From 81b8891b9077d6e8b4191634546208323b6d0bd2 Mon Sep 17 00:00:00 2001
From: Ben Drucker <bvdrucker@gmail.com>
Date: Wed, 6 May 2020 17:54:51 -0700
Subject: [PATCH] providers/terraform: don't call backend.Configure to validate
 terraform_remote_state

Validation is supposed to be a local-only operation, but Configure implementations
are allowed to make outgoing requests to remote APIs to validate settings.
---
 .../providers/terraform/data_source_state.go  | 29 +++++++++----------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/builtin/providers/terraform/data_source_state.go b/builtin/providers/terraform/data_source_state.go
index accc356df..d245954f4 100644
--- a/builtin/providers/terraform/data_source_state.go
+++ b/builtin/providers/terraform/data_source_state.go
@@ -48,7 +48,7 @@ func dataSourceRemoteStateValidate(cfg cty.Value) tfdiags.Diagnostics {
 	// Getting the backend implicitly validates the configuration for it,
 	// but we can only do that if it's all known already.
 	if cfg.GetAttr("config").IsWhollyKnown() && cfg.GetAttr("backend").IsKnown() {
-		_, moreDiags := getBackend(cfg)
+		_, _, moreDiags := getBackend(cfg)
 		diags = diags.Append(moreDiags)
 	} else {
 		// Otherwise we'll just type-check the config object itself.
@@ -81,9 +81,15 @@ func dataSourceRemoteStateValidate(cfg cty.Value) tfdiags.Diagnostics {
 func dataSourceRemoteStateRead(d cty.Value) (cty.Value, tfdiags.Diagnostics) {
 	var diags tfdiags.Diagnostics
 
-	b, moreDiags := getBackend(d)
+	b, cfg, moreDiags := getBackend(d)
 	diags = diags.Append(moreDiags)
-	if diags.HasErrors() {
+	if moreDiags.HasErrors() {
+		return cty.NilVal, diags
+	}
+
+	configureDiags := b.Configure(cfg)
+	if configureDiags.HasErrors() {
+		diags = diags.Append(configureDiags.Err())
 		return cty.NilVal, diags
 	}
 
@@ -152,7 +158,7 @@ func dataSourceRemoteStateRead(d cty.Value) (cty.Value, tfdiags.Diagnostics) {
 	return cty.ObjectVal(newState), diags
 }
 
-func getBackend(cfg cty.Value) (backend.Backend, tfdiags.Diagnostics) {
+func getBackend(cfg cty.Value) (backend.Backend, cty.Value, tfdiags.Diagnostics) {
 	var diags tfdiags.Diagnostics
 
 	backendType := cfg.GetAttr("backend").AsString()
@@ -173,7 +179,7 @@ func getBackend(cfg cty.Value) (backend.Backend, tfdiags.Diagnostics) {
 			fmt.Sprintf("There is no backend type named %q.", backendType),
 			cty.Path(nil).GetAttr("backend"),
 		))
-		return nil, diags
+		return nil, cty.NilVal, diags
 	}
 	b := f()
 
@@ -199,21 +205,14 @@ func getBackend(cfg cty.Value) (backend.Backend, tfdiags.Diagnostics) {
 				tfdiags.FormatError(err)),
 			cty.Path(nil).GetAttr("config"),
 		))
-		return nil, diags
+		return nil, cty.NilVal, diags
 	}
 
 	newVal, validateDiags := b.PrepareConfig(configVal)
 	diags = diags.Append(validateDiags)
 	if validateDiags.HasErrors() {
-		return nil, diags
-	}
-	configVal = newVal
-
-	configureDiags := b.Configure(configVal)
-	if configureDiags.HasErrors() {
-		diags = diags.Append(configureDiags.Err())
-		return nil, diags
+		return nil, cty.NilVal, diags
 	}
 
-	return b, diags
+	return b, newVal, diags
 }