Merge pull request #234 from hashicorp/bendbennett/issues-233

random_string and random_password require checks on length

Author: bendbennett

CHANGELOG.md

@@ -1,3 +1,12 @@
+## 3.1.3 (April 22, 2022)
+
+BUG FIXES:
+
+* resource/random_password: Prevent crash when length is less than 0 ([#129](https://github.com/hashicorp/terraform-provider-random/issues/129), [#181](https://github.com/hashicorp/terraform-provider-random/issues/181), [#200](https://github.com/hashicorp/terraform-provider-random/pull/200), [#233](https://github.com/hashicorp/terraform-provider-random/issues/233)).
+* resource/random_string: Prevent crash when length is less than 0 ([#129](https://github.com/hashicorp/terraform-provider-random/issues/129), [#181](https://github.com/hashicorp/terraform-provider-random/issues/181), [#200](https://github.com/hashicorp/terraform-provider-random/pull/200), [#233](https://github.com/hashicorp/terraform-provider-random/issues/233)).
+* resource/random_password: Prevent confusing inconsistent result error when length is 0 ([#222](https://github.com/hashicorp/terraform-provider-random/issues/222), [#233](https://github.com/hashicorp/terraform-provider-random/issues/233)).
+* resource/random_string: Prevent confusing inconsistent result error when length is 0 ([#222](https://github.com/hashicorp/terraform-provider-random/issues/222), [#233](https://github.com/hashicorp/terraform-provider-random/issues/233)).
+
 ## 3.1.2 (March 17, 2022)
 
 BUG FIXES:

docs/resources/password.md

@@ -36,7 +36,7 @@ resource "aws_db_instance" "example" {
 
 ### Required
 
-- `length` (Number) The length of the string desired.
+- `length` (Number) The length of the string desired. The minimum value for length is 1 and, length must also be >= (`min_upper` + `min_lower` + `min_numeric` + `min_special`).
 
 ### Optional
 

docs/resources/string.md

@@ -31,7 +31,7 @@ resource "random_string" "random" {
 
 ### Required
 
-- `length` (Number) The length of the string desired.
+- `length` (Number) The length of the string desired. The minimum value for length is 1 and, length must also be >= (`min_upper` + `min_lower` + `min_numeric` + `min_special`).
 
 ### Optional
 

internal/provider/resource_string_test.go

@@ -64,6 +64,14 @@ func TestAccResourceString(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"length", "lower", "number", "special", "upper", "min_lower", "min_numeric", "min_special", "min_upper", "override_special"},
 			},
+			{
+				Config:      testAccResourceStringInvalidConfig,
+				ExpectError: regexp.MustCompile(`.*length \(2\) must be >= min_upper \+ min_lower \+ min_numeric \+ min_special \(3\)`),
+			},
+			{
+				Config:      testAccResourceStringLengthTooShortConfig,
+				ExpectError: regexp.MustCompile(`.*expected length to be at least \(1\), got 0`),
+			},
 		},
 	})
 }
@@ -153,4 +161,13 @@ resource "random_string" "min" {
   min_numeric = 4
 }
 `
+	testAccResourceStringInvalidConfig = `
+resource "random_string" "invalid_length" {
+  length = 2
+  min_lower = 3
+}`
+	testAccResourceStringLengthTooShortConfig = `
+resource "random_string" "invalid_length" {
+  length = 0
+}`
 )

internal/provider/string.go

@@ -6,6 +6,8 @@ package provider
 import (
 	"context"
 	"crypto/rand"
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"math/big"
 	"sort"
 
@@ -29,10 +31,12 @@ func stringSchemaV1(sensitive bool) map[string]*schema.Schema {
 		},
 
 		"length": {
-			Description: "The length of the string desired.",
-			Type:        schema.TypeInt,
-			Required:    true,
-			ForceNew:    true,
+			Description: "The length of the string desired. The minimum value for length is 1 and, length " +
+				"must also be >= (`min_upper` + `min_lower` + `min_numeric` + `min_special`).",
+			Type:             schema.TypeInt,
+			Required:         true,
+			ForceNew:         true,
+			ValidateDiagFunc: validation.ToDiagFunc(validation.IntAtLeast(1)),
 		},
 
 		"special": {
@@ -144,6 +148,13 @@ func createStringFunc(sensitive bool) func(_ context.Context, d *schema.Resource
 		minSpecial := d.Get("min_special").(int)
 		overrideSpecial := d.Get("override_special").(string)
 
+		if length < minUpper+minLower+minNumeric+minSpecial {
+			return append(diags, diag.Diagnostic{
+				Severity: diag.Error,
+				Summary:  fmt.Sprintf("length (%d) must be >= min_upper + min_lower + min_numeric + min_special (%d)", length, minUpper+minLower+minNumeric+minSpecial),
+			})
+		}
+
 		if overrideSpecial != "" {
 			specialChars = overrideSpecial
 		}