feature request: module source must point to git repository

[m00lecule]

Hello Guys!

After a while of using terraform I spotted a tendency to push/commit changes, that for testing purposes points to my local path instead of git repo. I believie this rule is missing and might be useful in TFLint, forcing that all sources must point to remote repository.

Following code would be evaluated as invalid:

module "my-module" {
  source = "/home/user/documents/directory"
}

Example of valid module:

module "my-module" {
  source = "git::ssh://git@github.com/user/repo.git"
}

Also property clone_protocol that check wheater source repo is cloned using https or ssh might be a valid feature

[bendrucker]

Requiring a Git repo for all module blocks seems to be more a "personal preference/tendency" than a "best practice." Modules with significant complexity or repetition may benefit from breaking functionality into child modules (./modules/*). They may, for example, want to call them with for_each or with different providers.

However, I do see a pattern in your example that I think we can discourage with high confidence: absolute paths. This comes directly from the Terraform Configuration Guide:

Use the values in this section carefully, because they include information about the context in which a configuration is being applied and so may inadvertently hurt the portability or composability of a module....

The module source docs don't acknowledge whether absolute paths are even supported:

A local path must begin with either ./ or ../ to indicate that a local path is intended, to distinguish from a module registry address.

It's reasonable to support them, particularly for generated config, but this is so rarely needed that I think we could enable this proposed rule by default. By default, modules should be portable, just like config.

Optionally, we could also allow users to forbid ancestor source paths, i.e. ../*. In a repo with a single root module, this is comparable to an absolute path. But in a monorepo with many root modules and some reused child modules, many/most of your source attributes will be ancestor paths.

I do plan on doing some work on module rules soon, terraform-linters/tflint#1176, possibly renaming source rules to module_source_* for consistency. Leaving this partially to get you a response but also as notes for me to come back to.

[m00lecule]

@bendrucker - I agree, verification if source path is not absolute is enough. There might be cases, when we would like to keep submodules - to gather related resources. If this feature (absolute path verification) is implemented please close this issue.

[abuxton]

it would be useful instead of pinning to a just git based repo if you could variable-ize the URL?
working with TF you run into situations where you want to ensure the module source

• on prem git/tfe or if it is sourcing externally
• confined to TFC PMRs https://app.terraform.io/orgname
• using tfe and confined to generic hostname localterraform.com terraform

i wanted to suggest this before I attempted to create a new rule just for validating the uri based on a configurable variable.