Fix nil pointer panic when moved block has invalid addresses

.changes/v1.15/BUG FIXES-20260305-120000.yaml

@@ -0,0 +1,5 @@
+kind: BUG FIXES
+body: 'configs: fix nil pointer panic when a moved block has invalid addresses (e.g. quoted strings)'
+time: 2026-03-05T12:00:00.000000+00:00
+custom:
+    Issue: "34041"

internal/configs/module_test.go

@@ -131,6 +131,16 @@ func TestModule_required_providers_multiple(t *testing.T) {
 	}
 }
 
+// Moved blocks with invalid (e.g. quoted) addresses combined with import
+// blocks should produce errors but must not panic.
+// https://github.com/hashicorp/terraform/issues/34041
+func TestModule_moved_with_invalid_addresses_no_panic(t *testing.T) {
+	_, diags := testModuleFromDir("testdata/invalid-modules/moved-with-invalid-addresses")
+	if !diags.HasErrors() {
+		t.Fatal("module should have error diags, but does not")
+	}
+}
+
 // A module may have required_providers configured in files loaded later than
 // resources. These provider settings should still be reflected in the
 // resources' configuration.

internal/configs/moved.go

@@ -44,18 +44,20 @@ func decodeMovedBlock(block *hcl.Block) (*Moved, hcl.Diagnostics) {
 		}
 	}
 
+	if diags.HasErrors() {
+		return nil, diags
+	}
+
 	// we can only move from a module to a module, resource to resource, etc.
-	if !diags.HasErrors() {
-		if !moved.From.MightUnifyWith(moved.To) {
-			// We can catch some obviously-wrong combinations early here,
-			// but we still have other dynamic validation to do at runtime.
-			diags = diags.Append(&hcl.Diagnostic{
-				Severity: hcl.DiagError,
-				Summary:  "Invalid \"moved\" addresses",
-				Detail:   "The \"from\" and \"to\" addresses must either both refer to resources or both refer to modules.",
-				Subject:  &moved.DeclRange,
-			})
-		}
+	if !moved.From.MightUnifyWith(moved.To) {
+		// We can catch some obviously-wrong combinations early here,
+		// but we still have other dynamic validation to do at runtime.
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid \"moved\" addresses",
+			Detail:   "The \"from\" and \"to\" addresses must either both refer to resources or both refer to modules.",
+			Subject:  &moved.DeclRange,
+		})
 	}
 
 	return moved, diags

internal/configs/moved_test.go

@@ -118,10 +118,7 @@ func TestMovedBlock_decode(t *testing.T) {
 				}),
 				DefRange: blockRange,
 			},
-			&Moved{
-				From:      mustMoveEndpointFromExpr(foo_expr),
-				DeclRange: blockRange,
-			},
+			nil,
 			"Missing required argument",
 		},
 		"error: type mismatch": {

internal/configs/testdata/invalid-modules/moved-with-invalid-addresses/moved-invalid.tf

@@ -0,0 +1,16 @@
+# Quoted addresses (issue #34041)
+moved {
+  from = "module.foo"
+  to   = "module.bar"
+}
+
+# Unqualified resource names without type prefix (issue #34162)
+moved {
+  from = bar
+  to   = foo
+}
+
+import {
+  to = test_instance.foo
+  id = "test"
+}

internal/refactoring/move_statement.go

@@ -48,6 +48,11 @@ func FindMoveStatements(rootCfg *configs.Config) []MoveStatement {
 func findMoveStatements(cfg *configs.Config, into []MoveStatement) []MoveStatement {
 	modAddr := cfg.Path
 	for _, mc := range cfg.Module.Moved {
+		if mc.From == nil || mc.To == nil {
+			// Invalid addresses should've been caught during original
+			// configuration decoding, in the configs package.
+			continue
+		}
 		fromAddr, toAddr := addrs.UnifyMoveEndpoints(modAddr, mc.From, mc.To)
 		if fromAddr == nil || toAddr == nil {
 			// Invalid combination should've been caught during original