diff --git a/internal/terraform/context_plan_actions_test.go b/internal/terraform/context_plan_actions_test.go index ecb6d4386a..3a04e6652c 100644 --- a/internal/terraform/context_plan_actions_test.go +++ b/internal/terraform/context_plan_actions_test.go @@ -319,6 +319,75 @@ output "my_output2" { }, }, + "actions can't be used in depends_on": { + module: map[string]string{ + "main.tf": ` +action "test_action" "my_action" { + config { + attr = "value" + } +} +resource "test_object" "a" { + depends_on = [action.test_action.my_action] + lifecycle { + action_trigger { + events = [before_create] + actions = [action.test_action.my_action] + } + } +} +`, + }, + expectValidateDiagnostics: func(m *configs.Config) tfdiags.Diagnostics { + return tfdiags.Diagnostics{}.Append( + &hcl.Diagnostic{ + Severity: hcl.DiagError, + Summary: "Invalid depends_on reference", + Detail: "Actions can not be referenced in depends_on. Use depends_on on the resource that triggers the action instead.", + Subject: &hcl.Range{ + Filename: filepath.Join(m.Module.SourceDir, "main.tf"), + Start: hcl.Pos{Line: 8, Column: 17, Byte: 117}, + End: hcl.Pos{Line: 8, Column: 45, Byte: 145}, + }, + }) + }, + }, + + "action instances can't be used in depends_on": { + module: map[string]string{ + "main.tf": ` +action "test_action" "my_action" { + count = 3 + config { + attr = "value" + } +} +resource "test_object" "a" { + depends_on = [action.test_action.my_action[1]] + lifecycle { + action_trigger { + events = [before_create] + actions = [action.test_action.my_action[1]] + } + } +} +`, + }, + expectValidateDiagnostics: func(m *configs.Config) tfdiags.Diagnostics { + return tfdiags.Diagnostics{}.Append( + &hcl.Diagnostic{ + Severity: hcl.DiagError, + Summary: "Invalid depends_on reference", + Detail: "Actions can not be referenced in depends_on. Use depends_on on the resource that triggers the action instead.", + Subject: &hcl.Range{ + Filename: filepath.Join(m.Module.SourceDir, "main.tf"), + Start: hcl.Pos{Line: 9, Column: 17, Byte: 129}, + End: hcl.Pos{Line: 9, Column: 48, Byte: 160}, + }, + }) + }, + }, + "destroy run": { module: map[string]string{ "main.tf": ` diff --git a/internal/terraform/node_resource_validate.go b/internal/terraform/node_resource_validate.go index 7dd60e24c1..dc12110da8 100644 --- a/internal/terraform/node_resource_validate.go +++ b/internal/terraform/node_resource_validate.go @@ -811,6 +811,21 @@ func validateDependsOn(ctx EvalContext, dependsOn []hcl.Traversal) (diags tfdiag }) } + // We don't allow depends_on on actions because their ordering is depending on the resource + // that triggers them, therefore users should use a depends_on on the resource instead. + + if ref != nil { + switch ref.Subject.(type) { + case addrs.Action, addrs.ActionInstance: + diags = diags.Append(&hcl.Diagnostic{ + Severity: hcl.DiagError, + Summary: "Invalid depends_on reference", + Detail: "Actions can not be referenced in depends_on. Use depends_on on the resource that triggers the action instead.", + Subject: traversal.SourceRange().Ptr(), + }) + } + } + // The ref must also refer to something that exists. To test that, // we'll just eval it and count on the fact that our evaluator will // detect references to non-existent objects.