Why Variable validation blocks in Terraform? - Purpose & Use Cases

The Big Idea

What if your infrastructure could catch input mistakes before they cause costly failures?

The Scenario

Imagine you are setting up cloud resources using Terraform, and you have to manually check if the input values for your variables are correct every time before applying changes.

You write scripts or notes to remind yourself to verify inputs like region names, instance sizes, or IP addresses.

The Problem

This manual checking is slow and easy to forget.

If you miss a mistake, Terraform might create wrong resources or fail halfway, wasting time and causing frustration.

It's like trying to build furniture without checking if the parts fit first -- you might end up with broken pieces.

The Solution

Variable validation blocks in Terraform let you define rules right inside your code to automatically check if inputs are valid.

This means Terraform stops and tells you exactly what is wrong before making any changes.

It's like having a smart assistant that checks your parts before you start building, saving time and avoiding errors.

Before vs After

✗ Before

variable "region" {
  type = string
  # No validation here
}

# Need to manually check if region is valid before apply

✓ After

variable "region" {
  type = string
  validation {
    condition     = contains(["us-east-1", "us-west-2"], var.region)
    error_message = "Region must be us-east-1 or us-west-2"
  }
}

What It Enables

It enables safer, faster, and more reliable infrastructure setup by catching input errors early.

Real Life Example

When deploying a web app, you can ensure the server size variable only accepts allowed sizes like 'small', 'medium', or 'large', preventing costly mistakes.

Key Takeaways

Manual input checks are slow and error-prone.

Variable validation blocks automate input verification inside Terraform.

This leads to safer and smoother infrastructure deployments.

Practice

1. What is the main purpose of a validation block inside a Terraform variable?

easy

A. To check if the input value meets specific rules before applying the configuration

B. To assign a default value to the variable

C. To declare the variable type

D. To output the variable value after deployment

Solution

1. Step 1: Understand variable validation purpose

   The validation block is used to enforce rules on input values to prevent invalid configurations.

2. Step 2: Differentiate from other variable features

   Default values assign fallback values, type declares data type, and output shows results, but validation specifically checks input correctness.

3. Final Answer:

   To check if the input value meets specific rules before applying the configuration -> Option A

4. Quick Check:

   Validation block purpose = input checking [OK]

Hint: Validation blocks check inputs before use [OK]

Common Mistakes:

• Confusing validation with default value assignment
• Thinking validation outputs variable values
• Mixing validation with type declaration

2. Which of the following is the correct syntax to add a validation block inside a Terraform variable?

easy

A. variable "example" { validate { condition = length(var.example) > 0 error = "Must not be empty" } }

B. variable "example" { validation { condition = length(var.example) > 0 error_message = "Must not be empty" } }

C. variable "example" { validation { check = length(var.example) > 0 message = "Must not be empty" } }

D. variable "example" { validation { condition = length(example) > 0 error_message = "Must not be empty" } }

Solution

1. Step 1: Identify correct block and attribute names

   The correct block is validation with attributes condition and error_message.

2. Step 2: Check variable references and syntax

   Inside the condition, use var.example to refer to the variable value. variable "example" { validation { condition = length(var.example) > 0 error_message = "Must not be empty" } } matches this exactly.

3. Final Answer:

   variable "example" { validation { condition = length(var.example) > 0 error_message = "Must not be empty" } } -> Option B

4. Quick Check:

   Validation syntax = correct block and attributes [OK]

Hint: Use 'validation' block with 'condition' and 'error_message' [OK]

Common Mistakes:

• Using 'validate' instead of 'validation'
• Using wrong attribute names like 'check' or 'error'
• Referencing variable without 'var.' prefix

3. Given this variable declaration:

variable "port" {
  type = number
  validation {
    condition     = var.port >= 1024 && var.port <= 65535
    error_message = "Port must be between 1024 and 65535"
  }
}

What happens if you set port = 80 when applying Terraform?

medium

A. Terraform will apply successfully with port 80

B. Terraform will prompt to enter a valid port

C. Terraform will ignore the validation and use default port

D. Terraform will fail with error: Port must be between 1024 and 65535

Solution

1. Step 1: Analyze the validation condition

   The condition requires the port to be between 1024 and 65535 inclusive.

2. Step 2: Check the input value against the condition

   Port 80 is less than 1024, so the condition fails.

3. Step 3: Understand Terraform behavior on validation failure

   Terraform stops and shows the error message from error_message.

4. Final Answer:

   Terraform will fail with error: Port must be between 1024 and 65535 -> Option D

5. Quick Check:

   Validation fails = error message shown [OK]

Hint: Validation blocks stop apply if condition is false [OK]

Common Mistakes:

• Assuming Terraform applies anyway
• Thinking default values are used automatically
• Expecting interactive prompts for invalid input

4. Identify the error in this variable validation block:

variable "env" {
  type = string
  validation {
    condition     = var.env == "dev" || "prod"
    error_message = "env must be 'dev' or 'prod'"
  }
}

medium

A. Validation blocks cannot use logical OR operators

B. The error_message attribute is misspelled

C. The condition syntax is incorrect; it should compare both values explicitly

D. The variable type should be list, not string

Solution

1. Step 1: Review the condition expression

   The condition var.env == "dev" || "prod" is invalid because "prod" alone is always true.

2. Step 2: Correct the condition syntax

   It should be var.env == "dev" || var.env == "prod" to compare both values explicitly.

3. Final Answer:

   The condition syntax is incorrect; it should compare both values explicitly -> Option C

4. Quick Check:

   Logical OR needs full comparisons [OK]

Hint: Use full comparisons on both sides of OR [OK]

Common Mistakes:

• Writing incomplete logical expressions
• Assuming string alone works as condition
• Confusing error_message spelling

5. You want to validate a list variable users so it must have at least 2 unique names and none can be empty strings. Which validation block correctly enforces this?

hard

A. validation { condition = length(var.users) >= 2 && length(distinct(var.users)) == length(var.users) && alltrue([for u in var.users : u != ""]) error_message = "Users must have 2+ unique non-empty names" }

B. validation { condition = length(var.users) > 2 && distinct(var.users) != [] error_message = "Users must have 2+ unique names" }

C. validation { condition = length(var.users) >= 2 && var.users != [""] error_message = "Users must not be empty" }

D. validation { condition = length(var.users) >= 2 && length(var.users) == length(distinct(var.users)) error_message = "Users must have unique names" }

Solution

1. Step 1: Check list length and uniqueness

   Condition requires at least 2 items and all must be unique, so length(var.users) >= 2 and length(distinct(var.users)) == length(var.users) ensure this.

2. Step 2: Ensure no empty strings

   The alltrue([for u in var.users : u != ""]) checks every user is not empty.

3. Step 3: Compare options

   validation { condition = length(var.users) >= 2 && length(distinct(var.users)) == length(var.users) && alltrue([for u in var.users : u != ""]) error_message = "Users must have 2+ unique non-empty names" } includes all these checks correctly; others miss empty string check or uniqueness properly.

4. Final Answer:

   validation { condition = length(var.users) >= 2 && length(distinct(var.users)) == length(var.users) && alltrue([for u in var.users : u != ""]) error_message = "Users must have 2+ unique non-empty names" } -> Option A

5. Quick Check:

   All conditions combined = validation { condition = length(var.users) >= 2 && length(distinct(var.users)) == length(var.users) && alltrue([for u in var.users : u != ""]) error_message = "Users must have 2+ unique non-empty names" } [OK]

Hint: Combine length, distinct, and alltrue for list validation [OK]

Common Mistakes:

• Missing empty string check
• Using > 2 instead of >= 2 for minimum count
• Not verifying uniqueness correctly