Modules Folder Incorrectly Enforcing Provider/Version Constraints

[Sohan-Opstree]

Summary

I’m using Terraform with a directory structure where my modules are contained in a separate modules folder, which serves as the root module for other configurations. I have a wrapper code setup where the provider and version constraints are defined separately from the module configurations.

However, I am encountering an issue where the provider and version constraints defined in the wrapper code appear to be enforced on the modules as well, even though I have not specified any constraints within the modules themselves.

I have attempted to use annotations to ignore these constraints, but it did not resolve the issue.

I'm currently making use of pre-commit hook to ignore the folder but doesn't seems to best practice is their any other way to do this using tflint pre-commit hook

      - id: terraform_tflint
        args:
          - --args=--fix

Output:

TFLint in tofu/aws/modules/nat-gateway/:
2 issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
  on main.tf line 1:
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
  on main.tf line 8:
   8: resource "aws_nat_gateway" "nat-gw" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
TFLint in tofu/aws/modules/nacl/:
1 issue(s) found:
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
  on main.tf line 28:
  28: resource "aws_network_acl_rule" "network_acl_ingress_rule" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
TFLint in tofu/aws/modules/security_group/:
2 issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
  on main.tf line 1:
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
  on main.tf line 39:
  39: resource "aws_security_group_rule" "sg_egress_with_cidr" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md

Command

tflint

Terraform Configuration

main.tf

resource "aws_route_table" "route_table" {
  vpc_id = var.vpc_id
  route {
    cidr_block = var.cidr_block
    gateway_id = var.gateway_id
  }
  tags = merge(
    {
      "Name" = var.name
    },
    var.tags,
  )
}

variable.tf

variable "vpc_id" {
  description = "VPC ID in which Route table needs to be created"
  type        = string
}

variable "name" {
  description = "Name of Route Table To be created"
  type        = string
}

variable "tags" {
  description = "A map of tags to add to all resources"
  type        = map(string)
  default     = {}
}

variable "cidr_block" {
  description = "Cidr block for route"
  type        = string
}

variable "gateway_id" {
  description = "Internet gateway id"
  type        = string
}

wrapper/route.tf

module "publicRouteTable" {
  source     = "../../../aws/modules/route-table"
  vpc_id     = module.vpc.vpc_id
  cidr_block = "0.0.0.0/0"
  gateway_id = module.vpc.igw_id
  name       = format("%s-pub-rt", var.name)
  tags               = var.tags
}

### TFLint Configuration

```HCL
{}

Output

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
Warning: terraform "required_version" attribute is required (terraform_required_version)
Warning: terraform "required_version" attribute is required (terraform_required_version)
  on main.tf line 1:
  on providers.tf line 1:
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_version.md
   1: terraform {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_version.md
TFLint in tofu/aws/modules/nat-gateway/:
2 issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
  on main.tf line 1:
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
  on main.tf line 8:
   8: resource "aws_nat_gateway" "nat-gw" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
TFLint in tofu/aws/modules/nacl/:
1 issue(s) found:
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
  on main.tf line 28:
  28: resource "aws_network_acl_rule" "network_acl_ingress_rule" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
TFLint in tofu/aws/modules/security_group/:
2 issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
  on main.tf line 1:
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
  on main.tf line 39:
  39: resource "aws_security_group_rule" "sg_egress_with_cidr" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
TFLint in tofu/aws/modules/vpc/:
2 issue(s) found:
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
  on main.tf line 32:
  32: resource "aws_internet_gateway" "igw" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
Warning: terraform "required_version" attribute is required (terraform_required_version)
  on providers.tf line 1:
   1: terraform {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_version.md
TFLint in tofu/aws/modules/ec2/:
1 issue(s) found:
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
  on main.tf line 1:
   1: resource "aws_instance" "ec2" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_providers.md
TFLint in tofu/example/modules/vpc/:
2 issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
  on main.tf line 1:
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_required_version.md
Warning: [Fixed] variable "aws_region" is declared but not used (terraform_unused_declarations)
  on variables.tf line 6:
   6: variable "aws_region" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.8.0/docs/rules/terraform_unused_declarations.md
Terraform validate with trivy............................................Passed

TFLint Version

v1.94.1

Terraform Version

v1.9.5

Operating System

• Linux
• macOS
• Windows

[bendrucker]

If you run TFLint on these modules, they are still subject to those requirements. The rules skip child modules:

tflint-ruleset-terraform/rules/terraform_required_version.go

Lines 48 to 51 in 9dcbac6

	if !path.IsRoot() {
	// This rule does not evaluate child modules.
	return nil
	}

I'm guessing your pre-commit hook is recursing. If TFLint were loading these via the module block versus your caller visiting each directory individually, you shouldn't see those issues get emitted.