Help us shape the future of Go! Take the 2026 Go Developer Survey

tfmodules

package
v1.20.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 26, 2026 License: Apache-2.0 Imports: 32 Imported by: 0

Documentation

Overview

* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. * * This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. * * This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

Index

Constants

View Source 
const DefaultMaxConfigFileBytes int64 = 5 * bytesPerMB

DefaultMaxConfigFileBytes is the largest Terraform configuration file the scan parses with its default --max-file-size of 5 MB (see MaxConfigFileBytesForScan).

Variables

View Source 
var ErrSkippedLinkPlaceholder = errors.New("skipped Terraform symlink placeholder")

ErrSkippedLinkPlaceholder identifies an unsafe or unavailable checkout symlink. Callers skip these at debug level, rather than reporting an invalid config.

Functions

func CanonicalModuleSource added in v1.20.1 

func CanonicalModuleSource(source string) (string, bool)

CanonicalModuleSource renders a registry module source in its fully qualified form (host/namespace/name/provider//subdir), stripping any query. It returns false for non-registry sources, such as local paths and Git sources.

func ConfigEntries added in v1.15.0 

func ConfigEntries(entries []fs.DirEntry, pred func(string) bool) []fs.DirEntry

ConfigEntries returns non-directory entries matching pred. pred is typically tfpath.IsHCLConfig or tfpath.IsConfig.

func ConfigFileTooLarge added in v1.18.2 

func ConfigFileTooLarge(path string, maxBytes int64) bool

ConfigFileTooLarge reports whether the file at path exceeds a positive maxBytes.

func ConfinedFilePath added in v1.15.0 

func ConfinedFilePath(ctx context.Context, entry fs.DirEntry, dir, packageRoot string) (string, bool)

ConfinedFilePath reports whether a directory entry is a regular file the Terraform parser can scan. Regular files are accepted. Symlinks are accepted only when their target is a regular file confined within packageRoot (or dir when packageRoot is empty).

func DetectModuleSourceType 

func DetectModuleSourceType(source string) (sourceType, registryScope string)

func GetProviderFromResourceType 

func GetProviderFromResourceType(resourceType string) (string, error)

GetProviderFromResourceType extracts the provider name from a Terraform resource type. For example: "aws_s3_bucket" → "aws", "azurerm_network_interface" → "azurerm"

func IsUnresolved added in v1.7.2 

func IsUnresolved(err error) bool

func LoadTFFilesFromDir added in v1.9.0 

func LoadTFFilesFromDir(ctx context.Context, dir, packageRoot string) (model.FileMetadatas, error)

LoadTFFilesFromDir returns FileMetadata for top-level Terraform/OpenTofu configuration files (.tf, .tofu, .tf.json, .tofu.json) in dir (no recursion — a Terraform module is a single directory). When packageRoot is non-empty, symlinked config files are included only when their targets stay within the package root.

func LoadTFFilesFromDirWithLimit added in v1.18.2 

func LoadTFFilesFromDirWithLimit(
	ctx context.Context, dir, packageRoot string, maxBytes int64,
) (model.FileMetadatas, error)

LoadTFFilesFromDirWithLimit is LoadTFFilesFromDir skipping configuration files larger than a positive maxBytes: the scan would not parse them, so module calls they declare could never be evaluated.

func LocalModuleDir added in v1.20.0 

func LocalModuleDir(fsys vfs.FS, callerDir, source string) (string, bool)

LocalModuleDir resolves source with ResolveLocalModuleDir when it is a local module source, after removing its go-getter prefixes.

func LocalModuleDirWithContext added in v1.20.2 

func LocalModuleDirWithContext(ctx context.Context, fsys vfs.FS, callerDir, source string) (dir string, local bool, err error)

LocalModuleDirWithContext also retains an explicit checkout boundary and the scan-scoped symlink cache while resolving placeholder module directories. local identifies the source syntax even when its target must be skipped, so callers never offer a failed local source to a remote resolver.

func LooksLikeLocalModuleSource 

func LooksLikeLocalModuleSource(source string) bool

LooksLikeLocalModuleSource uses heuristics to determine if the resolved source string is likely local

func MaxConfigFileBytesForScan added in v1.18.2 

func MaxConfigFileBytesForScan(maxFileSizeMB int) int64

MaxConfigFileBytesForScan returns the largest configuration file a scan run with --max-file-size maxFileSizeMB parses, or -1 when a negative value disables that limit.

func MaxConfigFileBytesFromContext added in v1.18.2 

func MaxConfigFileBytesFromContext(ctx context.Context) int64

MaxConfigFileBytesFromContext returns the cap scoped by WithMaxConfigFileBytes, or zero, which reads every file, when there is none.

func ParseTerraformModules 

func ParseTerraformModules(
	ctx context.Context, fsys vfs.FS, files model.FileMetadatas, numWorkers int,
) (map[string]ParsedModule, error)

ParseTerraformModules parses HCL content and extracts module source/version. numWorkers: 0 means auto-detect (GOMAXPROCS).

func ParseTerraformModulesFromFiles added in v1.9.0 

func ParseTerraformModulesFromFiles(
	ctx context.Context, fsys vfs.FS, files model.FileMetadatas, allowedFiles map[string]bool,
) (map[string]ParsedModule, error)

ParseTerraformModulesFromFiles is a variant of ParseTerraformModules that accepts an optional allowedFiles set to restrict which files contribute module blocks (all files still contribute locals/vars for correct resolution). fsys is used for local-source path validation; a nil fsys falls back to vfs.DiskFS{}.

func ReadConfigFile added in v1.20.2 

func ReadConfigFile(ctx context.Context, fsys vfs.FS, path, packageRoot string) ([]byte, error)

ReadConfigFile reads a Terraform config, following confined checkout links.

func ReadConfigFileWithMaterializer added in v1.20.2 

func ReadConfigFileWithMaterializer(
	ctx context.Context, fsys vfs.FS, path, packageRoot string, materialize func(context.Context, string) error,
) ([]byte, error)

ReadConfigFileWithMaterializer allows sparse packages to acquire missing link targets. materialize is called only for confined missing path components of a detected placeholder, under the same hop and file-size limits as disk reads.

func ResolveConfigContent added in v1.20.2 

func ResolveConfigContent(ctx context.Context, fsys vfs.FS, path, packageRoot string, data []byte) ([]byte, error)

ResolveConfigContent follows a config placeholder without changing its logical filename: relative Terraform references still belong to the linking module. In-memory scans never read the host filesystem to resolve pushed content.

func ResolveLocalModuleDir added in v1.20.0 

func ResolveLocalModuleDir(fsys vfs.FS, callerDir, source string) string

ResolveLocalModuleDir resolves a local module source (without go-getter prefixes) against callerDir the way Terraform does. When that directory does not exist, it tries the layouts build systems produce by assembling a module from several directories, and returns the first that exists:

  • callerDir is <module>/environments/<name>, whose files are merged into <module>, so a relative source is relative to <module>;
  • an absolute source points into a build container where the repository is mounted elsewhere (e.g. /cnab/app/terraform/<repo path>), so its longest suffix of at least two segments that exists under an ancestor of callerDir inside the caller's repository is used. Outside a repository there is no fallback, so a module elsewhere on the machine is never attributed to the caller.

The Terraform resolution is returned when no fallback exists, so errors still name the path Terraform would use.

func ResolveModuleDir added in v1.20.2 

func ResolveModuleDir(ctx context.Context, fsys vfs.FS, callerDir, path, packageRoot string) (string, error)

ResolveModuleDir follows placeholder directories using the caller's repository (or the supplied downloaded package) as its boundary. Ordinary missing module sources retain their existing validation errors.

func ResolveModuleDirWithMaterializer added in v1.20.2 

func ResolveModuleDirWithMaterializer(
	ctx context.Context, fsys vfs.FS, callerDir, path, packageRoot string, materialize func(context.Context, string) error,
) (string, error)

ResolveModuleDirWithMaterializer is ResolveModuleDir for a sparse package that can acquire confined missing path components while resolving a directory.

func SelectConfigNames added in v1.15.0 

func SelectConfigNames(entries []fs.DirEntry, dir string, allow map[string]struct{}, keep string) []string

SelectConfigNames is SelectHCLConfigNames plus JSON config files.

func SelectHCLConfigNames added in v1.15.0 

func SelectHCLConfigNames(entries []fs.DirEntry, dir string, allow map[string]struct{}, keep string) []string

SelectHCLConfigNames returns HCL config basenames from entries, optionally limited to allow and then OpenTofu-shadowed within that set. keep, when set, is never dropped from a scan-set merge.

func StripGetterPrefix added in v1.20.0 

func StripGetterPrefix(source string) string

StripGetterPrefix removes go-getter scheme prefixes so the source can be treated as a path. Compound prefixes like "git::file://./path" are fully stripped in two passes.

func WithLinkPlaceholderPackages added in v1.20.2 

func WithLinkPlaceholderPackages(ctx context.Context, roots []string) context.Context

WithLinkPlaceholderPackages registers verified downloaded package boundaries for readers that do not carry an explicit package root. The stored roots are copied so concurrent readers do not depend on the caller's slice.

func WithLinkPlaceholderRoot added in v1.20.2 

func WithLinkPlaceholderRoot(ctx context.Context, root string) context.Context

WithLinkPlaceholderRoot supplies the scan's repository boundary when its checkout has no .git entry. Downloaded modules can override it with their package boundary. An empty root leaves an existing boundary unchanged.

func WithMaxConfigFileBytes added in v1.18.2 

func WithMaxConfigFileBytes(ctx context.Context, maxBytes int64) context.Context

WithMaxConfigFileBytes scopes the configuration file cap of LoadTFFilesFromDirWithLimit to ctx, for readers deep in module resolution.

Types

type ListModuleEntry added in v1.7.2 

type ListModuleEntry struct {
	Name          string `json:"name"`
	Source        string `json:"source"`
	Version       string `json:"version,omitempty"`
	SourceType    string `json:"source_type"`
	RegistryScope string `json:"registry_scope,omitempty"`
	FileName      string `json:"file_name"`
	DefLine       int    `json:"def_line"`
	DefEndLine    int    `json:"def_end_line"`
}

ListModuleEntry is the JSON shape emitted by `datadog-iac-scanner list-modules`. Field names are stable integration contracts for hosted scan orchestration.

func ListModuleEntries added in v1.7.2 

func ListModuleEntries(modules map[string]ParsedModule, includeLocal bool) []ListModuleEntry

ListModuleEntries converts parsed modules to list-modules JSON rows.

type ModuleAttributesInfo 

type ModuleAttributesInfo struct {
	Resources []string          `json:"resources"`
	Inputs    map[string]string `json:"inputs"`
}

type ModuleParseResult 

type ModuleParseResult struct {
	Index  int
	Module ParsedModule
	Error  error
}

type ParsedModule 

type ParsedModule struct {
	Name           string
	AbsSource      string
	Source         string
	Version        string
	IsLocal        bool
	SourceType     string // local, git, registry, etc.
	RegistryScope  string // public, private, or "" (non-registry)
	AttributesData map[string]ModuleAttributesInfo
	FileName       string
	DefLine        int
	DefEndLine     int
}

func ParseAllModuleVariables 

func ParseAllModuleVariables(
	ctx context.Context, fsys vfs.FS, modules map[string]ParsedModule, rootDir string, resolver RemoteResolver,
	mergeAllow map[string]struct{},
) ([]ParsedModule, error)

ParseAllModuleVariables resolves modules to disk and fills AttributesData. Resolution failures for individual modules are non-fatal and logged; only a context cancellation returns an error.

type RegistryModuleSource added in v1.12.0 

type RegistryModuleSource struct {
	Host      string
	Namespace string
	Name      string
	Provider  string
	Subdir    string
}

RegistryModuleSource is a Terraform registry module address.

func ParseRegistryModuleSource added in v1.12.0 

func ParseRegistryModuleSource(source string) (RegistryModuleSource, error)

ParseRegistryModuleSource parses a registry module source, including hosts with ports and //subdir selections. Implicit three-part addresses use registry.terraform.io rather than the OpenTofu default host; explicit registry.opentofu.org sources keep their declared host.

func (*RegistryModuleSource) Public added in v1.12.0 

func (s *RegistryModuleSource) Public() bool

func (*RegistryModuleSource) String added in v1.12.0 

func (s *RegistryModuleSource) String() string

type RemoteResolver added in v1.8.0 

type RemoteResolver interface {
	Resolve(ctx context.Context, mod *ParsedModule) (localPath string, err error)
}

type UnresolvedError added in v1.7.2 

type UnresolvedError struct {
	Reason string
	// NotApplicable marks a resolver declining a source it does not handle, as
	// opposed to a resolver that attempted the source and failed.
	NotApplicable bool
}

func (*UnresolvedError) Error added in v1.7.2 

func (e *UnresolvedError) Error() string

Source Files

View all Source files

Directories

Path Synopsis
* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
 * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
 * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
 * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.