terraform: validate count is non-negative

terraform/context.go

@@ -991,6 +991,23 @@ func (c *walkContext) validateWalkFn() depgraph.WalkFunc {
 
 			// If we're expanding, then expand the nodes, and then rewalk the graph
 			if rn.ExpandMode > ResourceExpandNone {
+				// Interpolate the count and verify it is non-negative
+				rc := NewResourceConfig(rn.Config.RawCount)
+				rc.interpolate(c)
+				count, err := rn.Config.Count()
+				if err == nil {
+					if count < 0 {
+						err = fmt.Errorf(
+							"%s error: count must be positive", rn.Resource.Id)
+					}
+				}
+				if err != nil {
+					l.Lock()
+					defer l.Unlock()
+					meta.Errs = append(meta.Errs, err)
+					return nil
+				}
+
 				return c.genericWalkResource(rn, walkFn)
 			}
 

terraform/context_test.go

@@ -107,6 +107,25 @@ func TestContextValidate_badVar(t *testing.T) {
 	}
 }
 
+func TestContextValidate_countNegative(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-count-negative")
+	c := testContext(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
 func TestContextValidate_moduleBadResource(t *testing.T) {
 	m := testModule(t, "validate-module-bad-rc")
 	p := testProvider("aws")

terraform/test-fixtures/validate-count-negative/main.tf

@@ -0,0 +1,3 @@
+resource "aws_instance" "test" {
+    count = "-5"
+}