Not able to lint the main modules if i call lint from source/application/calling module.

[shashigupta-wk]

Hello ,
Can you please help me identifying the issue or identifying if its feasible or not.

My project structure (see referenced example repository!)

Repo-Module
├─── Module1
│ └─── module1.tf
│ └─── variblae1.tf
├─── Module2
│ └─── module2.tf
│ └─── variblae2.tf

Repo-Application:
├─── App1
│ └─── App1.tf - This app calls the module1 as source with actual variable present in variable1.tfvars
│ └─── variable1.tfvars
│ └─── .tflint.hcl
├─── App2
│ └─── App2.tf - This app calls the module2 as source with actual variable present in variable2.tfvars
│ └─── variable2.tfvars
│ └─── .tflint.hcl

If i am doing tflint in App1 folder in "Repo-Application" with --var-file="./varibale1.tfvars" option its only validating current folder tf files not the tf file present in "Repo-Module" . I believe its not calling recursively to modules being called as a source in app1.tf or app2.tf file.

Can you please help on providing insight on how can we implement it to call and validate modules present in another directory.

[bendrucker]

It's very hard to follow your question given the lack of proper formatting. Please make use of code fences and syntax highlighting if you want us to be able to discuss further.

The module call docs should describe all of the behavior here:

https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/calling-modules.md

See Caveats for common misunderstandings.

[shashigupta-wk]

Thank you @bendrucker for your response. To make it simple

My folder hierarchy is

C:.
├───application1
│   │   .tflint.hcl
│   │   linux_vm.tf
│   │   variables.tf
│   │
│   └───vars
│           abc.tfvars
│
└───modules
        variables.tf
        vm.tf

Content of each file mentioned below:
/application1/tflint.hcl :

plugin "azurerm" {
    enabled = true
    version = "0.28.0"
    source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
}

plugin "terraform" {
  enabled = true
  preset  = "all"
}

config {
  call_module_type = "all"
  plugin_dir = "~/.tflint.d/plugins"
}

application1/linux_vm.tf:

module "vmcreate" {
  source = "../modules"
  size   = var.size

}

application1/variables.tf:

variable "size" {
  type    = set(string)
  default = []

}

application1/vars/abc.tfvars

size = ["xx","yy"]

modules/variables.tf

variable "size" {
  type = set(string) 
}

modules/vm.tf

resource "azurerm_linux_virtual_machine" "example" {
  for_each            = var.size
  name                = "example-machine"
  resource_group_name = "example-resources"
  location            = "West Europe"
  size                = each.value
  admin_username      = "adminuser"
  network_interface_ids = [
    "xx.xxxxxxxxxx",
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

 source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts"
    version   = "latest"
  }
}

so if i run tflint inside appliction1 i.e

cd application1
tflint  --var-file=./var/abc.tfvars

After execution of above command its checking only in application1 folder not modules.
Output shown below:

$ tflint  --var-file=./var/abc.tfvars
3 issue(s) found:

Warning: Module should include a main.tf file as the primary entrypoint (terraform_standard_module_structure)

  on main.tf line 1:
   (source code not available)

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.11.0/docs/rules/terraform_standard_module_structure.md

Warning: Module should include an empty outputs.tf file (terraform_standard_module_structure)

  on outputs.tf line 1:
   (source code not available)

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.11.0/docs/rules/terraform_standard_module_structure.md

Warning: terraform "required_version" attribute is required (terraform_required_version)

  on provider.tf line 1:
   1: terraform {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.11.0/docs/rules/terraform_required_version.md

[bendrucker]

Read the docs I linked, this is by design. There are no special exceptions for modules whose source is a child directory (versus a registry, git, or any other source type).

There are certain lint rules designed to check module calls and whether they'd cause the module to produce invalid resources given the input.

If you want to check your own modules themselves, there is no magic discovery, you have to run TFLint on them. Optionally using --recursive if you'd like.

[shashigupta-wk]

Hi @bendrucker ,

Thank you for your insight but i read through the docs and its quite confusing with the term "You can inspect not only the root module but also [module calls](https://developer.hashicorp.com/terraform/language/modules/syntax#calling-a-child-module). TFLint evaluates each call (i.e. module block) and emits any issues that result from the specified input variables."

application1/linux_vm.tf has source defined and its calling module ../modules/vm.tf . If the variable parameters i am passing doesn't get validated with ../modules/vm.tf , what does the module calls mean? Technically its not calling module at runtime but validating each and every file that's present inside the current directory where i am executing tflint with --recursive option providing --var-file option . So i am struggling to understand - what does "module call" mean?

Thank You in advance for helping me understand it.

[bendrucker]

TFLint makes use of official terminology so check the Terraform glossary for terms of art.

https://developer.hashicorp.com/terraform/docs/glossary#module

I'm going to have to bow out here as we're going in circles.

What if TFLint emitted an issue about a third party module you sourced complaining that it doesn't follow standard structure? Checking Terraform language conventions against a module call is noise. Module calls are dependencies, you don't lint your dependencies for style. TFLint does try to detect if you're "calling it wrong" and providing an input that would produce an invalid resource.

If you want to check the modules themselves regardless of variables, use recursive mode to run in them.