Skip to content
Sarj Sarj Sarj Standards

no-environment-conditional

Warn when Terraform chooses behavior from deployment-identity comparisons; prefer explicit typed capabilities or values.

SARJ204 Rule source Tests Catalog JSON

Why

Hard-coded environment branches scatter deployment policy through expressions and obscure the actual capability or value that callers intend to vary.

Fix

Pass the selected typed value or one named capability from the root configuration. Retain an explicit validation, precondition, or check when environment identity is itself the safety invariant.

Examples

Before — flagged Cloud project identity names a deployment environment
main.tf
locals {
  tier = var.gcp_project_id == "platform-prod" ? "HA" : "BASIC"
}
After — preferred Business project identity has no deployment evidence
main.tf
locals {
  queue = var.project == "analytics" ? "events" : "default"
}
Before — flagged Resource gated on the environment name
sandbox.tf
resource "google_storage_bucket" "cache" {
  count = var.environment == "sandbox" ? 1 : 0
  name  = "cache"
}
After — preferred Resource gated on a named capability input
sandbox.tf
resource "google_storage_bucket" "cache" {
  count = var.enable_object_cache ? 1 : 0
  name  = "cache"
}
Before — flagged Code branches on a hard-coded environment label
main.tf
locals {
  redis_tier = var.environment == "prod" ? "STANDARD_HA" : "BASIC"
}
After — preferred Externally supplied map selects a value without hard-coded branches
main.tf
locals {
  redis_tier = var.redis_tiers_by_environment[var.environment]
}
Before — flagged Module input computed from the environment name
main.tf
module "iam" {
  source                             = "./iam"
  team_platform_owner_privilege      = var.environment == "dev"
  developer_secret_access_v2_enabled = var.environment == "dev"
}
After — preferred Module input passed through from tfvars
main.tf
module "iam" {
  source                             = "./iam"
  team_platform_owner_privilege      = var.team_platform_owner_privilege
  developer_secret_access_v2_enabled = var.developer_secret_access_v2_enabled
}