[Incorrect sensitive check] - Failed to check `azurerm_linux_virtual_machine_invalid_size` rule: Invalid function argumen t; Invalid value for "value" parameter: the given value is not sensitive, so this call is redundant #1640

lonegunmanb · 2023-01-04T02:43:21Z

lonegunmanb
Jan 4, 2023

With the following main.tf file:

variable "nb_instances" {
  type        = number
  description = "count"
  default     = 1
  nullable    = false
}

variable "vm_extensions" {
  type        = map(object({
    publisher                         = string
    type                              = string
    type_handler_version              = string
    auto_upgrade_minor_version        = optional(bool)
    automatic_upgrade_enabled         = optional(bool)
    failure_suppression_enabled       = optional(bool, false)
    settings                          = optional(string)
    protected_settings                = optional(string)
    protected_settings_from_key_vault = optional(object({
      secret_url      = string
      source_vault_id = string
    }))
  }))
  description = "Argument to create `azurerm_virtual_machine_extension` resource, the argument descriptions could be found at [the document](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine_extension). Map key is extension's `name` argument."
  default   = null
  sensitive = true # Because `protected_settings` is sensitive
  validation {
    condition = length(var.vm_extensions) == length(distinct([
      for k, e in var.vm_extensions :"${e.publisher}-${e.type}"
    ]))
    error_message = "`type` in `vm_extensions` must be unique."
  }
}

locals {
  non_null_extensions = var.vm_extensions == null ? {} : var.vm_extensions
  vm_extensions       = {
    for k in setproduct(toset(keys(local.non_null_extensions)), toset(range(var.nb_instances))) :"${k[0]}-${k[1]}" =>
    { index = k[1], name = k[0], value = local.non_null_extensions[k[0]] }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

resource "azurerm_resource_group" "example" {
  name     = "zjhe-sensitive"
  location = "West Europe"
}

resource "azurerm_virtual_network" "example" {
  name                = "example-network"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_subnet" "example" {
  name                 = "internal"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.2.0/24"]
}

resource "azurerm_network_interface" "example" {
  name                = "example-nic"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.example.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "random_password" "pass" {
  length = 20
}

resource "azurerm_linux_virtual_machine" "example" {
  count = var.nb_instances

  name                            = "linux-${count.index}"
  resource_group_name             = azurerm_resource_group.example.name
  location                        = azurerm_resource_group.example.location
  size                            = "Standard_F2"
  admin_username                  = "adminuser"
  admin_password                  = random_password.pass.result
  disable_password_authentication = false
  network_interface_ids           = [
    azurerm_network_interface.example.id,
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "UbuntuServer"
    sku       = "16.04-LTS"
    version   = "latest"
  }
}

resource "azurerm_virtual_machine_extension" "extensions" {
  for_each = nonsensitive(local.vm_extensions)

  name                        = each.value.name
  publisher                   = each.value.value.publisher
  type                        = each.value.value.type
  type_handler_version        = each.value.value.type_handler_version
  virtual_machine_id          = azurerm_linux_virtual_machine.example[each.value.index].id
  auto_upgrade_minor_version  = each.value.value.auto_upgrade_minor_version
  automatic_upgrade_enabled   = each.value.value.automatic_upgrade_enabled
  failure_suppression_enabled = each.value.value.failure_suppression_enabled
  protected_settings          = each.value.value.protected_settings
  settings                    = each.value.value.settings
  tags                        = {
    "env" : "test"
  }

  dynamic "protected_settings_from_key_vault" {
    for_each = each.value.value.protected_settings_from_key_vault == null ? [] : ["protected_settings_from_key_vault"]

    content {
      secret_url      = each.value.value.protected_settings_from_key_vault.secret_url
      source_vault_id = each.value.value.protected_settings_from_key_vault.source_vault_id
    }
  }
}

Then run tflint:

tflint --config=.tflint.hcl main.tf

The content of .tflint.hcl:

/*
THIS FILE IS GENERATED BY TFMOD-SCAFFOLD, PLEASE DO NOT MODIFY IT.
IF YOU WANT TO USE A CUSTOMIZED CONFIGURATION, PLEASE CREATE YOUR OWN AND
SET THIS FILE'S PATH TO $TFLINT_CONFIG ENVVIRONMENT VARIABLE.
*/

plugin "azurerm" {
  enabled = true
  version = "0.20.0"
  source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
}

plugin "basic-ext" {
  enabled     = true
  version     = "0.3.1"
  source      = "github.com/Azure/tflint-ruleset-basic-ext"
  signing_key = <<-KEY
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGNjIIoBEACni6mzvCfY14cicqnW+BjFCoTUM95nxUINDFEQ7wkxGWmufAvQ
iEUDrv6iVNCEfk1cU2jGSWUlBu6hTZ9auOy8K2MrMhtdqYVx+mY1SS+fVYHzSQAC
C3qBTBY+TmDHl0QMQjF884AsYE2WTcZI3e1DOXXkVKlOMERzT7IQMVbeuiVklwLj
BA/sQISaZVesaWPWN8WtRb8iOrq4i5HHqnAWRZGtqMEsoNBWqzjqh1aoQ7Ex3ldH
2Ey1bEIi05PWr67k1QOU9pXhMNuC+NXCQDO1sEq/NG376v2GbgylVapUlWAq35tw
Ut8SFfiDM+GyHN1nNNjBKhOB7774yqh6FrPIfh/2WvN1EhAbPkr9eWfHROyIPWj1
t+IBFlMFbvMHLeMrlSZAkqlLljEZHdfzBfEXGUYKOOz/aeR+XjeMxGX977VoMk/0
uzLQPoVMqjOrAY4Iq+XhW6w4aBihDqkot3TDH6Cyczl+N9We0QatWd5jAG+BTb22
7AevzSlDKh/+oUAec6iG/WF4MjJB3c1Fdpkw4rtTjha6zKrFHNvpDzuyvJEnO9Pt
eBRAWaQvkqfMccQMYsasHWYkZKH2U8RAsqgW8iF9aRktBdGPao+ztkblbj/c7dUz
L4J28SmivzDJAzoAANjiC2R6xLBOb6b+TyafFmgevepwgN1QG5bPY3MptwARAQAB
tB9oZXppamllIDxoZXppamllQG1pY3Jvc29mdC5jb20+iQJOBBMBCgA4FiEEE0LC
37JNq10/9GosWbcR7NOMOjwFAmNjIIoCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgEC
F4AACgkQWbcR7NOMOjxtdQ//TUh2/GmF+4TF2qLgRgHKaH8pL8cUaCgYdUNlrK7B
8OXBKIxrnNs8FXUSsgyKHMjAdg0EdSgJt+w9nOgZEtLPTOE+e3RKgmmsMc9vn/qq
qoOw8B6NxRIJsGp8YbemoDUnmrUK93TSRxINBup4y413ZoON7g8O7I8kQBz4Ra6E
6U+Yx5rstFeS5D5jzWYeoh9Y6g9zucEDe3qnS8LcPmhj95mrm7A4uNwMDmny/J7B
I3sVILAybp8D8/PSSixjGsCr+81marKlkHxqaSL8dpR2tr2Z1lcm2gS4z81NXlx4
vh79cvpX8hedysssl8FpV3SzxYFlgWNP97vM9AAv00fBOR4lid3ZNoRCQdfw7LeT
GrglCWmMZ3Pm8JClYTbcsQ5wg5JgPFU9Rht+QN/EoNfJ5RipYYYwE9AOSJ6eJxHB
QH9pM1b+dZ6dYLqReeGUlZ0pYBoLC+LpqknxlPQzUuPl5VbbL2TsFIVy5n963gAk
5vEnRJgUFx+agI6ZPw+SnXRjwgqvuasgE8Z6wwbXWnSZf1kbJr4sv5alN/u1Uyph
CYl3uuHJkm0D/YfH4b83Bq7saTXWmJib7AR4piB8Z81vpO+Nq3zcvX1Z3r0AlF4j
t0KDU/cix305ldEITT7EJAxkxI71XCTgdt78h/e2N1gLatsv8I98ShK/U6Jxb0kx
pLC5Ag0EY2MgigEQAJJgnoe58UiuSFJIxPY6g4djYrWm7R9gw8oCdWJhjT9ou+bD
HYIY0RaaXuUsBaA/logdO87MeiIyPirypPhpSHN1c6CXBfLyspO606su8AKS+DK3
lTzExtU8c5lwP0KnDDugs/qbjpntrXCCUmxTF2RDMFbkbaAt9vl671+kggXvOfe/
iJFXjWXfBx/nKeMkHmXo6qpizurqe0CYdlOW2w7UXjeX8snuOz7kFK3PhEHJ8CKA
UEwqQaEp8v5zbAWGzRzPbY3Djw1RHw/WT6gEZWPQYK0HP6VdwIVJhpp8RKUe3QHJ
cG/hUJrEdbLOZrBe5NZCP5RStJ3XL4aAVS0nu/18nB1vf7pYq6VaywEM9n5PuLWr
mdtvUMTaDLjLM9H24qU8wHbiy+3jMGIUz5sKKIkBN8VxGacHo7Aadk7npGwiLpPD
VV0L5eapSCgf1Nja7ZDnzgzlcztg7eBV7r+tRBsgtWiFlDu00NZCowGfxeaWc7TZ
08JweBe4VDpUZZLiA/J2ET0/qAfDtTLtLbMrcgFuIZi0f05FG0qtW5SuVVuYGfdE
F7rUYFC5F39GxiDElR9F4XQcfhhtzAwVe9cYquPEkFBovzwhcVyJ3sfvupbk2nTN
koBjcs0n5C1b3YiaYeGM06hAXD0OTnl0Pbx1qMXTNs3DLCUoraU6tAwSvU4LABEB
AAGJAjYEGAEKACAWIQQTQsLfsk2rXT/0aixZtxHs04w6PAUCY2MgigIbDAAKCRBZ
txHs04w6POmfD/9GJ5sxWnwv8wzU46K4pK/Ie6AVCVIPgtqGIvifHwz4VM9VGIyb
oFTlRjow+i1z/8hb3tqdaJZvHkAv6jTPX6N3UiZ9l81LOqBJsx+vBHOSKAIRlgqX
jZ97N5y2H62BmBLqJxqA+C/8JhgrTiNB6pNAwet2mBgXCt2GDgy9UVgJ0Y/wJ2lk
E5LZOilxqd7P+qCruaCPyjyNkMTU9b3C2qR46Ip1GWc//UWwmLKCYsF+eVUst9Mk
O4QVJTj1B51mCXgrhg0ei8lNzXHw79W2MpEG6+HRUzyJqGylxh8B4BKwvGEr6PkC
QN8QE7kGhxLNXPNjAyM15lWOckR0nPkwV5zV+gpw+R5grOgnBcMIhoMkUKiFqnbd
km5bxwF00OL/QqocAvOUY44G1WtsigAeNu3OM3ki1j6VVAOlwljQ8OSdLuVM3vsU
Q2i0lo99PuDaAjTxCFPx7+/TsL5vL21zGvVpkWvXsfVLFvjo2bTs5Yc78MGF4IZN
o4QUqU7MGkjT7r8rFSPwFkAny0vUkp5iAKKaQFSvi5j1SNExtSeWk+cfjHwrH9l5
U6WDcghw5dibCpCUg5Eh0pbVe/Wdql3Y63Urk35fFAtGGpHozoVpoWFg6+n5HVlo
1DSrn+zuuxMp02sV+9MfqnT8Gq3fbU1mlTmqALKWa71w1dAv/M1kdjgA5w==
=nfI3
-----END PGP PUBLIC KEY BLOCK-----
    KEY
}

plugin "azurerm-ext" {
  enabled     = true
  version     = "0.2.0"
  source      = "github.com/Azure/tflint-ruleset-azurerm-ext"
  signing_key = <<-KEY
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGNjIIoBEACni6mzvCfY14cicqnW+BjFCoTUM95nxUINDFEQ7wkxGWmufAvQ
iEUDrv6iVNCEfk1cU2jGSWUlBu6hTZ9auOy8K2MrMhtdqYVx+mY1SS+fVYHzSQAC
C3qBTBY+TmDHl0QMQjF884AsYE2WTcZI3e1DOXXkVKlOMERzT7IQMVbeuiVklwLj
BA/sQISaZVesaWPWN8WtRb8iOrq4i5HHqnAWRZGtqMEsoNBWqzjqh1aoQ7Ex3ldH
2Ey1bEIi05PWr67k1QOU9pXhMNuC+NXCQDO1sEq/NG376v2GbgylVapUlWAq35tw
Ut8SFfiDM+GyHN1nNNjBKhOB7774yqh6FrPIfh/2WvN1EhAbPkr9eWfHROyIPWj1
t+IBFlMFbvMHLeMrlSZAkqlLljEZHdfzBfEXGUYKOOz/aeR+XjeMxGX977VoMk/0
uzLQPoVMqjOrAY4Iq+XhW6w4aBihDqkot3TDH6Cyczl+N9We0QatWd5jAG+BTb22
7AevzSlDKh/+oUAec6iG/WF4MjJB3c1Fdpkw4rtTjha6zKrFHNvpDzuyvJEnO9Pt
eBRAWaQvkqfMccQMYsasHWYkZKH2U8RAsqgW8iF9aRktBdGPao+ztkblbj/c7dUz
L4J28SmivzDJAzoAANjiC2R6xLBOb6b+TyafFmgevepwgN1QG5bPY3MptwARAQAB
tB9oZXppamllIDxoZXppamllQG1pY3Jvc29mdC5jb20+iQJOBBMBCgA4FiEEE0LC
37JNq10/9GosWbcR7NOMOjwFAmNjIIoCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgEC
F4AACgkQWbcR7NOMOjxtdQ//TUh2/GmF+4TF2qLgRgHKaH8pL8cUaCgYdUNlrK7B
8OXBKIxrnNs8FXUSsgyKHMjAdg0EdSgJt+w9nOgZEtLPTOE+e3RKgmmsMc9vn/qq
qoOw8B6NxRIJsGp8YbemoDUnmrUK93TSRxINBup4y413ZoON7g8O7I8kQBz4Ra6E
6U+Yx5rstFeS5D5jzWYeoh9Y6g9zucEDe3qnS8LcPmhj95mrm7A4uNwMDmny/J7B
I3sVILAybp8D8/PSSixjGsCr+81marKlkHxqaSL8dpR2tr2Z1lcm2gS4z81NXlx4
vh79cvpX8hedysssl8FpV3SzxYFlgWNP97vM9AAv00fBOR4lid3ZNoRCQdfw7LeT
GrglCWmMZ3Pm8JClYTbcsQ5wg5JgPFU9Rht+QN/EoNfJ5RipYYYwE9AOSJ6eJxHB
QH9pM1b+dZ6dYLqReeGUlZ0pYBoLC+LpqknxlPQzUuPl5VbbL2TsFIVy5n963gAk
5vEnRJgUFx+agI6ZPw+SnXRjwgqvuasgE8Z6wwbXWnSZf1kbJr4sv5alN/u1Uyph
CYl3uuHJkm0D/YfH4b83Bq7saTXWmJib7AR4piB8Z81vpO+Nq3zcvX1Z3r0AlF4j
t0KDU/cix305ldEITT7EJAxkxI71XCTgdt78h/e2N1gLatsv8I98ShK/U6Jxb0kx
pLC5Ag0EY2MgigEQAJJgnoe58UiuSFJIxPY6g4djYrWm7R9gw8oCdWJhjT9ou+bD
HYIY0RaaXuUsBaA/logdO87MeiIyPirypPhpSHN1c6CXBfLyspO606su8AKS+DK3
lTzExtU8c5lwP0KnDDugs/qbjpntrXCCUmxTF2RDMFbkbaAt9vl671+kggXvOfe/
iJFXjWXfBx/nKeMkHmXo6qpizurqe0CYdlOW2w7UXjeX8snuOz7kFK3PhEHJ8CKA
UEwqQaEp8v5zbAWGzRzPbY3Djw1RHw/WT6gEZWPQYK0HP6VdwIVJhpp8RKUe3QHJ
cG/hUJrEdbLOZrBe5NZCP5RStJ3XL4aAVS0nu/18nB1vf7pYq6VaywEM9n5PuLWr
mdtvUMTaDLjLM9H24qU8wHbiy+3jMGIUz5sKKIkBN8VxGacHo7Aadk7npGwiLpPD
VV0L5eapSCgf1Nja7ZDnzgzlcztg7eBV7r+tRBsgtWiFlDu00NZCowGfxeaWc7TZ
08JweBe4VDpUZZLiA/J2ET0/qAfDtTLtLbMrcgFuIZi0f05FG0qtW5SuVVuYGfdE
F7rUYFC5F39GxiDElR9F4XQcfhhtzAwVe9cYquPEkFBovzwhcVyJ3sfvupbk2nTN
koBjcs0n5C1b3YiaYeGM06hAXD0OTnl0Pbx1qMXTNs3DLCUoraU6tAwSvU4LABEB
AAGJAjYEGAEKACAWIQQTQsLfsk2rXT/0aixZtxHs04w6PAUCY2MgigIbDAAKCRBZ
txHs04w6POmfD/9GJ5sxWnwv8wzU46K4pK/Ie6AVCVIPgtqGIvifHwz4VM9VGIyb
oFTlRjow+i1z/8hb3tqdaJZvHkAv6jTPX6N3UiZ9l81LOqBJsx+vBHOSKAIRlgqX
jZ97N5y2H62BmBLqJxqA+C/8JhgrTiNB6pNAwet2mBgXCt2GDgy9UVgJ0Y/wJ2lk
E5LZOilxqd7P+qCruaCPyjyNkMTU9b3C2qR46Ip1GWc//UWwmLKCYsF+eVUst9Mk
O4QVJTj1B51mCXgrhg0ei8lNzXHw79W2MpEG6+HRUzyJqGylxh8B4BKwvGEr6PkC
QN8QE7kGhxLNXPNjAyM15lWOckR0nPkwV5zV+gpw+R5grOgnBcMIhoMkUKiFqnbd
km5bxwF00OL/QqocAvOUY44G1WtsigAeNu3OM3ki1j6VVAOlwljQ8OSdLuVM3vsU
Q2i0lo99PuDaAjTxCFPx7+/TsL5vL21zGvVpkWvXsfVLFvjo2bTs5Yc78MGF4IZN
o4QUqU7MGkjT7r8rFSPwFkAny0vUkp5iAKKaQFSvi5j1SNExtSeWk+cfjHwrH9l5
U6WDcghw5dibCpCUg5Eh0pbVe/Wdql3Y63Urk35fFAtGGpHozoVpoWFg6+n5HVlo
1DSrn+zuuxMp02sV+9MfqnT8Gq3fbU1mlTmqALKWa71w1dAv/M1kdjgA5w==
=nfI3
-----END PGP PUBLIC KEY BLOCK-----
    KEY
}

rule "terraform_comment_syntax" {
  enabled = true
}

rule "terraform_deprecated_index" {
  enabled = true
}

rule "terraform_deprecated_interpolation" {
  enabled = true
}

rule "terraform_documented_outputs" {
  enabled = true
}

rule "terraform_documented_variables" {
  enabled = true
}

rule "terraform_empty_list_equality" {
  enabled = true
}

rule "terraform_module_pinned_source" {
  enabled = true
}

rule "terraform_module_version" {
  enabled = true
}

rule "terraform_naming_convention" {
  enabled = true
}

rule "terraform_required_providers" {
  enabled = true
}

rule "terraform_required_version" {
  enabled = true
}

rule "terraform_standard_module_structure" {
  enabled = true
}

rule "terraform_typed_variables" {
  enabled = true
}

rule "terraform_unused_declarations" {
  enabled = true
}

rule "terraform_unused_required_providers" {
  enabled = true
}

rule "terraform_workspace_remote" {
  enabled = true
}

rule "terraform_locals_order" {
  enabled = true
}

rule "terraform_output_order" {
  enabled = true
}

rule "terraform_output_separate" {
  enabled = true
}

rule "terraform_variable_nullable_false" {
  enabled = true
}

rule "terraform_variable_order" {
  enabled = true
}

rule "terraform_variable_separate" {
  enabled = true
}

rule "terraform_resource_data_arg_layout" {
  enabled = true
}

rule "azurerm_arg_order" {
  enabled = true
}

rule "azurerm_resource_tag" {
  enabled = true
}

rule "terraform_count_index_usage" {
  enabled = false
}

rule "terraform_heredoc_usage" {
  enabled = true
}

rule "terraform_module_provider_declaration" {
  enabled = true
}

rule "terraform_required_providers_declaration" {
  enabled = true
}

rule "terraform_required_version_declaration" {
  enabled = true
}

rule "terraform_sensitive_variable_no_default" {
  enabled = true
}

rule "terraform_versions_file" {
  enabled = true
}

We've met the following error:

Failed to check ruleset; Failed to check `azurerm_linux_virtual_machine_invalid_size` rule: main.tf:113,27-46: Invalid function argumen
t; Invalid value for "value" parameter: the given value is not sensitive, so this call is redundant.

Line 113:

resource "azurerm_virtual_machine_extension" "extensions" {
>>  for_each = nonsensitive(local.vm_extensions)

  name                        = each.value.name

It looks like TFLint was complaining that local.vm_extensions is not sensitive, so the call of nonsensitive is redundant. If we remove this function call and the code looks like this:

resource "azurerm_virtual_machine_extension" "extensions" {
  for_each = local.vm_extensions

  name                        = each.value.name

And with terraform.tfvars file content:

vm_extensions = {
  hostname = {
    "publisher" : "Microsoft.Azure.Extensions",
    "type" : "CustomScript",
    "type_handler_version" : "2.0",
    "settings" : "{\"commandToExecute\": \"hostname && uptime\"}",
  },
  AzureMonitorLinuxAgent = {
    "publisher" : "Microsoft.Azure.Monitor",
    "type" : "AzureMonitorLinuxAgent",
    "type_handler_version" : "1.21",
    "auto_upgrade_minor_version" : true
  },
}

When we ran plan command:

terraform plan

╷
│ Error: Invalid for_each argument
│
│   on main.tf line 113, in resource "azurerm_virtual_machine_extension" "extensions":
│  113:   for_each = local.vm_extensions
│     ├────────────────
│     │ local.vm_extensions has a sensitive value
│
│ Sensitive values, or values derived from sensitive values, cannot be used as for_each arguments. If used, the sensitive value could  
│ be exposed as a resource instance key.
╵

For now my workaround is:

resource "azurerm_virtual_machine_extension" "extensions" {
  for_each = nonsensitive(sensitive(local.vm_extensions))

  name                        = each.value.name
  publisher                   = each.value.value.publisher
  type                        = each.value.value.type

Answered by wata727

Jan 4, 2023

This is the intended behavior. Perhaps local.vm_extensions is not sensitive because var.vm_extensions is NULL when running TFLint. On the other hand, local.vm_extensions is sensitive, as var.vm_extensions is probably given a value when running terraform plan.

Below is a minimal repro code:

variable "sensitive_set" {
  type      = list
  default   = null
  sensitive = true
}

locals {
  vm_extensions = var.sensitive_set == null ? [] : var.sensitive_set
}

resource "azurerm_virtual_machine" "main" {
  for_each = nonsensitive(local.vm_extensions)
}

$ tflint
Failed to check ruleset; Failed to check `azurerm_virtual_machine_invalid_vm_size` rule: main.tf:12,27-46: Invalid function argument; In…

View full answer

wata727 · 2023-01-04T17:58:41Z

wata727
Jan 4, 2023
Maintainer

This is the intended behavior. Perhaps local.vm_extensions is not sensitive because var.vm_extensions is NULL when running TFLint. On the other hand, local.vm_extensions is sensitive, as var.vm_extensions is probably given a value when running terraform plan.

Below is a minimal repro code:

variable "sensitive_set" {
  type      = list
  default   = null
  sensitive = true
}

locals {
  vm_extensions = var.sensitive_set == null ? [] : var.sensitive_set
}

resource "azurerm_virtual_machine" "main" {
  for_each = nonsensitive(local.vm_extensions)
}

$ tflint
Failed to check ruleset; Failed to check `azurerm_virtual_machine_invalid_vm_size` rule: main.tf:12,27-46: Invalid function argument; Invalid value for "value" parameter: the given value is not sensitive, so this call is redundant.
$ TF_VAR_sensitive_set=[] tflint
// No errors

This code really needs to be fixed as terraform plan can fail if var.vm_extensions is not given. Make sure local.vm_extensions is always sensitive or wrap it in sensitive like your workaround.

1 reply

lonegunmanb Jan 6, 2023
Author

Thanks @wata727 , make sense to me.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Incorrect sensitive check] - Failed to check `azurerm_linux_virtual_machine_invalid_size` rule: Invalid function argumen t; Invalid value for "value" parameter: the given value is not sensitive, so this call is redundant #1640

{{title}}

Replies: 1 comment 1 reply

{{title}}

{{title}}

Select a reply

[Incorrect sensitive check] - Failed to check azurerm_linux_virtual_machine_invalid_size rule: Invalid function argumen t; Invalid value for "value" parameter: the given value is not sensitive, so this call is redundant #1640

lonegunmanb Jan 4, 2023

Replies: 1 comment · 1 reply

wata727 Jan 4, 2023 Maintainer

lonegunmanb Jan 6, 2023 Author

[Incorrect sensitive check] - Failed to check `azurerm_linux_virtual_machine_invalid_size` rule: Invalid function argumen t; Invalid value for "value" parameter: the given value is not sensitive, so this call is redundant #1640

lonegunmanb
Jan 4, 2023

Replies: 1 comment 1 reply

wata727
Jan 4, 2023
Maintainer

lonegunmanb Jan 6, 2023
Author