Skip to content
Sarj Code Standards

no-terraform-data-condition

Disallow lifecycle conditions attached to terraform_data guard resources.

SARJ210 Rule source Tests Catalog JSON

Why

A terraform_data resource created only to reject a plan turns configuration policy into stateful graph noise. The assertion drifts with today's configuration while obscuring the input, resource, test, or deployment boundary that owns the invariant.

Fix

Delete the terraform_data guard. Put an input invariant on its variable, a provider invariant on the owning resource, and environment or rollout policy in tests and deployment review.

Examples

Before — flagged A literal true assertion adds no constraint
main.tf
resource "terraform_data" "guard" {
  lifecycle {
    precondition {
      condition     = true
      error_message = "Always passes."
    }
  }
}
After — preferred Retain the resource without an inert assertion
main.tf
resource "terraform_data" "guard" {
  lifecycle {}
}
Autofix output
main.tf
resource "terraform_data" "guard" {
  lifecycle {








  }
}
Before — flagged Do not model deployment policy as a fake resource
main.tf
resource "terraform_data" "deployment_guard" {
  lifecycle {
    precondition {
      condition     = var.enabled
      error_message = "deployment must be enabled"
    }
  }
}
After — preferred Keep a lifecycle condition protecting a provisioning operation
main.tf
resource "terraform_data" "bootstrap" {
  triggers_replace = [var.release]
  provisioner "local-exec" {
    command = "bootstrap-hosts"
  }
  lifecycle {
    precondition {
      condition     = var.release != ""
      error_message = "A release is required for provisioning."
    }
  }
}