rule to set a list of allowed or denied providers

[nitrocode]

Is this something that should be covered by tflint or a separate package?

Workaround https://github.com/suzuki-shunsuke/tfprovidercheck

Example for terraform_approved_providers

rule "terraform_approved_providers" {
  enabled = true

  providers = [
    {
      source  = "registry.terraform.io/hashicorp/google"
      version = ">= 4.0.0"
    },
  ]
}

Example for terraform_denied_providers

rule "terraform_denied_providers" {
  enabled = true

  providers = [
    {
      source  = "registry.terraform.io/hashicorp/null"
      version = "> 0"
    },
  ]
}

Thanks for considering!

[bendrucker]

I'd say this is a policy enforcement issue versus adherence to official Terraform recommendations.

I also wouldn't recommend static analysis (TFLint) as a means of doing this—tfprovidercheck is taking the right approach. The actual list of used providers is determined by the whole module tree, both root and children. By using the JSON mode of terraform version, it's getting the exact versions fetched by terraform init, which in turn handles resolving provider versions from the requirements in the module tree.

If you use static analysis, a deny rule can be trivially bypassed with a module block with any remote source (registry, git, etc.).