Support for reading terraform backend configuration about terraform-config-inspect HOT 4 CLOSED

@yermulnik I was able to achieve it using an external policy rule (opa). Basically run a init, then validate .terraform/terraform.tfstate for presence of non-local backend. There may be a better way now but I haven't explored this recently

from terraform-config-inspect.

Hi @burck1!

The scope of this library is reading the parts of a Terraform module that are relevant when it's being used as a child module, such as when distributed via a module registry. We didn't intend for it to expose the parts that live in the root module only and apply to the whole configuration. We're intentionally keeping the scope of this codebase minimal because it's essentially a forked subset of Terraform's own decoder and so the more that is implemented over here the more likely it is that the two implementations will diverge over time as the language changes.

Our longer-term goal here has been to replace the existing terraform show command with something more general that can produce JSON representations of various Terraform constructs, including provider schemas, configurations, etc.

We already defined the JSON representation of a loaded configuration as part of existing terraform show -json functionality, but in order to retain compatibility with that command we were forced to live within its constraints of only supporting JSON rendering of the current state or of a saved plan for now.

As far as we recall, there isn't an existing issue in the main Terraform repository covering the idea of having Terraform itself produce a detailed summary of configuration, so if you'd like to open an issue about this use-case over there that'd be much appreciated, and then we can use that issue to work through the design of such a command.

A tricky part of your specific request is that you want to look at the backend configuration in particular, and that's not currently part of the defined JSON format in Terraform either. However, if you mention that in your new issue we can think about how best to include it... it may require a specialized mode for whatever command we eventually implement to say that you are only interested in the backend configuration, since otherwise the command would probably require you to have already run terraform init first and would thus defeat the point of pre-validating the backend configuration.

from terraform-config-inspect.

@teamterraform is there a way to validate if the terraform code is having a non local backend set? I understand we need to do a tf init to run a tf show but is it even possible to check what is the backend configured (as I need to disallow local backend in my pipeline)

from terraform-config-inspect.

@burck1 @sushant-pradhan Have you guys found a way to read TF backend config?

from terraform-config-inspect.