Terraform Provisioner JSON Format Validator

The Incident (What Does the Error Mean?)

You ran terraform apply and it died with:

Error: invalid JSON

  on main.tf line 34, in resource "aws_instance" "app":
  34:   inline = ["curl -X POST https://internal-api/config -d '{\"key\": \"value\"}'"]

Cannot parse JSON: invalid character '\'' looking for beginning of value

Or a variant:

Error: invalid JSON
json: cannot unmarshal string into Go value of type map[string]interface {}

Immediate consequence: terraform apply halts. If this provisioner was on a resource that was already created (e.g., the EC2 instance is UP), Terraform marks it as tainted. Next apply will destroy and recreate that resource. In production, that means downtime.

The Attack Vector / Blast Radius

This isn't just a cosmetic syntax error. The blast radius is real:

1. Tainted resource cascade. Terraform taints the resource on provisioner failure by default. A tainted aws_db_instance or aws_elasticache_cluster getting destroyed on next apply is a data-loss event, not a deployment inconvenience.

2. Partial state corruption. If the provisioner fires mid-apply after dependent resources are already created (security groups, IAM roles, ENIs), you now have orphaned cloud resources that Terraform's state no longer tracks cleanly.

3. Silent misconfiguration. The most dangerous variant: the JSON is structurally valid but semantically wrong because HCL interpolation silently inserted a null or wrong value. The API accepts it, returns 200, and your app runs with a broken config for hours before anyone notices.

4. CI/CD pipeline blast. In a GitOps pipeline, this error fails the apply stage, but the plan stage likely passed — meaning your PR checks gave a false green. Every engineer on the team assumes the config is valid.

Prevention in CI/CD

Fix this class of error permanently in your pipeline. One-time setup, zero recurring incidents.

1. `terraform validate` in Pre-Commit

# .pre-commit-config.yaml
- repo: https://github.com/antonbabenko/pre-commit-terraform
  rev: v1.83.0
  hooks:
    - id: terraform_validate
    - id: terraform_fmt

terraform validate catches most interpolation-induced JSON errors before they hit your pipeline.

2. TFLint with Deep Variable Checking

tflint --enable-plugin=aws
tflint --var-file=terraform.tfvars

TFLint resolves variables during linting and catches cases where a null variable would produce invalid JSON at apply time.

3. Checkov Policy — Ban Raw JSON Strings in Provisioners

# checkov custom check: no raw JSON strings in provisioner inline commands
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck

class NoRawJsonInProvisioner(BaseResourceCheck):
    def __init__(self):
        name = "Ensure provisioner inline commands do not contain raw JSON strings"
        id = "CKV_CUSTOM_TF_001"
        supported_resources = ["*"]
        super().__init__(name=name, id=id, categories=[], supported_resources=supported_resources)

    def scan_resource_conf(self, conf):
        provisioners = conf.get("provisioner", [])
        for p in provisioners:
            inline = p.get("remote-exec", [{}])[0].get("inline", [])
            for cmd in inline:
                if isinstance(cmd, list):
                    cmd = cmd[0]
                if '{"' in str(cmd) or "{'" in str(cmd):
                    return CheckResult.FAILED
        return CheckResult.PASSED

4. OPA/Conftest Policy — Enforce `jsonencode()` Usage

# policy/provisioner_json.rego
package terraform.provisioner

deny[msg] {
  resource := input.resource_changes[_]
  provisioner := resource.change.after.provisioner[_]
  inline_cmd := provisioner["remote-exec"].inline[_]
  contains(inline_cmd, "-d '{") # raw JSON in curl -d flag
  msg := sprintf(
    "Resource '%s' uses raw JSON in provisioner. Use jsonencode() and a local_file resource instead.",
    [resource.address]
  )
}

Run in CI:

terraform show -json plan.tfplan | conftest test -p policy/ -

5. Pipeline Gate Summary

# .github/workflows/terraform.yml (relevant steps)
- name: Terraform Format Check
  run: terraform fmt -check -recursive

- name: Terraform Validate
  run: terraform validate

- name: TFLint
  run: tflint --var-file=terraform.tfvars

- name: Checkov Scan
  run: checkov -d . --framework terraform --check CKV_CUSTOM_TF_001

- name: Conftest OPA Policy
  run: terraform show -json tfplan.binary | conftest test -p policy/ -

The rule: if jsonencode() isn't used for any dynamic JSON construction in a provisioner, the pipeline fails. No exceptions.