core: Allow offline validation of provider configuration

[radeksimko]

So far this was an invisible nature of plan for me until 975e1a6

I'm looking for a way to do local, offline validation, mostly for running terraform plan -refresh=false in CI, which I use purely for syntax check.

I was wondering if validation that calls API (typically credentials validation, like in AWS) should be separated into a different function, that would be only called when it's really necessary (refresh, apply, destroy).

The current workaround is either to generate IAM credentials that will have permission to only run iam.getuser to get its own account ID (in cases where allowed_account_ids or forbidden_account_ids are defined).

I know there is a separate issue somewhere discussing syntax validation, but I'm thinking that plan should optionally work offline as well.

[josephholsten]

@radeksimko could use your 👀 on #5004, which is just a rebased #3783

[apparentlymart]

I think this use-case was mostly addressed in #3783, and it's currently possible to use terraform validate to do this sort of offline validation with some caveats. (In particular, you need to run terraform init with some special options to get providers and modules installed without also initializing the backend.)

This will get more robust in the next release when we switch to the new configuration language interpreter which is able to do catch more problems via static validation (type mismatches, etc) than the current one can.

Since we're pretty close here and the remaining work is already covered by other discussions, I'm going to close this out.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.