From 148227d5baa4a940ad4b99eb795cb22a5aa71408 Mon Sep 17 00:00:00 2001 From: Scott McDonald Date: Fri, 28 Aug 2026 17:51:22 +0000 Subject: [PATCH] fix(2-networking-a-fedramp): validate proxy_subnets and tenant subnets up front Two inputs the stage documents as optional are in fact required, and a plan that omits them dies with 'Invalid index' deep inside the module tree: - proxy_subnets defaults to {} but branch-net-envs.tf indexes it with each environment key when it creates the spoke's proxy-only subnet. - every environment needs a subnet under subnets[lower()] with a non-null tenant in regions.primary: connectivity-tests.tf, nva.tf and outputs.tf all take the first such subnet with [0] and index the spoke's subnet map with it. Add validation blocks on both variables (they may reference envs_folders and regions since Terraform 1.9, and the modules already require 1.10.2) so the plan fails immediately with a message that names the missing input, and say in the proxy_subnets description that one entry per environment is required. Signed-off-by: Scott McDonald --- .../stages-aw/2-networking-a-fedramp/variables.tf | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fast/stages-aw/2-networking-a-fedramp/variables.tf b/fast/stages-aw/2-networking-a-fedramp/variables.tf index d73ab21a9..6450f2b09 100644 --- a/fast/stages-aw/2-networking-a-fedramp/variables.tf +++ b/fast/stages-aw/2-networking-a-fedramp/variables.tf @@ -270,13 +270,26 @@ variable "subnets" { }))) default = {} nullable = false + validation { + condition = alltrue([ + for k in keys(var.envs_folders) : + try([for s in var.subnets[lower(k)] : s if s.tenant != null][0].region, null) == var.regions.primary + ]) + error_message = "Every environment in envs_folders needs a subnet list under subnets[lower()] whose first subnet with a non-null tenant is in regions.primary: the NVA landing routes, the connectivity-test addresses and the stage outputs all index that subnet." + } } variable "proxy_subnets" { - description = "VPC proxy-only subnet CIDRs keyed by environment." + description = "VPC proxy-only subnet CIDRs keyed by environment. One entry per key of envs_folders is required: every environment spoke gets a proxy-only subnet in regions.primary." type = map(string) default = {} nullable = false + validation { + condition = alltrue([ + for k in keys(var.envs_folders) : contains(keys(var.proxy_subnets), k) + ]) + error_message = "proxy_subnets needs an entry for every key of envs_folders (keys are case-sensitive and match envs_folders, not their lower-cased form): each environment spoke is created with a proxy-only subnet whose CIDR comes from this map." + } } variable "dns_policy_rules" {