Terraform Variable Validation Boolean Fix

The Incident (What Does the Error Mean?)

Raw error emitted by terraform validate or terraform plan:

Error: Invalid validation condition

  on variables.tf line 8, in variable "instance_type":
   8:     condition = var.instance_type

The condition value is not a valid boolean. Terraform requires a boolean
true or false value for the condition in a validation block.

Immediate consequence: Terraform exits with a non-zero code. Every downstream stage — plan, apply, CI pipeline, Atlantis run, Spacelift job — is dead on arrival. No state is modified, but no infrastructure ships either. In a GitOps workflow, this blocks the entire merge queue.

The Attack Vector / Blast Radius

This is not a runtime error — it is a schema-level rejection. Terraform's type system evaluates condition at parse/validate time. The blast radius:

• All environments simultaneously. Because variables.tf is typically shared across dev, staging, and prod workspaces, every workspace using this module fails to plan.
• Module consumers are blocked. If this variable lives inside a reusable module published to a private registry, every team consuming that module version is broken until a patched version is released.
• Silent misconfiguration risk. The most dangerous variant is when the condition looks boolean but returns a string like "true" (a Terraform string type, not the boolean true). This passes local syntax checks but fails in strict validation, causing intermittent CI failures that are hard to bisect.
• can() misuse cascades. Engineers who wrap the entire condition in can() to silence the error without understanding the root cause create a condition that always returns true, effectively disabling the validation entirely — a silent security regression.

Prevention in CI/CD

Do not let this reach a human code review. Catch it at commit time.

1. `terraform validate` as a Pre-Commit Hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.88.0
    hooks:
      - id: terraform_validate
      - id: terraform_tflint

terraform validate will catch non-boolean conditions before the branch is pushed.

2. TFLint with the AWS/GCP Ruleset

# .tflint.hcl
plugin "terraform" {
  enabled = true
  version = "0.5.0"
  source  = "github.com/terraform-linters/tflint-ruleset-terraform"
}

rule "terraform_required_version" { enabled = true }
rule "terraform_typed_variables" { enabled = true }  # catches untyped vars that produce ambiguous condition types

3. Checkov Policy — Enforce Validation Blocks Exist

checkov -d . --check CKV_TF_1 --compact

For custom enforcement, add an OPA/Rego policy to your Conftest suite:

# policies/variable_validation.rego
package terraform.validation

deny[msg] {
  var := input.variable[name]
  validation := var.validation[_]
  # Flag if condition is a bare variable reference (no operator)
  validation.condition == concat("", ["var.", name])
  msg := sprintf("Variable '%s': condition is a bare variable reference, not a boolean expression.", [name])
}

conftest test --policy policies/ plan.json

4. GitHub Actions Gate

# .github/workflows/terraform-validate.yml
name: Terraform Validate
on: [pull_request]
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "~1.8"
      - run: terraform init -backend=false
      - run: terraform validate
        # Fails the PR if any condition is non-boolean

The rule: terraform validate must be a required status check on your default branch. No exceptions. A non-boolean condition in a shared module is a 30-second fix that becomes a 3-hour incident when it ships to a module registry consumed by 12 teams.