fix: terraform-docs should read provider versions from required_providers - #43
Open
akuzminsky wants to merge 1 commit into
Open
fix: terraform-docs should read provider versions from required_providers#43akuzminsky wants to merge 1 commit into
akuzminsky wants to merge 1 commit into
Conversation
terraform-docs runs with `lockfile: true`, so it prefers .terraform.lock.hcl
over the constraints in required_providers when both are present. Module
repos do not commit a lock file, but a developer who runs `terraform init`
at the repo root leaves one behind, and the pre-commit hook then regenerates
README.md with that machine's resolved versions and stages it silently:
-| aws | ~> 6.0 |
+| aws | 6.60.0 |
Those numbers say nothing to a consumer of the module - they are whatever
that laptop resolved on that day - and they replace the constraints the
module actually declares. This happened in terraform-aws-elasticsearch and
was only caught by eye during review.
The file is only distributed to repo_type == "terraform_module", so root
configurations that legitimately commit a lock file are unaffected.
Verified with terraform-docs against terraform-aws-elasticsearch with a
lock file present: `lockfile: true` reproduces the pinned table, and
`lockfile: false` emits the declared constraints.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
11 tasks
State
|
| Success | Add | 🟡 Change | Destroy |
|---|---|---|---|
| ✅ | 0 | 51 | 0 |
Affected resources by action
| Action | Resources |
|---|---|
| 🟡 | module.repos["terraform-aws-actions-runner"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-bookstack"].github_repository_file.contributing_md[0] |
| 🟡 | module.repos["terraform-aws-bookstack"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-ci-cd"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-cloud-init"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-cloudcraft-role"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-cost-alert"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-debian-repo"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-dms"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-ecr"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-ecs"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-elasticsearch"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-emrserverless"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-gh-identity-provider"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-gha-admin"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-github-backup"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-github-role"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-guardduty-configuration"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-http-redirect"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-instance-profile"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-iso27001"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-jumphost"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-key"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-kibana"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-lambda-monitored"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-openclaw"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-openvpn"].github_repository_file.contributing_md[0] |
| 🟡 | module.repos["terraform-aws-openvpn"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-org-governance"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-percona-server"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-pmm-ecs"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-postfix"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-pypiserver"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-rds"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-registry"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-s3-bucket"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-secret"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-secret-policy"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-service-network"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-sqs-ecs"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-sqs-pod"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-state-bucket"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-state-manager"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-tags-override"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-tcp-pod"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-teleport-agent"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-terraformer"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-truststore"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-update-dns"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.repos["terraform-aws-website-pod"].github_repository_file.terraform_docs_config[0] |
| 🟡 | module.template_terraform_module.github_repository_file.terraform_docs_config[0] |
STDOUT
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# module.repos["terraform-aws-actions-runner"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-actions-runner:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-bookstack"].github_repository_file.contributing_md[0] will be updated in-place
~ resource "github_repository_file" "contributing_md" {
~ content = <<-EOT
# Contributing to this Project
Thank you for your interest in contributing! This document provides guidelines for contributing to this Terraform module.
## How to Contribute
### Reporting Issues
- Check existing issues before creating a new one
- Use a clear, descriptive title
- Include Terraform and provider versions
- Provide minimal reproduction steps
- Include relevant logs or error messages
### Submitting Changes
1. Fork the repository
2. Create a feature branch from `main`
3. Make your changes following our coding standards
4. Write or update tests as needed
5. Run `make test-clean` to verify all tests pass
6. Submit a pull request
### Pull Request Guidelines
- Reference any related issues
- Provide a clear description of changes
- Ensure CI checks pass
- Keep changes focused and atomic
- Update documentation if needed
## Development Setup
```bash
# Clone your fork
git clone https://github.com/YOUR_USERNAME/REPO_NAME.git
cd REPO_NAME
# Install dependencies
make bootstrap
# Run tests (keeps infrastructure for debugging)
make test-keep
# Run tests with cleanup (before PR)
make test-clean
```
- ### Pre-commit Hooks
-
- ```shell
- pre-commit install
- ```
-
- Hooks run automatically on `git commit`
- (see [.pre-commit-config.yaml](.pre-commit-config.yaml)):
-
- - `terraform fmt` - Format Terraform files
- - `terraform-docs` - Update the generated section of README.md
- - `tflint` - Terraform linting
-
- The repo hook installed by `make install-hooks` is preserved as
- `pre-commit.legacy` and still runs after the pre-commit hooks.
-
- Run the checks manually with `pre-commit run --all-files`.
-
## Coding Standards
Please follow the coding standards defined in `.claude/CODING_STANDARD.md`:
- Use `terraform fmt` for formatting
- Follow naming conventions (snake_case)
- Add descriptions to all variables and outputs
- Include validation blocks where appropriate
- Use conventional commits for commit messages
## Commit Message Format
We use [Conventional Commits](https://www.conventionalcommits.org/):
```
feat: Add support for custom IAM policies
fix: Correct security group ingress rules
docs: Update README with new examples
refactor: Simplify variable validation logic
```
## Testing
- Tests use pytest with pytest-infrahouse fixtures
- Tests create real AWS infrastructure
- Always run `make test-clean` before submitting PR
- Ensure tests pass for all supported AWS provider versions
## Questions?
- Open a GitHub issue for questions about contributing
- See [SECURITY.md](SECURITY.md) for reporting security vulnerabilities
## License
By contributing, you agree that your contributions will be licensed under the same license as the project.
EOT
id = "terraform-aws-bookstack:CONTRIBUTING.md:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-bookstack"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-bookstack:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-ci-cd"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-ci-cd:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-cloud-init"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-cloud-init:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-cloudcraft-role"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-cloudcraft-role:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-cost-alert"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-cost-alert:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-debian-repo"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-debian-repo:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-dms"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-dms:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-ecr"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-ecr:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-ecs"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-ecs:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-elasticsearch"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-elasticsearch:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-emrserverless"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-emrserverless:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-gh-identity-provider"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-gh-identity-provider:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-gha-admin"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-gha-admin:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-github-backup"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-github-backup:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-github-role"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-github-role:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-guardduty-configuration"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-guardduty-configuration:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-http-redirect"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-http-redirect:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-instance-profile"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-instance-profile:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-iso27001"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-iso27001:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-jumphost"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-jumphost:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-key"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-key:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-kibana"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-kibana:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-lambda-monitored"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-lambda-monitored:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-openclaw"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-openclaw:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-openvpn"].github_repository_file.contributing_md[0] will be updated in-place
~ resource "github_repository_file" "contributing_md" {
~ content = <<-EOT
# Contributing to this Project
Thank you for your interest in contributing! This document provides guidelines for contributing to this Terraform module.
## How to Contribute
### Reporting Issues
- Check existing issues before creating a new one
- Use a clear, descriptive title
- Include Terraform and provider versions
- Provide minimal reproduction steps
- Include relevant logs or error messages
### Submitting Changes
1. Fork the repository
2. Create a feature branch from `main`
3. Make your changes following our coding standards
4. Write or update tests as needed
5. Run `make test-clean` to verify all tests pass
6. Submit a pull request
### Pull Request Guidelines
- Reference any related issues
- Provide a clear description of changes
- Ensure CI checks pass
- Keep changes focused and atomic
- Update documentation if needed
## Development Setup
```bash
# Clone your fork
git clone https://github.com/YOUR_USERNAME/REPO_NAME.git
cd REPO_NAME
# Install dependencies
make bootstrap
# Run tests (keeps infrastructure for debugging)
make test-keep
# Run tests with cleanup (before PR)
make test-clean
```
## Coding Standards
Please follow the coding standards defined in `.claude/CODING_STANDARD.md`:
- Use `terraform fmt` for formatting
- Follow naming conventions (snake_case)
- Add descriptions to all variables and outputs
- Include validation blocks where appropriate
- Use conventional commits for commit messages
## Commit Message Format
We use [Conventional Commits](https://www.conventionalcommits.org/):
```
feat: Add support for custom IAM policies
fix: Correct security group ingress rules
docs: Update README with new examples
refactor: Simplify variable validation logic
```
## Testing
- Tests use pytest with pytest-infrahouse fixtures
- Tests create real AWS infrastructure
- Always run `make test-clean` before submitting PR
- Ensure tests pass for all supported AWS provider versions
## Questions?
- Open a GitHub issue for questions about contributing
- See [SECURITY.md](SECURITY.md) for reporting security vulnerabilities
- ## Testing locally (integration tests)
-
- This section describes how to test module changes in a development environment before deploying to production.
-
- ### Prerequisites
-
- - Terraform >= 1.5
- - Python 3.12+ (for pytest-based tests)
- - AWS CLI configured with credentials
- - GNU Make
- - Pre-commit (optional, for local linting)
-
- ### Setting Up Development Environment
-
- 1. **Clone the repository**
- ```shell
- git clone https://github.com/infrahouse/terraform-aws-openvpn.git
- cd terraform-aws-openvpn
- ```
-
- 2. **Install Python dependencies**
- ```shell
- make bootstrap
- ```
-
- This installs:
- - `checkov` - Security scanning
- - `infrahouse-core` - InfraHouse toolkit utilities
- - `pytest-infrahouse` - Test fixtures and helpers
-
- 3. **Install pre-commit hooks**
- ```shell
- pre-commit install
- ```
-
- Hooks run automatically on `git commit`
- (see [.pre-commit-config.yaml](.pre-commit-config.yaml)):
- - `terraform fmt` - Format Terraform files
- - `terraform-docs` - Update README.md documentation
- - `tflint` - Terraform linting
-
- The repo hook installed by `make install-hooks` is preserved as
- `pre-commit.legacy` and still runs after the pre-commit hooks.
-
- ### Running Tests
-
- The module includes comprehensive pytest-based integration tests.
-
- #### Quick Test Run
- ```shell
- # Run all tests
- make test
-
- # Run specific test file
- pytest tests/test_openvpn.py -v
-
- # Run specific test case
- pytest tests/test_openvpn.py::test_module -v
- ```
-
- #### Test Environment Variables
-
- Tests require AWS credentials and optionally Google OAuth credentials:
-
- ```shell
- # Required: AWS credentials (via AWS CLI profile or environment variables)
- export AWS_DEFAULT_PROFILE=AWSAdministratorAccess-123456789012
- export AWS_DEFAULT_REGION=us-west-1
-
- # Optional: Google OAuth client secret for full integration test
- export OPENVPN_CLIENT_SECRET='{"web": {"client_id": "...", "client_secret": "..."}}'
-
- # Run tests
- make test
- ```
-
- #### What Tests Cover
-
- 1. **Infrastructure Creation** (`test_module`)
- - Creates full VPN infrastructure in AWS
- - Verifies all resources are created correctly
- - Checks Auto Scaling Group, NLB, EFS, ECS portal
- - Validates security groups and IAM roles
-
- 2. **Connectivity** (`test_vpn_connectivity`)
- - Deploys test EC2 instance in private subnet
- - Verifies VPN client can connect
- - Tests network connectivity to private resources
-
- 3. **Security** (via Checkov)
- - Scans for misconfigurations
- - Validates encryption settings
- - Checks for overly permissive security groups
-
- #### Test Data Location
-
- Test fixtures are in `test_data/`:
- - `test_data/openvpn/` - Test configuration (turns the WIF feature on)
- - `test_data/openvpn/ecr.tf` - Test ECR repository (for custom portal images)
- - `test_data/openvpn/main.tf` - Test module invocation
-
- ### GCP credentials are required
-
- Since v7.0.0 the module always requires a `google` provider, and
- `tests/test_module.py` turns the WIF feature on. So the single integration test
- stands the module up against AWS **and** the real GCP project in one run, and
- also verifies the keyless federation (via `tests/wif_helpers.py`):
-
- - the directory-reader service account exists and has **no** user-managed keys,
- - the workload identity pool and its AWS provider exist and are `ACTIVE`,
- - the service account grants `workloadIdentityUser` and
- `serviceAccountTokenCreator` to a `principalSet` scoped to that pool.
-
- Because the module cannot apply without GCP, the test **fails** (not skips) when
- GCP credentials are missing — there is no AWS-only path anymore.
-
- #### Prerequisites
-
- 1. **Install the Google Cloud SDK** (provides `gcloud`):
- ```shell
- brew install --cask google-cloud-sdk
- ```
-
- 2. **Authenticate with Application Default Credentials (ADC).** Same mechanism
- locally and in CI, so no service-account key is stored:
- ```shell
- gcloud auth application-default login
- ```
- `gcloud auth application-default set-quota-project` is **not** needed — the
- test and provider pass the project explicitly (via `GOOGLE_PROJECT`), so the
- "quota project" warning google-auth prints is harmless. In CI, GCP auth is
- set up keylessly with `scripts/setup-ci-gcp-auth.sh` + `google-github-actions/auth`.
-
- 3. **GCP permissions.** Your identity needs, in the target project:
- - `roles/iam.serviceAccountAdmin`
- - `roles/iam.serviceAccountKeyAdmin` (the test lists SA keys to assert it is keyless)
- - `roles/iam.workloadIdentityPoolAdmin`
- - `roles/serviceusage.serviceUsageAdmin` (to enable the required APIs)
-
- The project must also have `cloudresourcemanager.googleapis.com` enabled (the
- google provider needs it to manage `google_project_service`).
-
- 4. **Python dependencies** (installed by `make bootstrap`):
- `google-api-python-client`, `google-auth`.
-
- #### Running
-
- ```shell
- make test-clean # run, then destroy resources (uses GOOGLE_PROJECT, default openvpn-427715)
- make test-keep # run and keep resources for debugging
- GOOGLE_PROJECT=my-project make test-clean # override the project
- ```
-
- The Workspace admin the SA impersonates defaults to `aleks@infrahouse.com`;
- override with `GOOGLE_WORKSPACE_ADMIN_EMAIL`.
-
- > **Note:** The one step Terraform cannot perform — authorizing the SA's client
- > ID for the directory scope via
- > [Domain-wide delegation](https://admin.google.com/ac/owl/domainwidedelegation)
- > — is **not** exercised by the test. Each run generates a fresh service account
- > (new client ID), so authorizing DWD per run is impractical; use
- > [`verify-wif.sh`](#google-configuration) on an instance to
- > check the delegation path by hand.
-
- ### Manual Testing Workflow
-
- For testing changes before committing:
-
- 1. **Create a test branch**
- ```shell
- git checkout -b feature/my-improvement
- ```
-
- 2. **Make your changes**
- - Edit Terraform files
- - Update variable descriptions
- - Modify security group rules
-
- 3. **Run linters locally**
- ```shell
- make lint
- ```
-
- This runs:
- - `terraform fmt -check` - Verify formatting
- - `terraform validate` - Validate syntax
- - Additional InfraHouse linters
-
- 4. **Run Checkov security scan**
- ```shell
- checkov -d . --config-file .checkov.yml
- ```
-
- 5. **Update documentation**
- ```shell
- terraform-docs markdown table --output-file README.md --output-mode inject .
- ```
-
- 6. **Run integration tests**
- ```shell
- make test-keep
- make test-clean ## final run at the end
- ```
-
- 7. **Commit changes**
- ```shell
- git add .
- git commit -m "Add feature X"
- # Pre-commit hooks run automatically
- ```
-
- ### Testing in Isolated AWS Account
-
- For safer testing, use a dedicated AWS account:
-
- 1. **Create test AWS account** (via AWS Organizations)
-
- 2. **Configure test environment**
- ```hcl
- # test_data/openvpn/main.tf
- module "vpn" {
- source = "../.." # Local module path
-
- backend_subnet_ids = ["subnet-test1", "subnet-test2"]
- lb_subnet_ids = ["subnet-public1", "subnet-public2"]
- zone_id = "Z1234567890ABC" # Test Route53 zone
-
- google_oauth_client_writer = "arn:aws:iam::123456789012:role/test-admin"
-
- # Use smaller instances for cost savings
- instance_type = "t3a.small"
- portal_instance_type = "t3.nano"
-
- # Shorter retention for test
- cloudwatch_log_retention_days = 7
- efs_backup_retention_days = 7
- }
- ```
-
- 3. **Apply test configuration**
- ```shell
- cd test_data/openvpn
- terraform init
- terraform apply
- ```
-
- 4. **Test functionality**
- - Download VPN profile from portal
- - Connect with OpenVPN client
- - Verify connectivity to test resources
-
- 5. **Destroy test resources**
- ```shell
- terraform destroy
- ```
-
- ### Debugging Failed Tests
-
- #### View Terraform Output
- ```shell
- # Enable Terraform debug logging
- export TF_LOG=DEBUG
- make test
- ```
-
- #### Check CloudWatch Logs
- ```shell
- # View bootstrap logs
- aws logs tail /aws/openvpn/development/openvpn --follow
-
- # View portal logs
- aws logs tail /aws/ecs/openvpn-portal --follow
- ```
-
- #### SSH to Test Instance
- ```shell
- # Get instance IP from Terraform output
- terraform output instance_private_ip
-
- # SSH via Systems Manager (no key required)
- aws ssm start-session --target i-1234567890abcdef0
-
- # Or traditional SSH if key pair configured
- ssh -i ~/.ssh/test-key.pem ubuntu@<instance-ip>
- ```
-
- #### Common Test Failures
-
- 1. **Test timeout** - Increase `asg_health_check_grace_period`
- 2. **EFS mount failure** - Check security group rules
- 3. **Google OAuth errors** - Verify `OPENVPN_CLIENT_SECRET` environment variable
- 4. **Terraform state lock** - Clean up DynamoDB lock table
-
- ### CI/CD Pipeline Testing
-
- The module uses GitHub Actions for automated testing:
-
- - **Workflow:** `.github/workflows/terraform-CI.yml`
- - **Runs on:** Pull requests to `main` branch
- - **Steps:**
- 1. Checkout code
- 2. Configure AWS credentials (via OIDC)
- 3. Set up Python environment
- 4. Run linters (`make lint`)
- 5. Run Checkov security scan
- 6. Run integration tests (`make test`)
-
- **View workflow runs:**
- https://github.com/infrahouse/terraform-aws-openvpn/actions
-
- ### Best Practices for Testing
-
- 1. **Always test in isolated environment first**
- - Never test directly in production AWS account
- - Use dedicated test account or separate VPC
-
- 2. **Clean up test resources**
- - Run `terraform destroy` after testing
- - Check for orphaned resources (load balancers, security groups)
-
- 3. **Test both success and failure paths**
- - Verify module handles errors gracefully
- - Test with invalid inputs
- - Test resource limits (max instances, etc.)
-
- 4. **Document test scenarios**
- - Add comments to test files
- - Document expected behavior
- - Include reproduction steps for bugs
-
- 5. **Use version pinning for testing**
- - Pin provider versions in test configuration
- - Ensures reproducible test results
-
## License
By contributing, you agree that your contributions will be licensed under the same license as the project.
EOT
id = "terraform-aws-openvpn:CONTRIBUTING.md:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-openvpn"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-openvpn:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-org-governance"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-org-governance:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-percona-server"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-percona-server:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-pmm-ecs"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-pmm-ecs:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-postfix"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-postfix:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-pypiserver"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-pypiserver:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-rds"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-rds:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-registry"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-registry:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-s3-bucket"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-s3-bucket:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-secret"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-secret:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-secret-policy"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-secret-policy:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-service-network"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-service-network:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-sqs-ecs"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-sqs-ecs:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-sqs-pod"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-sqs-pod:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-state-bucket"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-state-bucket:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-state-manager"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-state-manager:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-tags-override"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-tags-override:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-tcp-pod"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-tcp-pod:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-teleport-agent"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-teleport-agent:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-terraformer"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-terraformer:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-truststore"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-truststore:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-update-dns"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-update-dns:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.repos["terraform-aws-website-pod"].github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-aws-website-pod:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
# module.template_terraform_module.github_repository_file.terraform_docs_config[0] will be updated in-place
~ resource "github_repository_file" "terraform_docs_config" {
~ content = <<-EOT
---
# This file is managed by Terraform in github-control repository
# Do not edit this file, all changes will be overwritten
# If you need to change this file, create a pull request in
# https://github.com/infrahouse/github-control
formatter: markdown table
version: ""
recursive:
enabled: false
sections:
hide: []
show: []
content: |-
{{ .Requirements }}
{{ .Providers }}
{{ .Modules }}
{{ .Resources }}
{{ .Inputs }}
{{ .Outputs }}
output:
file: README.md
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->
output-values:
enabled: false
from: ""
sort:
enabled: true
by: name
settings:
anchor: true
color: true
default: true
description: true
escape: true
hide-empty: false
html: true
indent: 2
- lockfile: true
+ # Take provider versions from required_providers, not from .terraform.lock.hcl.
+ # Module repos do not commit a lock file, so reading one means the README's
+ # Providers table records whatever versions a developer's last `terraform init`
+ # happened to resolve - meaningless to consumers, and it silently replaces the
+ # constraints the module actually declares.
+ lockfile: false
read-comments: true
required: true
sensitive: true
type: true
EOT
id = "terraform-module-template:./.terraform-docs.yml:main"
# (9 unchanged attributes hidden)
}
Plan: 0 to add, 51 to change, 0 to destroy.
Warning: Argument is deprecated
with module.ih_8_repos.github_repository.repo,
on modules/local-repo/repos.tf line 4, in resource "github_repository" "repo":
4: has_downloads = false
This attribute is no longer in use, but it hasn't been removed yet. It will
be removed in a future version. See
https://github.com/orgs/community/discussions/102145#discussioncomment-8351756
(and 6 more similar warnings elsewhere)
Warning: Deprecated attribute
on .terraform/modules/actions-runner-pem-493370826424-uw1/data_sources.tf line 11, in data "external" "secret_value":
11: "python", "${path.module}/assets/get_secret.py", data.aws_region.current.name, aws_secretsmanager_secret.secret.id, data.aws_iam_role.caller_role.arn
The attribute "name" is deprecated. Refer to the provider documentation for
details.
(and 5 more similar warnings elsewhere)
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: tf.plan
To perform exactly these actions, run the following command to apply:
terraform apply "tf.plan"
metadata
eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogMCwgImNoYW5nZSI6IDUxLCAiZGVzdHJveSI6IDB9fQ==
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The managed
.terraform-docs.ymlsetslockfile: true, so terraform-docs prefers.terraform.lock.hclover the constraints inrequired_providerswhenever a lockfile is present.
Module repos do not commit a lock file, but anyone who runs
terraform initat therepo root leaves one behind. The managed pre-commit hook then regenerates
README.mdand
git adds it without being asked, so the Providers table silently becomes:Those numbers are whatever that laptop resolved on that day. They tell a consumer of
the module nothing, and they replace the constraints the module actually declares.
This just happened in
terraform-aws-elasticsearchwhile bumping dependencies, andwas caught only by reading the diff.
Change
lockfile: falseinmodules/plain-repo/files/.terraform-docs.yml, with a commentexplaining why.
Blast radius
The file is written only to repos with
repo_type == "terraform_module"(
modules/plain-repo/repos-files.tf:102), so root configurations that legitimatelycommit a lock file are unaffected.
Module repos whose README currently shows pinned provider versions will show
constraints instead the next time terraform-docs runs. That is a documentation-only
change, and it restores what those tables looked like before a stray lock file
appeared.
Verification
Ran terraform-docs against
terraform-aws-elasticsearchwith a lock file present:lockfile: trueaws | 6.60.0— reproduces the buglockfile: falseaws | >= 6.33.0, < 7.0.0— the declared constraintyamllintis clean on the edited file.🤖 Generated with Claude Code