Why this matters
Strongly-typed, validated inputs prevent unsafe applies and secrets leakage.
All variables must declare a type, default (when sensible), and validation blocks; mark sensitive inputs with sensitive=true.
Strongly-typed, validated inputs prevent unsafe applies and secrets leakage.
Side-by-side examples engineers can pattern-match during review.
variable "instance_type" {}
variable "instance_type" {
type = string
validation {
condition = contains(["t3.medium","t3.large"], var.instance_type)
error_message = "instance_type must be an approved size."
}
}
variable "db_password" {
type = string
sensitive = true
}
variable "db_password" { type = string, sensitive = true }variable "db_password" {}From the same buckets as this rule.