tflint-ruleset-opa
tflint-ruleset-opa copied to clipboard
Improve value handling
You have to write policies with many patterns in mind to cover all cases. For example:
- Unknown values
- Unknown values in the
countmeta-argument - Unknown values in the
for_eachmeta-argument - Unknown values in dynamic blocks
- Null
- Undefined
See also https://github.com/terraform-linters/tflint-ruleset-opa/blob/v0.1.0/docs/handling_special_values.md
It can be frustrating to have to think about so much when writing a policy. Providing an option to fall back to the initial value of each type in the above cases might make it easier to write the policy.
The question is whether users prefer false positives or false negatives. The current design focuses to avoid false positives, but users who want to enforce policies prefer to avoid false negatives. We should think carefully about which one to default to.