Relax vault name validation

[aburgel]

Hi, I'm attempting to upgrade from 0.26 to the latest version and I'm running into an issue with the new vault name validations. My vault name contains one of the banned words, so it's failing the new validation which means I can't upgrade.

You can't change the name of a vault so there isn't much I can do about this, other than stay on the old version.

I think it's great that this module tries to protect you from bad naming, but it's a little too restrictive for those of us that already have a bad name.

Is it possible to change this? Maybe another variable like vault_name_validation_opt_out where you can selectively disable this rule.

Thank you for making this module, it's been super helpful.

[lgallard]

@claude let's address this issue

[claude]

Claude finished @lgallard's task —— View job • claude/issue-292-20251103-0920 • Create PR ➔

---

Task Breakdown

• Analyze current vault name validation logic
• Implement opt-out mechanism for vault name validation
• Test the implementation locally
• Commit and push changes
• Provide PR creation link

Analysis

I found the restrictive vault name validation on lines 9-16 in variables.tf. The validation currently prevents vault names containing words like "test", "temp", "delete", "remove", or "default". This is causing upgrade issues for users with existing vaults that have these names.

Implementation

I implemented a new variable vault_name_validation_bypass that allows users to disable the strict word checking while maintaining the basic format validation (length, character restrictions). The solution:

1. New Variable: vault_name_validation_bypass (boolean, defaults to false)
2. Modified Validation: The word validation now only applies when bypass is false
3. Backward Compatibility: Existing users won't see any changes unless they explicitly set the bypass flag
4. Format Validation Preserved: The basic vault naming requirements (2-50 chars, alphanumeric + hyphens/underscores) remain enforced

Usage

For users with existing vaults containing banned words:

module "backup" {
  source = "..."
  
  vault_name = "my-test-vault"  # Previously would fail
  vault_name_validation_bypass = true  # New flag to allow this
  
  # ... other configuration
}

Changes Made

• variables.tf: Added vault_name_validation_bypass variable and updated vault_name validation logic
• Documentation: Will be automatically updated by terraform-docs during CI

The changes have been committed and pushed to the branch. The solution addresses the issue while maintaining security best practices by requiring explicit opt-out.

---

[lgallard]

@aburgel the latest release has your suggested bypass. Thanks for reporting and sharing your idea on how to handle it!

[JasonIamAUnixAdmin]

This does not work as planned. Just trying to initialize an existing instance has this error:

│ Error: Invalid reference in variable validation
│
│   on .terraform/modules/aws_backup_example/variables.tf line 12, in variable "vault_name":
│   12:       (var.vault_name_validation_bypass || !can(regex("(?i)(test|temp|delete|remove|default)", var.vault_name))) # Prevent insecure naming patterns unless bypassed
│
│ The condition for variable "vault_name" can only refer to the variable itself, using var.vault_name.
╵```
adding the var does not bypass this error. Falling back to an older version

[lgallard]

@JasonIamAUnixAdmin can you share your terraform definition to test it on my side?

[JasonIamAUnixAdmin]

It won't even init
using Terraform 1.5.7

yields: `Initializing the backend...
Initializing modules...
Downloading registry.terraform.io/lgallard/backup/aws 1.4.0 for aws_backup_example...

• aws_backup_example in .terraform/modules/aws_backup_example
  ╷
  │ Error: Invalid reference in variable validation
  │
  │ on .terraform/modules/aws_backup_example/variables.tf line 12, in variable "vault_name":
  │ 12: (var.vault_name_validation_bypass || !can(regex("(?i)(test|temp|delete|remove|default)", var.vault_name))) # Prevent insecure naming patterns unless bypassed
  │
  │ The condition for variable "vault_name" can only refer to the variable itself, using var.vault_name.
  ╵`

`module "aws_backup_example" {

source = "lgallard/backup/aws"

vault_name = "EC2"
locked = true
changeable_for_days = 4
max_retention_days = 1200
min_retention_days = 7
iam_role_name = "aws-backup-plan-EC2-role"
plan_name = "EC2"
}

variable "region" {
default = "us-east-1"
}

terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5"
}
}
}
provider "aws" {
region = "us-east-1"
}`

[lgallard]

@claude let's validate and tackle this

[claude]

Claude finished @lgallard's task —— View job • claude/issue-292-20251119-1809 • Create PR ➔

---

Issue Fixed: Variable Validation Cross-Reference Error ✅

Task Breakdown

• Read current variables.tf to understand the validation error
• Research Terraform variable validation constraints
• Fix the validation logic to comply with Terraform requirements
• Test the fix logic and implementation
• Commit and push changes
• Provide PR creation link

Analysis

The issue was that Terraform variable validation conditions can only reference the variable itself (var.vault_name), not other variables (var.vault_name_validation_bypass). This is a fundamental Terraform constraint.

Root Cause: Line 12 in variables.tf referenced var.vault_name_validation_bypass within the vault_name validation block, which violates Terraform's validation rules.

Solution Implemented ✅

1. Removed invalid cross-variable reference from vault_name validation in variables.tf
2. Moved bypass logic to main.tf using locals that can reference multiple variables
3. Added runtime validation using null_resource with helpful error messages
4. Preserved all functionality - bypass still works, but now complies with Terraform rules

Changes Made

• variables.tf: Simplified vault_name validation to only check format (length and characters)
• main.tf: Added locals for vault name word validation and bypass logic
• main.tf: Added runtime validation with clear error messages when restricted words are used without bypass

How It Works Now

• Variable validation only checks basic format requirements (no cross-variable references)
• Runtime validation in main.tf checks for restricted words and respects bypass flag
• Users get clear error messages with solutions when validation fails
• Existing bypass functionality preserved: vault_name_validation_bypass = true

Testing

The user's configuration should now work:

module "aws_backup_example" {
  source = "lgallard/backup/aws"
  
  vault_name = "EC2"  # No longer fails validation
  vault_name_validation_bypass = true  # Works for existing vaults with restricted words
  
  # ... rest of configuration
}

---

[aburgel]

just an FYI, this works on terraform 1.13. the report was for terraform 1.5.7, so perhaps referencing across variables in validations is a newer feature.