TFLint fails on parsing bare attributes in ignore_changes

[wesco-tomwinsnes]

Summary

When writing rules around ignore_changes terraform allows you to have bare attributes in the array
e.g.

resource "azurerm_linux_web_app_slot" "test" {
  name = "test"
  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

If you build a rule that requires certain changes to be ignore, e.g. hidden tags for azure web app slots (terraform-linters/tflint-ruleset-azurerm#430). TFLint will fail with a parsing error.

Failed to check ruleset; failed to check "azurerm_app_service_app_insights_hidden_link" rule: main.tf:5,7-11: Invalid reference; A reference to a resource type must be followed by at least one attribute access, specifying the resource name.

If you wrap the attributes in ignore_changes in double quotes, it parses as expected.

The root cause is that TFLint is currently interpreting those list elements using its general HCL expression evaluator, which treats a bare identifier like tags as a normal expression (a variable/traversal) that must resolve in scope. Since there’s no variable or symbol named tags, the evaluator reports an error.

Command

tflint

Terraform Configuration

resource "azurerm_linux_web_app_slot" "test" {
  name = "test"
  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

TFLint Configuration

plugin "terraform" {
  enabled = true
}

plugin "azurerm" {
  enabled = true
}

Output

Failed to check ruleset; failed to check "azurerm_app_service_app_insights_hidden_link" rule: main.tf:5,7-11: Invalid reference; A reference to a resource type must be followed by at least one attribute access, specifying the resource name.

TFLint Version

0.60.0

Terraform Version

No response

Operating System

• Linux
• macOS
• Windows

[github-actions]

⚠️ The provided Terraform configuration is not valid. Please ensure that your Terraform configuration and issue is directly reproducible. We are unable to review issues with partial reproductions, including omitted configuration or references to other files.

terraform init
terraform validate

Terraform validate failed:

Error: Missing required argument

  on main.tf line 1, in resource "azurerm_linux_web_app_slot" "test":
   1: resource "azurerm_linux_web_app_slot" "test" {

The argument "app_service_id" is required, but no definition was found.

Error: Insufficient site_config blocks

  on main.tf line 1, in resource "azurerm_linux_web_app_slot" "test":
   1: resource "azurerm_linux_web_app_slot" "test" {

At least 1 "site_config" blocks are required.

_{In the rare case that an invalid module or multiple files is part of the issue, you can indicate that this is expected with a 👍 on this comment}

[wata727]

After further investigation, I realized that ExpandModeNone is effective in this use case.

runner.GetResourceContent("azurerm_linux_web_app_slot", &hclext.BodySchema{...}, &tflint.GetModuleContentOption{
	ExpandMode: tflint.ExpandModeNone,
})

See also #2436
https://pkg.go.dev/github.com/terraform-linters/tflint-plugin-sdk@v0.23.1/tflint#ExpandMode