validating map of objects

Question

I am trying to validate a map of objects that is typed as below :

variable "ecs_config_map" {
  type = map(object({
    cpu     = number
    memory  = number
    desired = number

    capabilities = list(string)
    launch_type  = string
  }))
}

The value for the variable looks like :

ecs_config_map = {
  driver = {
    cpu     = 256
    memory  = 512
    desired = 0

    capabilities = ["FARGATE"]
    launch_type  = "FARGATE"
  }
  aggregator = {
    cpu     = 256
    memory  = 512
    desired = 0

    capabilities = ["FARGATE"]
    launch_type  = "FARGATE"
  }
}

---

Now, I want to perform some basic validation, but I cannot seem to get the syntax right.

 validation {
    condition = contains(["EC2", "FARGATE", "EXTERNAL"], var.ecs_config_map[*]["launch_type"])
    error_message = "Only EC2, FARGATE, EXTERNAL are allowed values for launch_type."
  }

This threw Invalid value for "list" parameter: list of bool required.

---

Debugging on terraform console described :

> type(var.ecs_config_map)
map(
    object({
        capabilities: list(string),
        cpu: number,
        desired: number,
        launch_type: string,
        memory: number,
    }),
)
> type(var.ecs_config_map["driver"])
object({
    capabilities: list(string),
    cpu: number,
    desired: number,
    launch_type: string,
    memory: number,
})
> type(var.ecs_config_map[*])
tuple([
    map(
        object({
            capabilities: list(string),
            cpu: number,
            desired: number,
            launch_type: string,
            memory: number,
        }),
    ),
])

which indicated that my problem was because I was trying to iterate over all the objects in the variable. I am using a splat expression when doing var.ecs_config_map[*] which converts the whole map into a tuple of maps of objects.

---

Then I tried to use a for expression to perform the validation

 validation {
    condition = can(for task in var.ecs_config_map : contains(["EC2", "FARGATE", "EXTERNAL"], task["launch_type"]))
    error_message = "Only EC2, FARGATE, EXTERNAL are allowed values for launch_type."
  }

And I got thrown The condition for variable "ecs_config_map" can only refer to the variable itself, using var.ecs_config_map.

for_each did not work either.

---

Am I messing up the syntax of the validation somewhere? Or am I asking too much from terraform by attempting validation of a complex type?

Answer 1

You can validate your variable with the following expression:

validation {
  condition     = length([for launch_type in values(var.ecs_config_map)[*].launch_type: launch_type if !contains(["EC2", "FARGATE", "EXTERNAL"], launch_type)]) <= 0
  error_message = "Only EC2, FARGATE, EXTERNAL are allowed values for launch_type."
}

This might seem complex so let's brake it donw.

We can extract the launch types from ecs_config_map with the following for expression:

output "launch_types" {
  value = [for launch_type in values(var.ecs_config_map)[*].launch_type : launch_type]
}

The output of this would be something like:

launch_types = [
  "FARGATE",
  "FARGATE",
]

Moving on, we would want to filter out those launch types which are not in the allowed types array (["EC2", "FARGATE", "EXTERNAL"]). We can do this as such:

output "not_allowed_launch_types" {
  value = [for launch_type in values(var.ecs_config_map)[*].launch_type: launch_type if !contains(["EC2", "FARGATE", "EXTERNAL"], launch_type)]
}

If the input is correct, this should output an empty array, otherwise we will have the incorrect launch types as the output.

Final step is to validate if we have any incorrect launch types. We can do this with the length function, if the length of the array with the incorrect launch types is greater than 0, we have an invalid input.