Terraform Boolean Condition Expression Fix

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 5 mins

TL;DR

• What broke: A condition block inside a validation, precondition, or postcondition block is returning a non-boolean value — Terraform requires a strict true/false result, nothing else.
• How to fix it: Wrap the offending expression with a boolean-coercing function like can(), contains(), length(...) > 0, or a direct comparison operator so the expression evaluates to true or false.
• Fast path: Drop your failing .tf file into the Client-Side Sandbox above to auto-refactor the condition expression without sending your config anywhere.

Error: The condition expression must be boolean

  on main.tf line 12, in variable "instance_type":
  12:       condition = var.instance_type

The condition expression must return a boolean (true or false) value, not a string.

How to Fix It (The Solution)

Basic Fix — Direct Boolean Comparison

The most common cause: passing a variable or expression directly instead of evaluating it.

variable "instance_type" {
  type = string

  validation {
-   condition     = var.instance_type
+   condition     = contains(["t3.micro", "t3.small", "m5.large"], var.instance_type)
    error_message = "instance_type must be one of: t3.micro, t3.small, m5.large."
  }
}

Common Non-Boolean Patterns and Their Fixes

# Pattern 1: length() returns a number, not a boolean
- condition = length(var.allowed_cidrs)
+ condition = length(var.allowed_cidrs) > 0

# Pattern 2: regex() returns a string match, not a boolean
- condition = regex("^arn:aws:", var.role_arn)
+ condition = can(regex("^arn:aws:", var.role_arn))

# Pattern 3: try() returns the value, not a boolean
- condition = try(var.tags["Environment"], null)
+ condition = try(var.tags["Environment"], null) != null

# Pattern 4: lookup() returns a string
- condition = lookup(var.config, "enabled", "false")
+ condition = lookup(var.config, "enabled", "false") == "true"

Enterprise Best Practice — Precondition with `can()` and `alltrue()`

In complex modules, validate multiple constraints atomically. Use alltrue() to compose boolean checks and can() to safely probe expressions that might throw errors:

resource "aws_instance" "app" {
  ami           = var.ami_id
  instance_type = var.instance_type

  lifecycle {
    precondition {
-     condition     = var.ami_id && var.instance_type
+     condition     = alltrue([
+       can(regex("^ami-[0-9a-f]{8,17}$", var.ami_id)),
+       contains(["t3.micro", "t3.small", "m5.large"], var.instance_type)
+     ])
      error_message = "ami_id must be a valid AMI ID and instance_type must be an approved size."
    }
  }
}

Key functions for boolean-safe conditions:

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.83.5
    hooks:
      - id: terraform_validate

tflint --init
tflint --call-module-type=all

checkov -d . --framework terraform

# policy/condition_must_be_bool.rego
package terraform.validation

deny[msg] {
  block := input.resource.aws_instance[_].lifecycle[_].precondition[_]
  not is_boolean(block.condition)
  msg := sprintf("precondition condition must be a boolean expression, got: %v", [block.condition])
}