Warn against using resource attributes within a set() in for_each loops

[Stretch96]

Introduction

Resources can be created with for_each using a set() or map()

A resource created with for_each with a set() uses the value
A resource created with for_each with a map() uses the key

If we have resources, and attempt to use the resulting attributes witihin a for_each, it will result in an error if the resource has not yet been created

This issue goes unnotticed if a module is within development, and hasn't been tested on an empty workspace

Example:

"resource" "thing1" {
  name = "example1"
}

"resource" "thing2" {
  name = "example2"
}

locals {
  things = [
    resource.thing1.id,
    resource.thing2.id,
  ]
}

"resource" "thingAssociation" {
  for_each = local.things

  thing_id = each.value
}

The above would work, if resource.thingAssociation was added after resource.thing1 and resource.thing2 were craeted

However, it can't be deployed on a new workspace, because the for_each uses the value of the set() to determine the new reference/id that will be stored in the Terraform State

So we get the error:

The "for_each" set includes values derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource.
When working with unknown values in for_each, it's better to use a map value where the keys are defined statically in your configuration and

But, if a map() is used, eg:

Example:

"resource" "thing1" {
  name = "example1"
}

"resource" "thing2" {
  name = "example2"
}

locals {
  things = {
    "thing1" = resource.thing1.id,
    "thing2" = resource.thing2.id,
  ]
}

"resource" "thingAssociation" {
  for_each = local.things

  thing_id = each.value
}

It will now use the key for the determine the new reference/id that will be stored in the Terraform State - which is static

Proposal

Warn against the use of resource attributes within for_each, unless they are used as a map("thing" = *.id) rather than set[*.id]

[bendrucker]

This proposal is very hard to follow because of invalid syntax in the examples. An ideal example is minimal and runnable. That means no indirection through locals and using a real provider like null to illustrate your intent.

That said, no plans to implement anything like this, but converting to a discussion for any future comments.

TFLint can only enforce things that can be determined statically. The issue here arises when id is unknown. Since id (currently) has special properties/handling, it's theoretically safe to assume that it will sometimes be unknown, for any resource, in any provider. This cannot be generalized for any other attributes. In other words, if you don't actually test your modules by applying them, it is impossible to detect this condition in the general case.

Separately, this ruleset is focused on automating guidance from the Terraform documentation, and not trying to detect potential footguns.