HashiCorp Terraform Associate (004) Question 124
Single answer4g Validate configuration using custom conditionsA platform team maintains a reusable Terraform module that provisions an AWS Application Load Balancer. The team wants to fail early if a caller provides an invalid health check path. The requirement is: the variable must begin with a forward slash (/), and if the value is invalid, Terraform should stop with a clear error message before creating resources. Which implementation best meets this requirement?
- A
Define the variable with a validation block: variable "health_check_path" { type = string validation { condition = startswith(var.health_check_path, "/") error_message = "health_check_path must start with /." } }
- B
Add a lifecycle precondition inside the aws_lb_target_group resource that checks startswith(var.health_check_path, "/"), because preconditions are only evaluated after the resource is created
- C
Use an output block with a precondition that checks startswith(var.health_check_path, "/"), because outputs are validated before Terraform plans resources
- D
Set the variable type to string and rely on terraform validate to detect that the string does not start with / automatically
Show answer and explanation
Correct answer: A
Explanation
The best answer is the variable validation block because this feature is designed specifically to validate input variables using custom conditions and return a clear error_message when the condition is false. In Terraform, custom conditions include input variable validation, preconditions, and postconditions. For a module input rule like "must start with /", variable validation is the most direct and maintainable approach. Preconditions and postconditions are useful when validating assumptions about resources, data sources, and outputs, but they are not the best primary mechanism for simple caller input validation. This aligns with Terraform language best practices documented by HashiCorp for custom conditions and input variable validation.
- A. Correct.
Correct. A variable validation block is the appropriate way to enforce rules on input variables and return a custom error message when the caller provides an invalid value. This checks the input early and is specifically designed for validating module inputs such as string format requirements.
- B. Incorrect.
Incorrect. A lifecycle precondition can validate assumptions related to resources, data sources, and outputs, but the statement about evaluation timing is wrong. Preconditions are checked before Terraform evaluates the object they are attached to for planning/apply, not only after creation. While a precondition could be used in some scenarios, it is not the best fit here because the requirement is to validate a module input directly and as early as possible.
- C. Incorrect.
Incorrect. Output preconditions are intended to validate conditions about output values, not to serve as the primary mechanism for validating input variables. Outputs are evaluated later in the workflow, so this does not best satisfy the requirement to fail early on bad input.
- D. Incorrect.
Incorrect. Declaring a variable as type string only ensures the value is a string. Terraform does not automatically infer custom format constraints such as requiring a leading slash. The terraform validate command checks configuration syntax and internal consistency, but it does not add custom semantic rules unless you explicitly define them with validation or conditions.