Unable to apply aws_s3_bucket_name rule

[kloktech-mark]

Hi, I'm trying to apply a s3 bucket name rule to s3 resource in a module. Module inspection is turned on, but the rule either isn't ran or doesn't seem to detect any issue. Can you see what am I doing wrong? If I put the resource in template.tf, then rule will work as expected. But if I put it in module, it doesn't detect issue.

tflint

TFLint version 0.46.0
+ ruleset.terraform (0.2.2-bundled)
+ ruleset.aws (0.22.1)

.tflint.hcl

config {
    format = "compact"
    module = true
    disabled_by_default = false

}
plugin "terraform" {
  enabled = true
  preset  = "recommended"
}

plugin "aws" {
    enabled = true
    version = "0.22.1"
    source  = "github.com/terraform-linters/tflint-ruleset-aws"
}

rule "aws_s3_bucket_name" {
  enabled = true
  regex = "^[a-z\\-]+$"
  prefix = "my-org"
}

rule "terraform_required_version"{
  enabled = false
}

module/s3.tf

resource "aws_s3_bucket" "foo" {
  bucket = "foo"
}

template.tf

module "my_instance" {
  source        = "./module"
}

TFLINT_LOG=debug tflint

00:02:28 config.go:136: [INFO] Load config: .tflint.hcl
00:02:28 config.go:268: [DEBUG] Config loaded
00:02:28 config.go:269: [DEBUG]   Module: true
00:02:28 config.go:270: [DEBUG]   ModuleSet: true
00:02:28 config.go:271: [DEBUG]   Force: false
00:02:28 config.go:272: [DEBUG]   ForceSet: false
00:02:28 config.go:273: [DEBUG]   DisabledByDefault: false
00:02:28 config.go:274: [DEBUG]   DisabledByDefaultSet: true
00:02:28 config.go:275: [DEBUG]   PluginDir:
00:02:28 config.go:276: [DEBUG]   PluginDirSet: false
00:02:28 config.go:277: [DEBUG]   Format: compact
00:02:28 config.go:278: [DEBUG]   FormatSet: true
00:02:28 config.go:279: [DEBUG]   Varfiles:
00:02:28 config.go:280: [DEBUG]   Variables:
00:02:28 config.go:281: [DEBUG]   Only:
00:02:28 config.go:282: [DEBUG]   IgnoreModules:
00:02:28 config.go:286: [DEBUG]   Rules:
00:02:28 config.go:288: [DEBUG]     terraform_required_version: false
00:02:28 config.go:288: [DEBUG]     aws_s3_bucket_name: true
00:02:28 config.go:290: [DEBUG]   Plugins:
00:02:28 config.go:292: [DEBUG]     terraform: enabled=true, version=, source=
00:02:28 config.go:292: [DEBUG]     aws: enabled=true, version=0.22.1, source=github.com/terraform-linters/tflint-ruleset-aws
00:02:28 option.go:70: [DEBUG] CLI Options
00:02:28 option.go:71: [DEBUG]   Module: false
00:02:28 option.go:72: [DEBUG]   Force: false
00:02:28 option.go:73: [DEBUG]   Format:
00:02:28 option.go:74: [DEBUG]   Varfiles:
00:02:28 option.go:75: [DEBUG]   Variables:
00:02:28 option.go:76: [DEBUG]   EnableRules:
00:02:28 option.go:77: [DEBUG]   DisableRules:
00:02:28 option.go:78: [DEBUG]   Only:
00:02:28 option.go:79: [DEBUG]   EnablePlugins:
00:02:28 option.go:80: [DEBUG]   IgnoreModules:
00:02:28 loader.go:38: [INFO] Initialize new loader
00:02:28 module_mgr.go:63: [INFO] Module manifest file found. Initializing...
00:02:28 loader.go:80: [INFO] Module inspection is enabled. Building the root module with children...
00:02:28 loader.go:114: [DEBUG] Trying to load the module: key=my_instance, version=, dir=module
00:02:28 runner.go:45: [INFO] Initialize new runner for root
00:02:28 runner.go:45: [INFO] Initialize new runner for module.my_instance
00:02:28 discovery.go:33: [INFO] Plugin `terraform` is not installed, but the bundled plugin is available.
00:02:28 discovery.go:54: [INFO] Plugin `terraform` found
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:604: starting plugin: path=/usr/local/bin/tflint args=["/usr/local/bin/tflint", "--act-as-bundled-plugin"]
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:612: plugin started: path=/usr/local/bin/tflint pid=14044
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:707: waiting for RPC address: path=/usr/local/bin/tflint
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:1046: tflint: 00:02:28 [DEBUG] go-plugin@v1.4.9/server.go:404: plugin address: network=unix address=/var/folders/rw/scxjklf511l3kd7frp3sdqkr0000gn/T/plugin2242490679
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:752: using plugin: version=11
00:02:28 discovery.go:90: [DEBUG] Find plugin path: /Users/malin/.tflint.d/plugins/github.com/terraform-linters/tflint-ruleset-aws/0.22.1/tflint-ruleset-aws
00:02:28 discovery.go:54: [INFO] Plugin `aws` found
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:604: starting plugin: path=/Users/malin/.tflint.d/plugins/github.com/terraform-linters/tflint-ruleset-aws/0.22.1/tflint-ruleset-aws args=["/Users/malin/.tflint.d/plugins/github.com/terraform-linters/tflint-ruleset-aws/0.22.1/tflint-ruleset-aws"]
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:612: plugin started: path=/Users/malin/.tflint.d/plugins/github.com/terraform-linters/tflint-ruleset-aws/0.22.1/tflint-ruleset-aws pid=14045
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:707: waiting for RPC address: path=/Users/malin/.tflint.d/plugins/github.com/terraform-linters/tflint-ruleset-aws/0.22.1/tflint-ruleset-aws
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:752: using plugin: version=11
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:1046: tflint-ruleset-aws: 00:02:28 [DEBUG] go-plugin@v1.4.8/server.go:401: plugin address: network=unix address=/var/folders/rw/scxjklf511l3kd7frp3sdqkr0000gn/T/plugin871312069
00:02:28 [DEBUG] host2plugin/client.go:124: starting host-side gRPC server
00:02:28 [DEBUG] host2plugin/client.go:124: starting host-side gRPC server
00:02:28 [DEBUG] host2plugin/client.go:124: starting host-side gRPC server
00:02:28 [DEBUG] host2plugin/client.go:124: starting host-side gRPC server
00:02:28 [DEBUG] go-plugin@v1.4.9/grpc_stdio.go:142: stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
00:02:28 [INFO]  go-plugin@v1.4.9/client.go:665: plugin process exited: path=/usr/local/bin/tflint pid=14044
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:472: plugin exited
00:02:28 [DEBUG] go-plugin@v1.4.9/grpc_stdio.go:142: stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
00:02:28 [INFO]  go-plugin@v1.4.9/client.go:665: plugin process exited: path=/Users/malin/.tflint.d/plugins/github.com/terraform-linters/tflint-ruleset-aws/0.22.1/tflint-ruleset-aws pid=14045
00:02:28 [DEBUG] go-plugin@v1.4.9/client.go:472: plugin exited

[bendrucker]

https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/module-inspection.md#caveats

Issues must be associated with a variable that was passed to the module. If an issue within a child module is detected in an expression that does not reference a variable (var), it will be discarded.

[kloktech-mark]

Thank you! It didn't occur to me this is exactly what that caveat meant. Thanks! So I guess if there's a rule to check static values in module, then I should run tflint directly in the module, yes?

[bendrucker]

Correct! Module mode is meant to check issues with module blocks, as opposed to their source. If you want to assert the same rules against the module's source, you should indeed run TFLint there as well, optionally in recursive mode depending on your directory structure.