Updating terragrunt from 0.68.6 to 0.70.4: TFLINT gives error " A variable named "xxxxx" was assigned, but the root module does not declare "

[NicolaSpreafico]

Hello,

In my Terragrunt project I enabled TFLINT as documented here:
https://terragrunt.gruntwork.io/docs/features/hooks/#tflint-hook

This is my hook

  # Run tflint during execution

  before_hook "before_tflint" {
    commands = ["validate", "apply", "plan"]
    execute  = ["tflint"]
  }

And this is the content of my .tflint.hcl

plugin "terraform" {
  enabled = true
  version = "0.10.0"
  source  = "github.com/terraform-linters/tflint-ruleset-terraform"
}

plugin "google" {
  enabled = true
  version = "0.30.0"
  source  = "github.com/terraform-linters/tflint-ruleset-google"
}

config {
  module = true
}

With Terragrunt version 0.68.6 (and previous versions) this configuration always worked fine since many months.
This morning I updated Terragrunt runtime to 0.70.4 and it started me giving these errors:

Error: Value for undeclared variable

  on <value for var.zone> line 1:
  (source code not available)

A variable named "zone" was assigned, but the root module does not declare a variable of that name.

My main project structure is following these guidelines:
https://terragrunt.gruntwork.io/docs/features/includes/

• I have an hcl file which shares variables assignement between different modules of the same environment
• I have an hcl file which shares variables assignement between different environments of the same module

In this way I can declare a value once and all the management is centralized.

It happens that, based on the nature of the single module, not all the variables are declared, like for example in the hcl I may have

var1=foo
var2=baz
var3=bar

but in a specific module I may only declare

variable "var1" { .... }

Up until today all the value assignments which did not have a variable declaration counterpart were simply ignored, with the new version they started to give an error.

I'm opening this issue to ask you if this is some sort of unexpected regression or, if it is indeed expected, there is some way to tell tflint to ignore this kind of error.

Than you

[yhakbar]

Hey @NicolaSpreafico ,

It was intended that we'd upgrade to the latest MPL version of tflint, yes.

If you would prefer not to deal with tflint issues in v0.50.3, I recommend using an external tflint binary that you install locally:

terraform {
  before_hook "tflint" {
    commands = ["apply", "plan", "validate"]
    execute  = ["tflint", "--terragrunt-external-tflint"]
  }
}

Terragrunt used to use a pre-built version of v0.47.0, so it's probably safe to drop to that version.

[NicolaSpreafico]

Hi @yhakbar,
thank you for the insight but I'm not sure I'm getting your suggestion as solution to my issue.

I'm now running these versions:

> terragrunt --version
terragrunt version v0.70.4

> tflint --version
TFLint version 0.50.3

But during terragrunt plan I'm still getting the same error. Am I missing something or is there a way to ignore that specific rule?
This is the debug log from Terrragrunt

14:05:07.876 DEBUG  Finding .tflint.hcl file from ./.terragrunt-cache/XddAFogwH2marbk-6J4oPf8cyMM/8cDxeKcU44m2xYzXR0-C2xWgPdE and going to ./.terragrunt-cache/XddAFogwH2marbk-6J4oPf8cyMM
14:05:07.876 DEBUG  Finding .tflint.hcl file from ./.terragrunt-cache/XddAFogwH2marbk-6J4oPf8cyMM and going to ./.terragrunt-cache
14:05:07.876 DEBUG  Finding .tflint.hcl file from ./.terragrunt-cache and going to .
14:05:07.876 DEBUG  Finding .tflint.hcl file from . and going to ..
14:05:07.877 DEBUG  Finding .tflint.hcl file from .. and going to ../..
14:05:07.877 DEBUG  Finding .tflint.hcl file from ../.. and going to ../../..
14:05:07.877 DEBUG  Found .tflint.hcl in ../../.tflint.hcl
14:05:07.877 DEBUG  Using .tflint.hcl file in ../../.tflint.hcl
14:05:07.877 DEBUG  Initializing tflint in directory ./.terragrunt-cache/XddAFogwH2marbk-6J4oPf8cyMM/8cDxeKcU44m2xYzXR0-C2xWgPdE
14:05:07.877 DEBUG  Running external tflint init with args [tflint --init --config ../../.tflint.hcl --chdir ./.terragrunt-cache/XddAFogwH2marbk-6J4oPf8cyMM/8cDxeKcU44m2xYzXR0-C2xWgPdE]
14:05:07.877 DEBUG  Running command: tflint --init --config ../../.tflint.hcl --chdir ./.terragrunt-cache/XddAFogwH2marbk-6J4oPf8cyMM/8cDxeKcU44m2xYzXR0-C2xWgPdE
Plugin "terraform" is already installed
Plugin "google" is already installed
14:05:07.891 DEBUG  Running external tflint with args [tflint --config ../../.tflint.hcl --chdir ./.terragrunt-cache/XddAFogwH2marbk-6J4oPf8cyMM/8cDxeKcU44m2xYzXR0-C2xWgPdE --var=*** --var=*** --var=***]
14:05:07.892 DEBUG  Running command: tflint --config ../../.tflint.hcl --chdir ./.terragrunt-cache/XddAFogwH2marbk-6J4oPf8cyMM/8cDxeKcU44m2xYzXR0-C2xWgPdE --var=*** --var=*** --var=***
Failed to parse variables; <value for var.zone>:1,1-1: Value for undeclared variable; A variable named "zone" was assigned, but the root module does not declare a variable of that name., and 2 other diagnostic(s):

Error: Value for undeclared variable

  on <value for var.zone> line 1:
  (source code not available)

A variable named "zone" was assigned, but the root module does not declare a variable of that name.

I found other reference
terraform-linters/tflint#1941 (comment)

[yhakbar]

The maintainers don't want there to be a way to opt-out of this check as of v0.50.3. If they did introduce something in a later release we wouldn't upgrade to it anyways, as we don't want to risk integrating with any BUSL licensed code.

#1941 says that it should ignore extra TF_VAR_ variables, so maybe there's something off in our implementation of the tflint hook. It might be that we shouldn't use --var for the tflint call, but should instead set TF_VAR_ prefixed environment variables. If a member of the community was to submit a pull request to address that, I would review it (though I should point out that Gruntwork is about to go on holiday break until the 6th of Jan).

If you want the old behavior, I recommend you downgrade your locally installed version of tflint to v0.47.0, then make sure you call tflint with the --terragrunt-external-tflint flag like this:

terraform {
  before_hook "tflint" {
    commands = ["apply", "plan", "validate"]
    execute  = ["tflint", "--terragrunt-external-tflint"]
  }
}

[yhakbar]

Potentially resolved by #3669