Running tflint from a top level dir: tflint cannot locate file with relative file path

[dalebennettdojo]

I am running tflint from a top level directory and pointing it to a lower level folder. I am also passing a config file using the aws plugin. My command looks like this:

tflint terraform/providers/aws/staging -f compact --config terraform/tf-lint-config/aws/.tflint.hcl

my .tflint.hcl looks like this:

plugin "aws" {
  enabled = true
  version = "0.18.0"
  source  = "github.com/terraform-linters/tflint-ruleset-aws"
}

I am getting the following error:

Failed to check ruleset; Failed to check `aws_iam_policy_sid_invalid_characters` rule: terraform/providers/aws/staging/main.tf:315,18-45: Invalid function argument; Invalid value for "path" parameter: no file exists at "./lb_controller_policy.json"; this function works only with files that are distributed as part of the configuration source code, so if this file will be created by a resource in this configuration you must instead obtain this result from an attribute of that resource.

The error is relating to this part of the main.tf file

resource "aws_iam_policy" "eks_amazon_lb_controller" {
  name   = "eks_amazon_lb_controller"
  policy = file("./lb_controller_policy.json")
}

The file ./lb_controller_policy.json definitely exists in the same directory as provided to tflint, but I think tflint does not use this context to locate the file. I have tried running the following commands instead:

cd terraform/providers/aws/staging
tflint -f compact --config ../../../tf-lint-config/aws/.tflint.hcl

When I cd to the directory containing the terraform ./lb_controller_policy.json is located just fine. This is a problem for me because when trying to add the linter to github actions, running from the top level directory seems to enable the warning annotations on the pull request changed files.

Expected Behavior

Passing a directory to tflint should behave as if running from within the directory itself. If the terraform within the directory in question uses a relative file path, the corresponding files should be able to be located.

Actual behavior

Cannot locate file with relative file path when passing a directory to tflint. However, the file is located fine if a cd to the directory in question occurs first.

Step to Reproduce

Create an aws config file as described in bug description
Create a .tf file referencing some json with a relative file path, put the file in a sub directory. See the terraform extract above (aws_iam_policy) for specific example

tflint path/to/terraform --config path/to/aws/config

Should result in:

Failed to check ruleset; Failed to check `aws_iam_policy_sid_invalid_characters` rule: terraform/providers/aws/staging/main.tf:315,18-45: Invalid function argument; Invalid value for "path" parameter: no file exists at "./lb_controller_policy.json"; this function works only with files that are distributed as part of the configuration source code, so if this file will be created by a resource in this configuration you must instead obtain this result from an attribute of that resource.

Additional Context

TFLint version 0.42.2

[bendrucker]

This is easily fixed by changing your call to file("${path.module}/lb_controller_policy.json"), which is the most correct way to include files in a Terraform module. The use of relative paths only works from root modules, whereas path.module will generate a path relative to the current module.

Terraform will actually chdir into your module. In prior versions without -chdir, I expect you would have seen the same error from Terraform.

I've left a comment on the issue tracking -chdir support mentioning this:

#1315 (comment)

If -chdir is implemented and support for passing modules (or single files 😞) as args is dropped this should work as expected.

[dalebennettdojo]

This is easily fixed by changing your call to file("${path.module}/lb_controller_policy.json"), which is the most correct way to include files in a Terraform module. The use of relative paths only works from root modules, whereas path.module will generate a path relative to the current module.

Terraform will actually chdir into your module. In prior versions without -chdir, I expect you would have seen the same error from Terraform.

I've left a comment on the issue tracking -chdir support mentioning this:

#1315 (comment)

If -chdir is implemented and support for passing modules (or single files 😞) as args is dropped this should work as expected.

Thanks for the help. The syntax you suggested works as I would hope. Got the warning annotations back in PRs now as a result