IaC · maintainability

←Previous Next→

no-dead-environment-input

Find undeclared tfvars assignments and potentially redundant scalar values across discovered Terraform environments.

SARJ205 Rule source Tests Catalog JSON

Why

Undeclared assignments are stale configuration, while repeated scalar values can hide whether a setting is truly environment-specific or belongs in shared configuration.

Fix

Remove assignments that have no parsed declaration. For repeated values, confirm the setting is not an intentional per-environment contract before moving it to a default or shared input source.

Examples

Before — flagged Assignment restating the variable's declared default

env/dev/terraform.tfvars

text_llm_enable_thinking = true

variables.tf

variable "text_llm_enable_thinking" {
  type    = bool
  default = true
}

After — preferred A sibling environment overrides the declared default

env/dev/terraform.tfvars

text_llm_enable_thinking = true

env/prod/terraform.tfvars

text_llm_enable_thinking = false

variables.tf

variable "text_llm_enable_thinking" {
  type    = bool
  default = true
}

Before — flagged Assignment surviving the deletion of its variable

env/dev/terraform.tfvars

region      = "me-central2"
gke_enabled = true

variables.tf

variable "region" {
  type = string
}

After — preferred Every tfvars assignment has a parsed root declaration

env/dev/terraform.tfvars

region      = "me-central2"
gke_enabled = true

variables.tf

variable "region" {
  type = string
}
variable "gke_enabled" {
  type = bool
}

Before — flagged Boolean assigned the same semantic value in every environment

env/dev/terraform.tfvars

pagerduty_enabled = false

env/prod/terraform.tfvars

pagerduty_enabled = false

variables.tf

variable "pagerduty_enabled" {
  type    = bool
  default = true
}

After — preferred Data input carrying a real per-environment difference

env/dev/terraform.tfvars

redis_tier = "BASIC"

env/prod/terraform.tfvars

redis_tier = "STANDARD_HA"

variables.tf

variable "redis_tier" {
  type = string
}

Before — flagged Sensitive input duplicated instead of injected once

env/dev/terraform.tfvars

api_token = "same-placeholder"

env/prod/terraform.tfvars

api_token = "same-placeholder"

variables.tf

variable "api_token" {
  type      = string
  sensitive = true
}

After — preferred Sensitive input carrying an actual environment decision

env/dev/terraform.tfvars

api_token = "dev-placeholder"

env/prod/terraform.tfvars

api_token = "prod-placeholder"

variables.tf

variable "api_token" {
  type      = string
  sensitive = true
}