Merge pull request #35920 from hashicorp/jbardin/ephemeral-conditions

core: check preconditions and postconditions for ephemeral resources
hashicorp · Oct 29, 2024 · 9a90202 · 9a90202
2 parents 8144156 + 4f6a78f
commit 9a90202
Show file tree

Hide file tree

Showing 3 changed files with 64 additions and 0 deletions.
diff --git a/internal/checks/state_init.go b/internal/checks/state_init.go
@@ -33,6 +33,10 @@ func collectInitialStatuses(into addrs.Map[addrs.ConfigCheckable, *configCheckab
 		addr := rc.Addr().InModule(moduleAddr)
 		collectInitialStatusForResource(into, addr, rc)
 	}
+	for _, rc := range cfg.Module.EphemeralResources {
+		addr := rc.Addr().InModule(moduleAddr)
+		collectInitialStatusForResource(into, addr, rc)
+	}
 
 	for _, oc := range cfg.Module.Outputs {
 		addr := oc.Addr().InModule(moduleAddr)

diff --git a/internal/terraform/context_plan_ephemeral_test.go b/internal/terraform/context_plan_ephemeral_test.go
@@ -425,6 +425,54 @@ module "child" {
 				})
 			},
 		},
+		"resource precondition": {
+			module: map[string]string{
+				"main.tf": `
+locals {
+  test_value = 2
+}
+ephemeral "ephem_resource" "data" {
+  lifecycle {
+    precondition {
+      condition = local.test_value != 2
+	  error_message = "value should not be 2"
+    }
+  }
+}
+`,
+			},
+			expectPlanDiagnostics: func(m *configs.Config) (diags tfdiags.Diagnostics) {
+				return diags.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Resource precondition failed",
+					Detail:   "value should not be 2",
+				})
+			},
+		},
+		"resource postcondition": {
+			module: map[string]string{
+				"main.tf": `
+locals {
+  test_value = 2
+}
+ephemeral "ephem_resource" "data" {
+  lifecycle {
+    postcondition {
+      condition = self.value == "pass"
+	  error_message = "value should be \"pass\""
+    }
+  }
+}
+`,
+			},
+			expectPlanDiagnostics: func(m *configs.Config) (diags tfdiags.Diagnostics) {
+				return diags.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Resource postcondition failed",
+					Detail:   `value should be "pass"`,
+				})
+			},
+		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			if tc.toBeImplemented {

diff --git a/internal/terraform/node_resource_ephemeral.go b/internal/terraform/node_resource_ephemeral.go
@@ -132,6 +132,18 @@ func ephemeralResourceOpen(ctx EvalContext, inp ephemeralResourceInput) (*provid
 		Private:    resp.Private,
 	})
 
+	// Postconditions for ephemerals validate only what is returned by
+	// OpenEphemeralResource. These will block downstream dependency operations
+	// if an error is returned, but don't prevent renewal or closing of the
+	// resource.
+	checkDiags = evalCheckRules(
+		addrs.ResourcePostcondition,
+		config.Postconditions,
+		ctx, inp.addr, keyData,
+		tfdiags.Error,
+	)
+	diags = diags.Append(checkDiags)
+
 	return nil, diags
 }