Allow Variable Validation Conditions to Refer to Other Variables

[RoseSecurity]

OpenTofu Version

OpenTofu 1.6.2

Use Cases

I want to be able to have conditional validation on variables - the condition being the value of other variables.
Currently, I'm trying to implement a load balancer (resource "aws_lb") in AWS - the load balancer resource can either be of type "application" or "network". Depending on the load balancer type, there are several required and optional variables that you can pass in. Terraform throws an error if you fail to pass a required variable, but, if you pass in an optional variable to the wrong load balancer type, there isn't much warning.

For the sake of example, an application load balancer can optionally take a list of security groups, but a network load balancer can't. If a developer passes in a list of security groups to an NLB, they may have specified the wrong value for load_balancer_type, or they may be passing variables into the wrong load balancer resource - in either case, I'd like to give a warning to the developer to save them having to go debugging.

This isn't a request that's strictly for AWS load balancers - the pattern of "value X is required if value Y is Z" seems to be fairly common across Terraform plugins.

Attempted Solutions

I tried adding a validation block here:

variable "security_groups" {
  description = "A list of security groups to attach to the load balancer. Only works with ALBs"
  type = list(string)

  validation {
    condition = var.lb_type == "application"
    error_message = "Security groups can only be used by Application Load Balancers."
  }
}

Error:

Error: Invalid variable validation condition

  on variables.tf line 36, in variable "security_groups":
  36:     condition = var.lb_type == "application"

The condition for variable "security_groups" must refer to var.security_groups
in order to test incoming values.

Proposal

Just a few prefaces to my proposals:

• Implementing such a feature could allow for cyclic dependencies between variables - although, I think that it's at the developer's own risk - like how to package systems in programming languages facilitate cyclic dependencies (but we still all recognize the benefit of having them).

• I think that the (bigger) potential issue is causing a significant growth in the dependency graph by creating a complex set of conditional validation rules

References

• Terraform Request

[cam72cam]

Do you think a variant of #1042 may be helpful here?

[RoseSecurity]

@cam72cam Definitely, I really would love to see more flexibility around this area