What this command does in detail
validate checks a configuration against the rules the provider's schema defines, using only the files and the already-downloaded provider plugin — it never calls out to Azure's APIs. It catches things like: a required argument left out of a resource block, an argument that doesn't exist for that resource type (often from a typo, or a provider version upgrade that renamed something), a reference to a resource or variable that was never declared, or a value of the wrong type.
It's the fast, cheap check — it can run in a second or two, entirely offline, which is why this project runs it on every push and pull request, before anything slower like terraform plan is even attempted.
Where to run it from working directory
terraform -chdir=terraform validate terraform -chdir=terraform/bootstrap validate
Run separately for each of this project's two independent root modules — validating one tells you nothing about the other.
Precondition what must already be true
- terraform init must have already run successfully in this folder — validate needs the provider's schema, downloaded during init, to know what arguments each resource type accepts.
- A real backend connection is not required — init -backend=false is enough, which is exactly how this project's offline checks run it.
- No Azure login, subscription access, or real variable values (like the database password) are required just to validate the structure.
Postcondition what becomes true after it succeeds
- No changes to any file, state, or Azure resource — this command is read-only.
- Prints Success! The configuration is valid., or a list of specific errors, each pointing to the exact file and line responsible.
- A successful validate does not guarantee a later terraform plan or terraform apply will succeed — it only confirms the configuration is structurally sound, not that Azure will accept every value (a taken resource name, for example, can still fail later).
How this project uses it real examples
terraform -chdir=terraform init -backend=false -input=false -lockfile=readonly terraform -chdir=terraform validate terraform -chdir=terraform test terraform -chdir=terraform/bootstrap init -backend=false -input=false -lockfile=readonly terraform -chdir=terraform/bootstrap validate
This is this project's validate job: it runs on every push and pull request touching terraform/**, entirely without Azure credentials, so a broken configuration is caught immediately — long before anyone would try an actual apply.
Common errors and how to fix them
| What you see | Likely cause | How to fix it |
|---|---|---|
| “Could not load plugin” | terraform init hasn't been run in this folder yet. | Run terraform init (-backend=false is fine) first. |
| “Reference to undeclared resource” | A block references another resource's local name that doesn't exist — usually a typo. | Check the resource's actual local name (the second label in its resource block) and correct the reference. |
| “Missing required argument” | A resource block is missing an argument the provider requires. | Check the corresponding file's tutorial page for that resource, or the provider documentation, for the full list of required arguments. |
| “Unsupported argument” | An argument name is misspelled, or was renamed/removed by a provider version upgrade. | Compare against versions.tf's pinned provider version and its changelog. |
