Add rule to detect 'Invalid validation error message'

[jaredbrogan]

Currently, there doesn't appear to be a rule to detect variables that contain a validation block with an error_message value that doesn't follow proper grammar.

This is an example of the error seen:

[bendrucker]

TFLint does not attempt to reproduce terraform validate, which seems like it should have caught this. Your described behavior is not reproducible, presumably you're using an outdated version of Terraform:

hashicorp/terraform#24214 (comment)

This would be a valid case for a rule though:

https://developer.hashicorp.com/terraform/language/expressions/custom-conditions#error-messages

We recommend writing error messages as one or more full sentences in a style similar to Terraform's own error messages.

Which meets the criteria:

https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/README.md

[jaredbrogan]

You make a valid (pun intended) point for using terraform validate. My team's premerge pipeline that executes tflint doesn't currently include that as an additional check, but that will now be changed. Nonetheless, as you said it does seem worthwhile to make a new tflint rule to better account for it. 🙂

[bendrucker]

Yeah, back when this was an error, validate would catch it and so we could skip the rule. Not enforcing that is the right move on Terraform's part, which then leaves room for TFLint to provide optional enforcement for the optional recommendation.

I have a bug I want to tackle around variable validation soon:

#94

I can probably find time to write this rule when I'm working on that. If not, PR welcome.

[bendrucker]

In general, validate before TFLint is a good idea because it will often give you better errors. E.g., if you accidentally set tag = {} with the AWS provider instead of tags = {}, validate will give you a "did you mean" hint. A TFLint rule that expects to find tags will just say "no tags here" which can be confusing. Validating the structure first avoids potentially cryptic output from TFLint.