core: check preconditions and postconditions for ephemeral resources

internal/checks/state_init.go

@@ -33,6 +33,10 @@ func collectInitialStatuses(into addrs.Map[addrs.ConfigCheckable, *configCheckab
 		addr := rc.Addr().InModule(moduleAddr)
 		collectInitialStatusForResource(into, addr, rc)
 	}
+	for _, rc := range cfg.Module.EphemeralResources {
+		addr := rc.Addr().InModule(moduleAddr)
+		collectInitialStatusForResource(into, addr, rc)
+	}
 
 	for _, oc := range cfg.Module.Outputs {
 		addr := oc.Addr().InModule(moduleAddr)

internal/terraform/context_plan_ephemeral_test.go

@@ -425,6 +425,54 @@ module "child" {
 				})
 			},
 		},
+		"resource precondition": {
+			module: map[string]string{
+				"main.tf": `
+locals {
+  test_value = 2
+}
+ephemeral "ephem_resource" "data" {
+  lifecycle {
+    precondition {
+      condition = local.test_value != 2
+	  error_message = "value should not be 2"
+    }
+  }
+}
+`,
+			},
+			expectPlanDiagnostics: func(m *configs.Config) (diags tfdiags.Diagnostics) {
+				return diags.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Resource precondition failed",
+					Detail:   "value should not be 2",
+				})
+			},
+		},
+		"resource postcondition": {
+			module: map[string]string{
+				"main.tf": `
+locals {
+  test_value = 2
+}
+ephemeral "ephem_resource" "data" {
+  lifecycle {
+    postcondition {
+      condition = self.value == "pass"
+	  error_message = "value should be \"pass\""
+    }
+  }
+}
+`,
+			},
+			expectPlanDiagnostics: func(m *configs.Config) (diags tfdiags.Diagnostics) {
+				return diags.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Resource postcondition failed",
+					Detail:   `value should be "pass"`,
+				})
+			},
+		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			if tc.toBeImplemented {

internal/terraform/node_resource_ephemeral.go

@@ -132,6 +132,18 @@ func ephemeralResourceOpen(ctx EvalContext, inp ephemeralResourceInput) (*provid
 		Private:    resp.Private,
 	})
 
+	// Postconditions for ephemerals validate only what is returned by
+	// OpenEphemeralResource. These will block downstream dependency operations
+	// if an error is returned, but don't prevent renewal or closing of the
+	// resource.
+	checkDiags = evalCheckRules(
+		addrs.ResourcePostcondition,
+		config.Postconditions,
+		ctx, inp.addr, keyData,
+		tfdiags.Error,
+	)
+	diags = diags.Append(checkDiags)
+
 	return nil, diags
 }