Report & generate missing provider source or version constraint

[radeksimko]

Context

Missing Source

Currently users may write configuration such as the following:

resource "aws_instance" "name" {

}

or

provider "aws" {

}

In either of these cases, we (correctly) assume that the user means the latest version of hashicorp/aws by aws.

However, the lack of required_providers entry for the aws provider implies bad practice as provider source should be more explicitly declared in all recent versions of Terraform.

(Legacy Style) Missing Source With Version

Older versions of Terraform (which pre-date the Registry) allowed the following syntax:

terraform {
  required_providers {
    aws = "~> 5.22"
  }
}

resource "aws_instance" "name" {

}

In any recent version however, it's about as bad as the other examples, in that it's not clear what exact aws provider the configuration requires.

Missing Version Constraint

The version constraint isn't required by Terraform and the lack of it implies latest available version.

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
  }
}

resource "aws_instance" "name" {

}

This implies another poor practice where users often unknowingly end up writing configuration assuming a particular version of the provider (say v4.2.1) and then become surprised when a new provider version gets released with breaking changes that are incompatible with their configuration.

Proposal

• Raise missing provider source as warning diagnostic (suggest implied full address in the message)
• Raise legacy style missing source as warning diagnostic (suggest implied full address in the message)
• Raise missing version constraint as warning diagnostic (suggest restricting to the latest major version, e.g. ~> 5.22)