143  }
   144  ```
   145  
   146  Similar to support for meta-arguments, some rules may process a dynamic block as-is without expansion. If the `for_each` is unknown, the block will be empty.
   147  
   148  ## Modules
   149  
   150  TFLint doesn't automatically inspect the content of modules themselves. However, by default, it will analyze their content in order to raise any issues that arise from attributes in module calls.
   151  
   152  ```hcl
   153  resource "aws_instance" "static" {
   154    ebs_block_device {
   155      encrypted = false # => Must be encrypted
   156    }
   157  }
   158  
   159  module "aws_instance" {
   160    source = "./module/aws_instance"
   161  
   162    encrypted = false # => Must be encrypted
   163  }
   164  ```
   165  
   166  Remote modules can also be inspected. See [Calling Modules](./calling-modules.md) for details.
   167  
   168  ## Environment Variables
   169  
   170  The following environment variables are supported:
   171  
   172  - [TF_VAR_name](https://developer.hashicorp.com/terraform/cli/config/environment-variables#tf_var_name)
   173  - [TF_DATA_DIR](https://developer.hashicorp.com/terraform/cli/config/environment-variables#tf_data_dir)
   174  - [TF_WORKSPACE](https://developer.hashicorp.com/terraform/cli/config/environment-variables#tf_workspace)