Merge v0.12 development so far

The master branch is now tracking towards the v0.12 release.

.go-version

+1.11.1

CHANGELOG.md

+## 0.12.0 (Unreleased)
+
+INCOMPATIBILITIES AND NOTES:
+
+* `terraform validate` now has a smaller scope than before, focusing only on configuration syntax and value type checking. This makes it safe to run e.g. on save in a text editor.
+
+IMPROVEMENTS:
+
+* `terraform validate` now accepts an argument `-json` which produces machine-readable output. Please refer to the documentation for this command for details on the format and some caveats that consumers must consider when using this interface. [GH-17539]
+
 ## 0.11.9 (Unreleased)
 
 IMPROVEMENTS:

README.md

@@ -76,7 +76,9 @@ $ make plugin-dev PLUGIN=provider-test
 
 ### Dependencies
 
-Terraform stores its dependencies under `vendor/`, which [Go 1.6+ will automatically recognize and load](https://golang.org/cmd/go/#hdr-Vendor_Directories). We use [`govendor`](https://github.com/kardianos/govendor) to manage the vendored dependencies.
+Terraform uses Go Modules for dependency management, but for the moment is
+continuing to use Go 1.6-style vendoring for compatibility with tools that
+have not yet been updated for full Go Modules support.
 
 If you're developing Terraform, there are a few tasks you might need to perform.
 
@@ -88,17 +90,11 @@ To add a dependency:
 
 Assuming your work is on a branch called `my-feature-branch`, the steps look like this:
 
-1. Add the new package to your GOPATH:
+1. Add an `import` statement to a suitable package in the Terraform code.
 
-    ```bash
-    go get github.com/hashicorp/my-project
-    ```
-
-2.  Add the new package to your `vendor/` directory:
-
-    ```bash
-    govendor add github.com/hashicorp/my-project/package
-    ```
+2. Run `go mod vendor` to download the latest version of the module containing
+   the imported package into the `vendor/` directory, and update the `go.mod`
+   and `go.sum` files.
 
 3. Review the changes in git and commit them.
 
@@ -106,13 +102,11 @@ Assuming your work is on a branch called `my-feature-branch`, the steps look lik
 
 To update a dependency:
 
-1. Fetch the dependency:
+1. Run `go get -u module-path@version-number`, such as `go get -u github.com/hashicorp/hcl@2.0.0`
 
-    ```bash
-    govendor fetch github.com/hashicorp/my-project
-    ```
+2. Run `go mod vendor` to update the vendored copy in the `vendor/` directory.
 
-2. Review the changes in git and commit them.
+3. Review the changes in git and commit them.
 
 ### Acceptance Tests
 

addrs/count_attr.go

+package addrs
+
+// CountAttr is the address of an attribute of the "count" object in
+// the interpolation scope, like "count.index".
+type CountAttr struct {
+	referenceable
+	Name string
+}
+
+func (ca CountAttr) String() string {
+	return "count." + ca.Name
+}

addrs/doc.go

+// Package addrs contains types that represent "addresses", which are
+// references to specific objects within a Terraform configuration or
+// state.
+//
+// All addresses have string representations based on HCL traversal syntax
+// which should be used in the user-interface, and also in-memory
+// representations that can be used internally.
+//
+// For object types that exist within Terraform modules a pair of types is
+// used. The "local" part of the address is represented by a type, and then
+// an absolute path to that object in the context of its module is represented
+// by a type of the same name with an "Abs" prefix added, for "absolute".
+//
+// All types within this package should be treated as immutable, even if this
+// is not enforced by the Go compiler. It is always an implementation error
+// to modify an address object in-place after it is initially constructed.
+package addrs

addrs/input_variable.go

+package addrs
+
+import (
+	"fmt"
+)
+
+// InputVariable is the address of an input variable.
+type InputVariable struct {
+	referenceable
+	Name string
+}
+
+func (v InputVariable) String() string {
+	return "var." + v.Name
+}
+
+// AbsInputVariableInstance is the address of an input variable within a
+// particular module instance.
+type AbsInputVariableInstance struct {
+	Module   ModuleInstance
+	Variable InputVariable
+}
+
+// InputVariable returns the absolute address of the input variable of the
+// given name inside the receiving module instance.
+func (m ModuleInstance) InputVariable(name string) AbsInputVariableInstance {
+	return AbsInputVariableInstance{
+		Module: m,
+		Variable: InputVariable{
+			Name: name,
+		},
+	}
+}
+
+func (v AbsInputVariableInstance) String() string {
+	if len(v.Module) == 0 {
+		return v.String()
+	}
+
+	return fmt.Sprintf("%s.%s", v.Module.String(), v.Variable.String())
+}

addrs/instance_key.go

+package addrs
+
+import (
+	"fmt"
+
+	"github.com/zclconf/go-cty/cty"
+	"github.com/zclconf/go-cty/cty/gocty"
+)
+
+// InstanceKey represents the key of an instance within an object that
+// contains multiple instances due to using "count" or "for_each" arguments
+// in configuration.
+//
+// IntKey and StringKey are the two implementations of this type. No other
+// implementations are allowed. The single instance of an object that _isn't_
+// using "count" or "for_each" is represented by NoKey, which is a nil
+// InstanceKey.
+type InstanceKey interface {
+	instanceKeySigil()
+	String() string
+}
+
+// ParseInstanceKey returns the instance key corresponding to the given value,
+// which must be known and non-null.
+//
+// If an unknown or null value is provided then this function will panic. This
+// function is intended to deal with the values that would naturally be found
+// in a hcl.TraverseIndex, which (when parsed from source, at least) can never
+// contain unknown or null values.
+func ParseInstanceKey(key cty.Value) (InstanceKey, error) {
+	switch key.Type() {
+	case cty.String:
+		return StringKey(key.AsString()), nil
+	case cty.Number:
+		var idx int
+		err := gocty.FromCtyValue(key, &idx)
+		return IntKey(idx), err
+	default:
+		return NoKey, fmt.Errorf("either a string or an integer is required")
+	}
+}
+
+// NoKey represents the absense of an InstanceKey, for the single instance
+// of a configuration object that does not use "count" or "for_each" at all.
+var NoKey InstanceKey
+
+// IntKey is the InstanceKey representation representing integer indices, as
+// used when the "count" argument is specified or if for_each is used with
+// a sequence type.
+type IntKey int
+
+func (k IntKey) instanceKeySigil() {
+}
+
+func (k IntKey) String() string {
+	return fmt.Sprintf("[%d]", int(k))
+}
+
+// StringKey is the InstanceKey representation representing string indices, as
+// used when the "for_each" argument is specified with a map or object type.
+type StringKey string
+
+func (k StringKey) instanceKeySigil() {
+}
+
+func (k StringKey) String() string {
+	// FIXME: This isn't _quite_ right because Go's quoted string syntax is
+	// slightly different than HCL's, but we'll accept it for now.
+	return fmt.Sprintf("[%q]", string(k))
+}
+
+// InstanceKeyLess returns true if the first given instance key i should sort
+// before the second key j, and false otherwise.
+func InstanceKeyLess(i, j InstanceKey) bool {
+	iTy := instanceKeyType(i)
+	jTy := instanceKeyType(j)
+
+	switch {
+	case i == j:
+		return false
+	case i == NoKey:
+		return true
+	case j == NoKey:
+		return false
+	case iTy != jTy:
+		// The ordering here is arbitrary except that we want NoKeyType
+		// to sort before the others, so we'll just use the enum values
+		// of InstanceKeyType here (where NoKey is zero, sorting before
+		// any other).
+		return uint32(iTy) < uint32(jTy)
+	case iTy == IntKeyType:
+		return int(i.(IntKey)) < int(j.(IntKey))
+	case iTy == StringKeyType:
+		return string(i.(StringKey)) < string(j.(StringKey))
+	default:
+		// Shouldn't be possible to get down here in practice, since the
+		// above is exhaustive.
+		return false
+	}
+}
+
+func instanceKeyType(k InstanceKey) InstanceKeyType {
+	if _, ok := k.(StringKey); ok {
+		return StringKeyType
+	}
+	if _, ok := k.(IntKey); ok {
+		return IntKeyType
+	}
+	return NoKeyType
+}
+
+// InstanceKeyType represents the different types of instance key that are
+// supported. Usually it is sufficient to simply type-assert an InstanceKey
+// value to either IntKey or StringKey, but this type and its values can be
+// used to represent the types themselves, rather than specific values
+// of those types.
+type InstanceKeyType rune
+
+const (
+	NoKeyType     InstanceKeyType = 0
+	IntKeyType    InstanceKeyType = 'I'
+	StringKeyType InstanceKeyType = 'S'
+)

addrs/local_value.go

+package addrs
+
+import (
+	"fmt"
+)
+
+// LocalValue is the address of a local value.
+type LocalValue struct {
+	referenceable
+	Name string
+}
+
+func (v LocalValue) String() string {
+	return "local." + v.Name
+}
+
+// Absolute converts the receiver into an absolute address within the given
+// module instance.
+func (v LocalValue) Absolute(m ModuleInstance) AbsLocalValue {
+	return AbsLocalValue{
+		Module:     m,
+		LocalValue: v,
+	}
+}
+
+// AbsLocalValue is the absolute address of a local value within a module instance.
+type AbsLocalValue struct {
+	Module     ModuleInstance
+	LocalValue LocalValue
+}
+
+// LocalValue returns the absolute address of a local value of the given
+// name within the receiving module instance.
+func (m ModuleInstance) LocalValue(name string) AbsLocalValue {
+	return AbsLocalValue{
+		Module: m,
+		LocalValue: LocalValue{
+			Name: name,
+		},
+	}
+}
+
+func (v AbsLocalValue) String() string {
+	if len(v.Module) == 0 {
+		return v.LocalValue.String()
+	}
+	return fmt.Sprintf("%s.%s", v.Module.String(), v.LocalValue.String())
+}

addrs/module.go

+package addrs
+
+import (
+	"strings"
+)
+
+// Module is an address for a module call within configuration. This is
+// the static counterpart of ModuleInstance, representing a traversal through
+// the static module call tree in configuration and does not take into account
+// the potentially-multiple instances of a module that might be created by
+// "count" and "for_each" arguments within those calls.
+//
+// This type should be used only in very specialized cases when working with
+// the static module call tree. Type ModuleInstance is appropriate in more cases.
+//
+// Although Module is a slice, it should be treated as immutable after creation.
+type Module []string
+
+// RootModule is the module address representing the root of the static module
+// call tree, which is also the zero value of Module.
+//
+// Note that this is not the root of the dynamic module tree, which is instead
+// represented by RootModuleInstance.
+var RootModule Module
+
+// IsRoot returns true if the receiver is the address of the root module,
+// or false otherwise.
+func (m Module) IsRoot() bool {
+	return len(m) == 0
+}
+
+func (m Module) String() string {
+	if len(m) == 0 {
+		return ""
+	}
+	return strings.Join([]string(m), ".")
+}
+
+// Child returns the address of a child call in the receiver, identified by the
+// given name.
+func (m Module) Child(name string) Module {
+	ret := make(Module, 0, len(m)+1)
+	ret = append(ret, m...)
+	return append(ret, name)
+}
+
+// Parent returns the address of the parent module of the receiver, or the
+// receiver itself if there is no parent (if it's the root module address).
+func (m Module) Parent() Module {
+	if len(m) == 0 {
+		return m
+	}
+	return m[:len(m)-1]
+}
+
+// Call returns the module call address that corresponds to the given module
+// instance, along with the address of the module that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCall and then returns a slice of the receiever that excludes that
+// last part. This is just a convenience for situations where a call address
+// is required, such as when dealing with *Reference and Referencable values.
+func (m Module) Call() (Module, ModuleCall) {
+	if len(m) == 0 {
+		panic("cannot produce ModuleCall for root module")
+	}
+
+	caller, callName := m[:len(m)-1], m[len(m)-1]
+	return caller, ModuleCall{
+		Name: callName,
+	}
+}

addrs/module_call.go

+package addrs
+
+import (
+	"fmt"
+)
+
+// ModuleCall is the address of a call from the current module to a child
+// module.
+//
+// There is no "Abs" version of ModuleCall because an absolute module path
+// is represented by ModuleInstance.
+type ModuleCall struct {
+	referenceable
+	Name string
+}
+
+func (c ModuleCall) String() string {
+	return "module." + c.Name
+}
+
+// Instance returns the address of an instance of the receiver identified by
+// the given key.
+func (c ModuleCall) Instance(key InstanceKey) ModuleCallInstance {
+	return ModuleCallInstance{
+		Call: c,
+		Key:  key,
+	}
+}
+
+// ModuleCallInstance is the address of one instance of a module created from
+// a module call, which might create multiple instances using "count" or
+// "for_each" arguments.
+type ModuleCallInstance struct {
+	referenceable
+	Call ModuleCall
+	Key  InstanceKey
+}
+
+func (c ModuleCallInstance) String() string {
+	if c.Key == NoKey {
+		return c.Call.String()
+	}
+	return fmt.Sprintf("module.%s%s", c.Call.Name, c.Key)
+}
+
+// ModuleInstance returns the address of the module instance that corresponds
+// to the receiving call instance when resolved in the given calling module.
+// In other words, it returns the child module instance that the receving
+// call instance creates.
+func (c ModuleCallInstance) ModuleInstance(caller ModuleInstance) ModuleInstance {
+	return caller.Child(c.Call.Name, c.Key)
+}
+
+// Output returns the address of an output of the receiver identified by its
+// name.
+func (c ModuleCallInstance) Output(name string) ModuleCallOutput {
+	return ModuleCallOutput{
+		Call: c,
+		Name: name,
+	}
+}
+
+// ModuleCallOutput is the address of a particular named output produced by
+// an instance of a module call.
+type ModuleCallOutput struct {
+	referenceable
+	Call ModuleCallInstance
+	Name string
+}
+
+func (co ModuleCallOutput) String() string {
+	return fmt.Sprintf("%s.%s", co.Call.String(), co.Name)
+}
+
+// AbsOutputValue returns the absolute output value address that corresponds
+// to the receving module call output address, once resolved in the given
+// calling module.
+func (co ModuleCallOutput) AbsOutputValue(caller ModuleInstance) AbsOutputValue {
+	moduleAddr := co.Call.ModuleInstance(caller)
+	return moduleAddr.OutputValue(co.Name)
+}

addrs/module_instance.go

+package addrs
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/hashicorp/hcl2/hcl"
+	"github.com/hashicorp/hcl2/hcl/hclsyntax"
+	"github.com/zclconf/go-cty/cty"
+	"github.com/zclconf/go-cty/cty/gocty"
+
+	"github.com/hashicorp/terraform/tfdiags"
+)
+
+// ModuleInstance is an address for a particular module instance within the
+// dynamic module tree. This is an extension of the static traversals
+// represented by type Module that deals with the possibility of a single
+// module call producing multiple instances via the "count" and "for_each"
+// arguments.
+//
+// Although ModuleInstance is a slice, it should be treated as immutable after
+// creation.
+type ModuleInstance []ModuleInstanceStep
+
+var (
+	_ Targetable = ModuleInstance(nil)
+)
+
+func ParseModuleInstance(traversal hcl.Traversal) (ModuleInstance, tfdiags.Diagnostics) {
+	mi, remain, diags := parseModuleInstancePrefix(traversal)
+	if len(remain) != 0 {
+		if len(remain) == len(traversal) {
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid module instance address",
+				Detail:   "A module instance address must begin with \"module.\".",
+				Subject:  remain.SourceRange().Ptr(),
+			})
+		} else {
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid module instance address",
+				Detail:   "The module instance address is followed by additional invalid content.",
+				Subject:  remain.SourceRange().Ptr(),
+			})
+		}
+	}
+	return mi, diags
+}
+
+// ParseModuleInstanceStr is a helper wrapper around ParseModuleInstance
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseProviderConfigCompact.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// then the returned address is invalid.
+func ParseModuleInstanceStr(str string) (ModuleInstance, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+	diags = diags.Append(parseDiags)
+	if parseDiags.HasErrors() {
+		return nil, diags
+	}
+
+	addr, addrDiags := ParseModuleInstance(traversal)
+	diags = diags.Append(addrDiags)
+	return addr, diags
+}
+
+func parseModuleInstancePrefix(traversal hcl.Traversal) (ModuleInstance, hcl.Traversal, tfdiags.Diagnostics) {
+	remain := traversal
+	var mi ModuleInstance
+	var diags tfdiags.Diagnostics
+
+	for len(remain) > 0 {
+		var next string
+		switch tt := remain[0].(type) {
+		case hcl.TraverseRoot:
+			next = tt.Name
+		case hcl.TraverseAttr:
+			next = tt.Name
+		default:
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid address operator",
+				Detail:   "Module address prefix must be followed by dot and then a name.",
+				Subject:  remain[0].SourceRange().Ptr(),
+			})
+			break
+		}
+
+		if next != "module" {
+			break
+		}
+
+		kwRange := remain[0].SourceRange()
+		remain = remain[1:]
+		// If we have the prefix "module" then we should be followed by an
+		// module call name, as an attribute, and then optionally an index step
+		// giving the instance key.
+		if len(remain) == 0 {
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid address operator",
+				Detail:   "Prefix \"module.\" must be followed by a module name.",
+				Subject:  &kwRange,
+			})
+			break
+		}
+
+		var moduleName string
+		switch tt := remain[0].(type) {
+		case hcl.TraverseAttr:
+			moduleName = tt.Name
+		default:
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid address operator",
+				Detail:   "Prefix \"module.\" must be followed by a module name.",
+				Subject:  remain[0].SourceRange().Ptr(),
+			})
+			break
+		}
+		remain = remain[1:]
+		step := ModuleInstanceStep{
+			Name: moduleName,
+		}
+
+		if len(remain) > 0 {
+			if idx, ok := remain[0].(hcl.TraverseIndex); ok {
+				remain = remain[1:]
+
+				switch idx.Key.Type() {
+				case cty.String:
+					step.InstanceKey = StringKey(idx.Key.AsString())
+				case cty.Number:
+					var idxInt int
+					err := gocty.FromCtyValue(idx.Key, &idxInt)
+					if err == nil {
+						step.InstanceKey = IntKey(idxInt)
+					} else {
+						diags = diags.Append(&hcl.Diagnostic{
+							Severity: hcl.DiagError,
+							Summary:  "Invalid address operator",
+							Detail:   fmt.Sprintf("Invalid module index: %s.", err),
+							Subject:  idx.SourceRange().Ptr(),
+						})
+					}
+				default:
+					// Should never happen, because no other types are allowed in traversal indices.
+					diags = diags.Append(&hcl.Diagnostic{
+						Severity: hcl.DiagError,
+						Summary:  "Invalid address operator",
+						Detail:   "Invalid module key: must be either a string or an integer.",
+						Subject:  idx.SourceRange().Ptr(),
+					})
+				}
+			}
+		}
+
+		mi = append(mi, step)
+	}
+
+	var retRemain hcl.Traversal
+	if len(remain) > 0 {
+		retRemain = make(hcl.Traversal, len(remain))
+		copy(retRemain, remain)
+		// The first element here might be either a TraverseRoot or a
+		// TraverseAttr, depending on whether we had a module address on the
+		// front. To make life easier for callers, we'll normalize to always
+		// start with a TraverseRoot.
+		if tt, ok := retRemain[0].(hcl.TraverseAttr); ok {
+			retRemain[0] = hcl.TraverseRoot{
+				Name:     tt.Name,
+				SrcRange: tt.SrcRange,
+			}
+		}
+	}
+
+	return mi, retRemain, diags
+}
+
+// UnkeyedInstanceShim is a shim method for converting a Module address to the
+// equivalent ModuleInstance address that assumes that no modules have
+// keyed instances.
+//
+// This is a temporary allowance for the fact that Terraform does not presently
+// support "count" and "for_each" on modules, and thus graph building code that
+// derives graph nodes from configuration must just assume unkeyed modules
+// in order to construct the graph. At a later time when "count" and "for_each"
+// support is added for modules, all callers of this method will need to be
+// reworked to allow for keyed module instances.
+func (m Module) UnkeyedInstanceShim() ModuleInstance {
+	path := make(ModuleInstance, len(m))
+	for i, name := range m {
+		path[i] = ModuleInstanceStep{Name: name}
+	}
+	return path
+}
+
+// ModuleInstanceStep is a single traversal step through the dynamic module
+// tree. It is used only as part of ModuleInstance.
+type ModuleInstanceStep struct {
+	Name        string
+	InstanceKey InstanceKey
+}
+
+// RootModuleInstance is the module instance address representing the root
+// module, which is also the zero value of ModuleInstance.
+var RootModuleInstance ModuleInstance
+
+// IsRoot returns true if the receiver is the address of the root module instance,
+// or false otherwise.
+func (m ModuleInstance) IsRoot() bool {
+	return len(m) == 0
+}
+
+// Child returns the address of a child module instance of the receiver,
+// identified by the given name and key.
+func (m ModuleInstance) Child(name string, key InstanceKey) ModuleInstance {
+	ret := make(ModuleInstance, 0, len(m)+1)
+	ret = append(ret, m...)
+	return append(ret, ModuleInstanceStep{
+		Name:        name,
+		InstanceKey: key,
+	})
+}
+
+// Parent returns the address of the parent module instance of the receiver, or
+// the receiver itself if there is no parent (if it's the root module address).
+func (m ModuleInstance) Parent() ModuleInstance {
+	if len(m) == 0 {
+		return m
+	}
+	return m[:len(m)-1]
+}
+
+// String returns a string representation of the receiver, in the format used
+// within e.g. user-provided resource addresses.
+//
+// The address of the root module has the empty string as its representation.
+func (m ModuleInstance) String() string {
+	var buf bytes.Buffer
+	sep := ""
+	for _, step := range m {
+		buf.WriteString(sep)
+		buf.WriteString("module.")
+		buf.WriteString(step.Name)
+		if step.InstanceKey != NoKey {
+			buf.WriteString(step.InstanceKey.String())
+		}
+		sep = "."
+	}
+	return buf.String()
+}
+
+// Less returns true if the receiver should sort before the given other value
+// in a sorted list of addresses.
+func (m ModuleInstance) Less(o ModuleInstance) bool {
+	if len(m) != len(o) {
+		// Shorter path sorts first.
+		return len(m) < len(o)
+	}
+
+	for i := range m {
+		mS, oS := m[i], o[i]
+		switch {
+		case mS.Name != oS.Name:
+			return mS.Name < oS.Name
+		case mS.InstanceKey != oS.InstanceKey:
+			return InstanceKeyLess(mS.InstanceKey, oS.InstanceKey)
+		}
+	}
+
+	return false
+}
+
+// Ancestors returns a slice containing the receiver and all of its ancestor
+// module instances, all the way up to (and including) the root module.
+// The result is ordered by depth, with the root module always first.
+//
+// Since the result always includes the root module, a caller may choose to
+// ignore it by slicing the result with [1:].
+func (m ModuleInstance) Ancestors() []ModuleInstance {
+	ret := make([]ModuleInstance, 0, len(m)+1)
+	for i := 0; i <= len(m); i++ {
+		ret = append(ret, m[:i])
+	}
+	return ret
+}
+
+// Call returns the module call address that corresponds to the given module
+// instance, along with the address of the module instance that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// A single module call can produce potentially many module instances, so the
+// result discards any instance key that might be present on the last step
+// of the instance. To retain this, use CallInstance instead.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCall and then returns a slice of the receiever that excludes that
+// last part. This is just a convenience for situations where a call address
+// is required, such as when dealing with *Reference and Referencable values.
+func (m ModuleInstance) Call() (ModuleInstance, ModuleCall) {
+	if len(m) == 0 {
+		panic("cannot produce ModuleCall for root module")
+	}
+
+	inst, lastStep := m[:len(m)-1], m[len(m)-1]
+	return inst, ModuleCall{
+		Name: lastStep.Name,
+	}
+}
+
+// CallInstance returns the module call instance address that corresponds to
+// the given module instance, along with the address of the module instance
+// that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCallInstance and then returns a slice of the receiever that excludes
+// that last part. This is just a convenience for situations where a call\
+// address is required, such as when dealing with *Reference and Referencable
+// values.
+func (m ModuleInstance) CallInstance() (ModuleInstance, ModuleCallInstance) {
+	if len(m) == 0 {
+		panic("cannot produce ModuleCallInstance for root module")
+	}
+
+	inst, lastStep := m[:len(m)-1], m[len(m)-1]
+	return inst, ModuleCallInstance{
+		Call: ModuleCall{
+			Name: lastStep.Name,
+		},
+		Key: lastStep.InstanceKey,
+	}
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address either matches the receiver, is a sub-module-instance of the
+// receiver, or is a targetable absolute address within a module that
+// is contained within the reciever.
+func (m ModuleInstance) TargetContains(other Targetable) bool {
+	switch to := other.(type) {
+
+	case ModuleInstance:
+		if len(to) < len(m) {
+			// Can't be contained if the path is shorter
+			return false
+		}
+		// Other is contained if its steps match for the length of our own path.
+		for i, ourStep := range m {
+			otherStep := to[i]
+			if ourStep != otherStep {
+				return false
+			}
+		}
+		// If we fall out here then the prefixed matched, so it's contained.
+		return true
+
+	case AbsResource:
+		return m.TargetContains(to.Module)
+
+	case AbsResourceInstance:
+		return m.TargetContains(to.Module)
+
+	default:
+		return false
+	}
+}
+
+func (m ModuleInstance) targetableSigil() {
+	// ModuleInstance is targetable
+}

addrs/output_value.go

+package addrs
+
+import (
+	"fmt"
+)
+
+// OutputValue is the address of an output value, in the context of the module
+// that is defining it.
+//
+// This is related to but separate from ModuleCallOutput, which represents
+// a module output from the perspective of its parent module. Since output
+// values cannot be represented from the module where they are defined,
+// OutputValue is not Referenceable, while ModuleCallOutput is.
+type OutputValue struct {
+	Name string
+}
+
+func (v OutputValue) String() string {
+	return "output." + v.Name
+}
+
+// Absolute converts the receiver into an absolute address within the given
+// module instance.
+func (v OutputValue) Absolute(m ModuleInstance) AbsOutputValue {
+	return AbsOutputValue{
+		Module:      m,
+		OutputValue: v,
+	}
+}
+
+// AbsOutputValue is the absolute address of an output value within a module instance.
+//
+// This represents an output globally within the namespace of a particular
+// configuration. It is related to but separate from ModuleCallOutput, which
+// represents a module output from the perspective of its parent module.
+type AbsOutputValue struct {
+	Module      ModuleInstance
+	OutputValue OutputValue
+}
+
+// OutputValue returns the absolute address of an output value of the given
+// name within the receiving module instance.
+func (m ModuleInstance) OutputValue(name string) AbsOutputValue {
+	return AbsOutputValue{
+		Module: m,
+		OutputValue: OutputValue{
+			Name: name,
+		},
+	}
+}
+
+func (v AbsOutputValue) String() string {
+	if v.Module.IsRoot() {
+		return v.OutputValue.String()
+	}
+	return fmt.Sprintf("%s.%s", v.Module.String(), v.OutputValue.String())
+}
+
+// ModuleCallOutput converts an AbsModuleOutput into a ModuleCallOutput,
+// returning also the module instance that the ModuleCallOutput is relative
+// to.
+//
+// The root module does not have a call, and so this method cannot be used
+// with outputs in the root module, and will panic in that case.
+func (v AbsOutputValue) ModuleCallOutput() (ModuleInstance, ModuleCallOutput) {
+	if v.Module.IsRoot() {
+		panic("ReferenceFromCall used with root module output")
+	}
+
+	caller, call := v.Module.CallInstance()
+	return caller, ModuleCallOutput{
+		Call: call,
+		Name: v.OutputValue.Name,
+	}
+}

addrs/parse_ref.go

+package addrs
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/hcl2/hcl"
+	"github.com/hashicorp/hcl2/hcl/hclsyntax"
+	"github.com/hashicorp/terraform/tfdiags"
+)
+
+// Reference describes a reference to an address with source location
+// information.
+type Reference struct {
+	Subject     Referenceable
+	SourceRange tfdiags.SourceRange
+	Remaining   hcl.Traversal
+}
+
+// ParseRef attempts to extract a referencable address from the prefix of the
+// given traversal, which must be an absolute traversal or this function
+// will panic.
+//
+// If no error diagnostics are returned, the returned reference includes the
+// address that was extracted, the source range it was extracted from, and any
+// remaining relative traversal that was not consumed as part of the
+// reference.
+//
+// If error diagnostics are returned then the Reference value is invalid and
+// must not be used.
+func ParseRef(traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+	ref, diags := parseRef(traversal)
+
+	// Normalize a little to make life easier for callers.
+	if ref != nil {
+		if len(ref.Remaining) == 0 {
+			ref.Remaining = nil
+		}
+	}
+
+	return ref, diags
+}
+
+// ParseRefStr is a helper wrapper around ParseRef that takes a string
+// and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseRef.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned reference may be nil or incomplete.
+func ParseRefStr(str string) (*Reference, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+	diags = diags.Append(parseDiags)
+	if parseDiags.HasErrors() {
+		return nil, diags
+	}
+
+	ref, targetDiags := ParseRef(traversal)
+	diags = diags.Append(targetDiags)
+	return ref, diags
+}
+
+func parseRef(traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	root := traversal.RootName()
+	rootRange := traversal[0].SourceRange()
+
+	switch root {
+
+	case "count":
+		name, rng, remain, diags := parseSingleAttrRef(traversal)
+		return &Reference{
+			Subject:     CountAttr{Name: name},
+			SourceRange: tfdiags.SourceRangeFromHCL(rng),
+			Remaining:   remain,
+		}, diags
+
+	case "data":
+		if len(traversal) < 3 {
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid reference",
+				Detail:   `The "data" object must be followed by two attribute names: the data source type and the resource name.`,
+				Subject:  traversal.SourceRange().Ptr(),
+			})
+			return nil, diags
+		}
+		remain := traversal[1:] // trim off "data" so we can use our shared resource reference parser
+		return parseResourceRef(DataResourceMode, rootRange, remain)
+
+	case "local":
+		name, rng, remain, diags := parseSingleAttrRef(traversal)
+		return &Reference{
+			Subject:     LocalValue{Name: name},
+			SourceRange: tfdiags.SourceRangeFromHCL(rng),
+			Remaining:   remain,
+		}, diags
+
+	case "module":
+		callName, callRange, remain, diags := parseSingleAttrRef(traversal)
+		if diags.HasErrors() {
+			return nil, diags
+		}
+
+		// A traversal starting with "module" can either be a reference to
+		// an entire module instance or to a single output from a module
+		// instance, depending on what we find after this introducer.
+
+		callInstance := ModuleCallInstance{
+			Call: ModuleCall{
+				Name: callName,
+			},
+			Key: NoKey,
+		}
+
+		if len(remain) == 0 {
+			// Reference to an entire module instance. Might alternatively
+			// be a reference to a collection of instances of a particular
+			// module, but the caller will need to deal with that ambiguity
+			// since we don't have enough context here.
+			return &Reference{
+				Subject:     callInstance,
+				SourceRange: tfdiags.SourceRangeFromHCL(callRange),
+				Remaining:   remain,
+			}, diags
+		}
+
+		if idxTrav, ok := remain[0].(hcl.TraverseIndex); ok {
+			var err error
+			callInstance.Key, err = ParseInstanceKey(idxTrav.Key)
+			if err != nil {
+				diags = diags.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Invalid index key",
+					Detail:   fmt.Sprintf("Invalid index for module instance: %s.", err),
+					Subject:  &idxTrav.SrcRange,
+				})
+				return nil, diags
+			}
+			remain = remain[1:]
+
+			if len(remain) == 0 {
+				// Also a reference to an entire module instance, but we have a key
+				// now.
+				return &Reference{
+					Subject:     callInstance,
+					SourceRange: tfdiags.SourceRangeFromHCL(hcl.RangeBetween(callRange, idxTrav.SrcRange)),
+					Remaining:   remain,
+				}, diags
+			}
+		}
+
+		if attrTrav, ok := remain[0].(hcl.TraverseAttr); ok {
+			remain = remain[1:]
+			return &Reference{
+				Subject: ModuleCallOutput{
+					Name: attrTrav.Name,
+					Call: callInstance,
+				},
+				SourceRange: tfdiags.SourceRangeFromHCL(hcl.RangeBetween(callRange, attrTrav.SrcRange)),
+				Remaining:   remain,
+			}, diags
+		}
+
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid reference",
+			Detail:   "Module instance objects do not support this operation.",
+			Subject:  remain[0].SourceRange().Ptr(),
+		})
+		return nil, diags
+
+	case "path":
+		name, rng, remain, diags := parseSingleAttrRef(traversal)
+		return &Reference{
+			Subject:     PathAttr{Name: name},
+			SourceRange: tfdiags.SourceRangeFromHCL(rng),
+			Remaining:   remain,
+		}, diags
+
+	case "self":
+		return &Reference{
+			Subject:     Self,
+			SourceRange: tfdiags.SourceRangeFromHCL(rootRange),
+			Remaining:   traversal[1:],
+		}, diags
+
+	case "terraform":
+		name, rng, remain, diags := parseSingleAttrRef(traversal)
+		return &Reference{
+			Subject:     TerraformAttr{Name: name},
+			SourceRange: tfdiags.SourceRangeFromHCL(rng),
+			Remaining:   remain,
+		}, diags
+
+	case "var":
+		name, rng, remain, diags := parseSingleAttrRef(traversal)
+		return &Reference{
+			Subject:     InputVariable{Name: name},
+			SourceRange: tfdiags.SourceRangeFromHCL(rng),
+			Remaining:   remain,
+		}, diags
+
+	default:
+		return parseResourceRef(ManagedResourceMode, rootRange, traversal)
+	}
+}
+
+func parseResourceRef(mode ResourceMode, startRange hcl.Range, traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	if len(traversal) < 2 {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid reference",
+			Detail:   `A reference to a resource type must be followed by at least one attribute access, specifying the resource name.`,
+			Subject:  hcl.RangeBetween(traversal[0].SourceRange(), traversal[len(traversal)-1].SourceRange()).Ptr(),
+		})
+		return nil, diags
+	}
+
+	var typeName, name string
+	switch tt := traversal[0].(type) { // Could be either root or attr, depending on our resource mode
+	case hcl.TraverseRoot:
+		typeName = tt.Name
+	case hcl.TraverseAttr:
+		typeName = tt.Name
+	default:
+		// If it isn't a TraverseRoot then it must be a "data" reference.
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid reference",
+			Detail:   `The "data" object does not support this operation.`,
+			Subject:  traversal[0].SourceRange().Ptr(),
+		})
+		return nil, diags
+	}
+
+	attrTrav, ok := traversal[1].(hcl.TraverseAttr)
+	if !ok {
+		var what string
+		switch mode {
+		case DataResourceMode:
+			what = "data source"
+		default:
+			what = "resource type"
+		}
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid reference",
+			Detail:   fmt.Sprintf(`A reference to a %s must be followed by at least one attribute access, specifying the resource name.`, what),
+			Subject:  traversal[1].SourceRange().Ptr(),
+		})
+		return nil, diags
+	}
+	name = attrTrav.Name
+	rng := hcl.RangeBetween(startRange, attrTrav.SrcRange)
+	remain := traversal[2:]
+
+	resourceAddr := Resource{
+		Mode: mode,
+		Type: typeName,
+		Name: name,
+	}
+	resourceInstAddr := ResourceInstance{
+		Resource: resourceAddr,
+		Key:      NoKey,
+	}
+
+	if len(remain) == 0 {
+		// This might actually be a reference to the collection of all instances
+		// of the resource, but we don't have enough context here to decide
+		// so we'll let the caller resolve that ambiguity.
+		return &Reference{
+			Subject:     resourceInstAddr,
+			SourceRange: tfdiags.SourceRangeFromHCL(rng),
+		}, diags
+	}
+
+	if idxTrav, ok := remain[0].(hcl.TraverseIndex); ok {
+		var err error
+		resourceInstAddr.Key, err = ParseInstanceKey(idxTrav.Key)
+		if err != nil {
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid index key",
+				Detail:   fmt.Sprintf("Invalid index for resource instance: %s.", err),
+				Subject:  &idxTrav.SrcRange,
+			})
+			return nil, diags
+		}
+		remain = remain[1:]
+		rng = hcl.RangeBetween(rng, idxTrav.SrcRange)
+	}
+
+	return &Reference{
+		Subject:     resourceInstAddr,
+		SourceRange: tfdiags.SourceRangeFromHCL(rng),
+		Remaining:   remain,
+	}, diags
+}
+
+func parseSingleAttrRef(traversal hcl.Traversal) (string, hcl.Range, hcl.Traversal, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	root := traversal.RootName()
+	rootRange := traversal[0].SourceRange()
+
+	if len(traversal) < 2 {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid reference",
+			Detail:   fmt.Sprintf("The %q object cannot be accessed directly. Instead, access one of its attributes.", root),
+			Subject:  &rootRange,
+		})
+		return "", hcl.Range{}, nil, diags
+	}
+	if attrTrav, ok := traversal[1].(hcl.TraverseAttr); ok {
+		return attrTrav.Name, hcl.RangeBetween(rootRange, attrTrav.SrcRange), traversal[2:], diags
+	}
+	diags = diags.Append(&hcl.Diagnostic{
+		Severity: hcl.DiagError,
+		Summary:  "Invalid reference",
+		Detail:   fmt.Sprintf("The %q object does not support this operation.", root),
+		Subject:  traversal[1].SourceRange().Ptr(),
+	})
+	return "", hcl.Range{}, nil, diags
+}

addrs/parse_ref_test.go

+package addrs
+
+import (
+	"testing"
+
+	"github.com/go-test/deep"
+	"github.com/hashicorp/hcl2/hcl"
+	"github.com/hashicorp/hcl2/hcl/hclsyntax"
+	"github.com/hashicorp/terraform/tfdiags"
+	"github.com/zclconf/go-cty/cty"
+)
+
+func TestParseRef(t *testing.T) {
+	tests := []struct {
+		Input   string
+		Want    *Reference
+		WantErr string
+	}{
+
+		// count
+		{
+			`count.index`,
+			&Reference{
+				Subject: CountAttr{
+					Name: "index",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 12, Byte: 11},
+				},
+			},
+			``,
+		},
+		{
+			`count.index.blah`,
+			&Reference{
+				Subject: CountAttr{
+					Name: "index",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 12, Byte: 11},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "blah",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 12, Byte: 11},
+							End:   hcl.Pos{Line: 1, Column: 17, Byte: 16},
+						},
+					},
+				},
+			},
+			``, // valid at this layer, but will fail during eval because "index" is a number
+		},
+		{
+			`count`,
+			nil,
+			`The "count" object cannot be accessed directly. Instead, access one of its attributes.`,
+		},
+		{
+			`count["hello"]`,
+			nil,
+			`The "count" object does not support this operation.`,
+		},
+
+		// data
+		{
+			`data.external.foo`,
+			&Reference{
+				Subject: ResourceInstance{
+					Resource: Resource{
+						Mode: DataResourceMode,
+						Type: "external",
+						Name: "foo",
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 18, Byte: 17},
+				},
+			},
+			``,
+		},
+		{
+			`data.external.foo.bar`,
+			&Reference{
+				Subject: ResourceInstance{
+					Resource: Resource{
+						Mode: DataResourceMode,
+						Type: "external",
+						Name: "foo",
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 18, Byte: 17},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "bar",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 18, Byte: 17},
+							End:   hcl.Pos{Line: 1, Column: 22, Byte: 21},
+						},
+					},
+				},
+			},
+			``,
+		},
+		{
+			`data.external.foo["baz"].bar`,
+			&Reference{
+				Subject: ResourceInstance{
+					Resource: Resource{
+						Mode: DataResourceMode,
+						Type: "external",
+						Name: "foo",
+					},
+					Key: StringKey("baz"),
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 25, Byte: 24},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "bar",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 25, Byte: 24},
+							End:   hcl.Pos{Line: 1, Column: 29, Byte: 28},
+						},
+					},
+				},
+			},
+			``,
+		},
+		{
+			`data.external.foo["baz"]`,
+			&Reference{
+				Subject: ResourceInstance{
+					Resource: Resource{
+						Mode: DataResourceMode,
+						Type: "external",
+						Name: "foo",
+					},
+					Key: StringKey("baz"),
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 25, Byte: 24},
+				},
+			},
+			``,
+		},
+		{
+			`data`,
+			nil,
+			`The "data" object must be followed by two attribute names: the data source type and the resource name.`,
+		},
+		{
+			`data.external`,
+			nil,
+			`The "data" object must be followed by two attribute names: the data source type and the resource name.`,
+		},
+
+		// local
+		{
+			`local.foo`,
+			&Reference{
+				Subject: LocalValue{
+					Name: "foo",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 10, Byte: 9},
+				},
+			},
+			``,
+		},
+		{
+			`local.foo.blah`,
+			&Reference{
+				Subject: LocalValue{
+					Name: "foo",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 10, Byte: 9},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "blah",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 10, Byte: 9},
+							End:   hcl.Pos{Line: 1, Column: 15, Byte: 14},
+						},
+					},
+				},
+			},
+			``,
+		},
+		{
+			`local.foo["blah"]`,
+			&Reference{
+				Subject: LocalValue{
+					Name: "foo",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 10, Byte: 9},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseIndex{
+						Key: cty.StringVal("blah"),
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 10, Byte: 9},
+							End:   hcl.Pos{Line: 1, Column: 18, Byte: 17},
+						},
+					},
+				},
+			},
+			``,
+		},
+		{
+			`local`,
+			nil,
+			`The "local" object cannot be accessed directly. Instead, access one of its attributes.`,
+		},
+		{
+			`local["foo"]`,
+			nil,
+			`The "local" object does not support this operation.`,
+		},
+
+		// module
+		{
+			`module.foo`,
+			&Reference{
+				Subject: ModuleCallInstance{
+					Call: ModuleCall{
+						Name: "foo",
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 11, Byte: 10},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo.bar`,
+			&Reference{
+				Subject: ModuleCallOutput{
+					Call: ModuleCallInstance{
+						Call: ModuleCall{
+							Name: "foo",
+						},
+					},
+					Name: "bar",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 15, Byte: 14},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo.bar.baz`,
+			&Reference{
+				Subject: ModuleCallOutput{
+					Call: ModuleCallInstance{
+						Call: ModuleCall{
+							Name: "foo",
+						},
+					},
+					Name: "bar",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 15, Byte: 14},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "baz",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 15, Byte: 14},
+							End:   hcl.Pos{Line: 1, Column: 19, Byte: 18},
+						},
+					},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo["baz"]`,
+			&Reference{
+				Subject: ModuleCallInstance{
+					Call: ModuleCall{
+						Name: "foo",
+					},
+					Key: StringKey("baz"),
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 18, Byte: 17},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo["baz"].bar`,
+			&Reference{
+				Subject: ModuleCallOutput{
+					Call: ModuleCallInstance{
+						Call: ModuleCall{
+							Name: "foo",
+						},
+						Key: StringKey("baz"),
+					},
+					Name: "bar",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 22, Byte: 21},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo["baz"].bar.boop`,
+			&Reference{
+				Subject: ModuleCallOutput{
+					Call: ModuleCallInstance{
+						Call: ModuleCall{
+							Name: "foo",
+						},
+						Key: StringKey("baz"),
+					},
+					Name: "bar",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 22, Byte: 21},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "boop",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 22, Byte: 21},
+							End:   hcl.Pos{Line: 1, Column: 27, Byte: 26},
+						},
+					},
+				},
+			},
+			``,
+		},
+		{
+			`module`,
+			nil,
+			`The "module" object cannot be accessed directly. Instead, access one of its attributes.`,
+		},
+		{
+			`module["foo"]`,
+			nil,
+			`The "module" object does not support this operation.`,
+		},
+
+		// path
+		{
+			`path.module`,
+			&Reference{
+				Subject: PathAttr{
+					Name: "module",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 12, Byte: 11},
+				},
+			},
+			``,
+		},
+		{
+			`path.module.blah`,
+			&Reference{
+				Subject: PathAttr{
+					Name: "module",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 12, Byte: 11},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "blah",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 12, Byte: 11},
+							End:   hcl.Pos{Line: 1, Column: 17, Byte: 16},
+						},
+					},
+				},
+			},
+			``, // valid at this layer, but will fail during eval because "module" is a string
+		},
+		{
+			`path`,
+			nil,
+			`The "path" object cannot be accessed directly. Instead, access one of its attributes.`,
+		},
+		{
+			`path["module"]`,
+			nil,
+			`The "path" object does not support this operation.`,
+		},
+
+		// self
+		{
+			`self`,
+			&Reference{
+				Subject: Self,
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 5, Byte: 4},
+				},
+			},
+			``,
+		},
+		{
+			`self.blah`,
+			&Reference{
+				Subject: Self,
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 5, Byte: 4},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "blah",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 5, Byte: 4},
+							End:   hcl.Pos{Line: 1, Column: 10, Byte: 9},
+						},
+					},
+				},
+			},
+			``,
+		},
+
+		// terraform
+		{
+			`terraform.workspace`,
+			&Reference{
+				Subject: TerraformAttr{
+					Name: "workspace",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 20, Byte: 19},
+				},
+			},
+			``,
+		},
+		{
+			`terraform.workspace.blah`,
+			&Reference{
+				Subject: TerraformAttr{
+					Name: "workspace",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 20, Byte: 19},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "blah",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 20, Byte: 19},
+							End:   hcl.Pos{Line: 1, Column: 25, Byte: 24},
+						},
+					},
+				},
+			},
+			``, // valid at this layer, but will fail during eval because "workspace" is a string
+		},
+		{
+			`terraform`,
+			nil,
+			`The "terraform" object cannot be accessed directly. Instead, access one of its attributes.`,
+		},
+		{
+			`terraform["workspace"]`,
+			nil,
+			`The "terraform" object does not support this operation.`,
+		},
+
+		// var
+		{
+			`var.foo`,
+			&Reference{
+				Subject: InputVariable{
+					Name: "foo",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 8, Byte: 7},
+				},
+			},
+			``,
+		},
+		{
+			`var.foo.blah`,
+			&Reference{
+				Subject: InputVariable{
+					Name: "foo",
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 8, Byte: 7},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "blah",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 8, Byte: 7},
+							End:   hcl.Pos{Line: 1, Column: 13, Byte: 12},
+						},
+					},
+				},
+			},
+			``, // valid at this layer, but will fail during eval because "module" is a string
+		},
+		{
+			`var`,
+			nil,
+			`The "var" object cannot be accessed directly. Instead, access one of its attributes.`,
+		},
+		{
+			`var["foo"]`,
+			nil,
+			`The "var" object does not support this operation.`,
+		},
+
+		// anything else, interpreted as a managed resource reference
+		{
+			`boop_instance.foo`,
+			&Reference{
+				Subject: ResourceInstance{
+					Resource: Resource{
+						Mode: ManagedResourceMode,
+						Type: "boop_instance",
+						Name: "foo",
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 18, Byte: 17},
+				},
+			},
+			``,
+		},
+		{
+			`boop_instance.foo.bar`,
+			&Reference{
+				Subject: ResourceInstance{
+					Resource: Resource{
+						Mode: ManagedResourceMode,
+						Type: "boop_instance",
+						Name: "foo",
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 18, Byte: 17},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "bar",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 18, Byte: 17},
+							End:   hcl.Pos{Line: 1, Column: 22, Byte: 21},
+						},
+					},
+				},
+			},
+			``,
+		},
+		{
+			`boop_instance.foo["baz"].bar`,
+			&Reference{
+				Subject: ResourceInstance{
+					Resource: Resource{
+						Mode: ManagedResourceMode,
+						Type: "boop_instance",
+						Name: "foo",
+					},
+					Key: StringKey("baz"),
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 25, Byte: 24},
+				},
+				Remaining: hcl.Traversal{
+					hcl.TraverseAttr{
+						Name: "bar",
+						SrcRange: hcl.Range{
+							Start: hcl.Pos{Line: 1, Column: 25, Byte: 24},
+							End:   hcl.Pos{Line: 1, Column: 29, Byte: 28},
+						},
+					},
+				},
+			},
+			``,
+		},
+		{
+			`boop_instance.foo["baz"]`,
+			&Reference{
+				Subject: ResourceInstance{
+					Resource: Resource{
+						Mode: ManagedResourceMode,
+						Type: "boop_instance",
+						Name: "foo",
+					},
+					Key: StringKey("baz"),
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 25, Byte: 24},
+				},
+			},
+			``,
+		},
+		{
+			`boop_instance`,
+			nil,
+			`A reference to a resource type must be followed by at least one attribute access, specifying the resource name.`,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Input, func(t *testing.T) {
+			traversal, travDiags := hclsyntax.ParseTraversalAbs([]byte(test.Input), "", hcl.Pos{Line: 1, Column: 1})
+			if travDiags.HasErrors() {
+				t.Fatal(travDiags.Error())
+			}
+
+			got, diags := ParseRef(traversal)
+
+			switch len(diags) {
+			case 0:
+				if test.WantErr != "" {
+					t.Fatalf("succeeded; want error: %s", test.WantErr)
+				}
+			case 1:
+				if test.WantErr == "" {
+					t.Fatalf("unexpected diagnostics: %s", diags.Err())
+				}
+				if got, want := diags[0].Description().Detail, test.WantErr; got != want {
+					t.Fatalf("wrong error\ngot:  %s\nwant: %s", got, want)
+				}
+			default:
+				t.Fatalf("too many diagnostics: %s", diags.Err())
+			}
+
+			if diags.HasErrors() {
+				return
+			}
+
+			for _, problem := range deep.Equal(got, test.Want) {
+				t.Errorf(problem)
+			}
+		})
+	}
+}

addrs/parse_target.go

+package addrs
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+	"github.com/hashicorp/hcl2/hcl"
+	"github.com/hashicorp/terraform/tfdiags"
+)
+
+// Target describes a targeted address with source location information.
+type Target struct {
+	Subject     Targetable
+	SourceRange tfdiags.SourceRange
+}
+
+// ParseTarget attempts to interpret the given traversal as a targetable
+// address. The given traversal must be absolute, or this function will
+// panic.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the Target value is invalid and
+// must not be used.
+func ParseTarget(traversal hcl.Traversal) (*Target, tfdiags.Diagnostics) {
+	path, remain, diags := parseModuleInstancePrefix(traversal)
+	if diags.HasErrors() {
+		return nil, diags
+	}
+
+	rng := tfdiags.SourceRangeFromHCL(traversal.SourceRange())
+
+	if len(remain) == 0 {
+		return &Target{
+			Subject:     path,
+			SourceRange: rng,
+		}, diags
+	}
+
+	mode := ManagedResourceMode
+	if remain.RootName() == "data" {
+		mode = DataResourceMode
+		remain = remain[1:]
+	}
+
+	if len(remain) < 2 {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid address",
+			Detail:   "Resource specification must include a resource type and name.",
+			Subject:  remain.SourceRange().Ptr(),
+		})
+		return nil, diags
+	}
+
+	var typeName, name string
+	switch tt := remain[0].(type) {
+	case hcl.TraverseRoot:
+		typeName = tt.Name
+	case hcl.TraverseAttr:
+		typeName = tt.Name
+	default:
+		switch mode {
+		case ManagedResourceMode:
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid address",
+				Detail:   "A resource type name is required.",
+				Subject:  remain[0].SourceRange().Ptr(),
+			})
+		case DataResourceMode:
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid address",
+				Detail:   "A data source name is required.",
+				Subject:  remain[0].SourceRange().Ptr(),
+			})
+		default:
+			panic("unknown mode")
+		}
+		return nil, diags
+	}
+
+	switch tt := remain[1].(type) {
+	case hcl.TraverseAttr:
+		name = tt.Name
+	default:
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid address",
+			Detail:   "A resource name is required.",
+			Subject:  remain[1].SourceRange().Ptr(),
+		})
+		return nil, diags
+	}
+
+	var subject Targetable
+	remain = remain[2:]
+	switch len(remain) {
+	case 0:
+		subject = path.Resource(mode, typeName, name)
+	case 1:
+		if tt, ok := remain[0].(hcl.TraverseIndex); ok {
+			key, err := ParseInstanceKey(tt.Key)
+			if err != nil {
+				diags = diags.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Invalid address",
+					Detail:   fmt.Sprintf("Invalid resource instance key: %s.", err),
+					Subject:  remain[0].SourceRange().Ptr(),
+				})
+				return nil, diags
+			}
+
+			subject = path.ResourceInstance(mode, typeName, name, key)
+		} else {
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid address",
+				Detail:   "Resource instance key must be given in square brackets.",
+				Subject:  remain[0].SourceRange().Ptr(),
+			})
+			return nil, diags
+		}
+	default:
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid address",
+			Detail:   "Unexpected extra operators after address.",
+			Subject:  remain[1].SourceRange().Ptr(),
+		})
+		return nil, diags
+	}
+
+	return &Target{
+		Subject:     subject,
+		SourceRange: rng,
+	}, diags
+}
+
+// ParseTargetStr is a helper wrapper around ParseTarget that takes a string
+// and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a target string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseTarget.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned target may be nil or incomplete.
+func ParseTargetStr(str string) (*Target, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+	diags = diags.Append(parseDiags)
+	if parseDiags.HasErrors() {
+		return nil, diags
+	}
+
+	target, targetDiags := ParseTarget(traversal)
+	diags = diags.Append(targetDiags)
+	return target, diags
+}
+
+// ParseAbsResource attempts to interpret the given traversal as an absolute
+// resource address, using the same syntax as expected by ParseTarget.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the AbsResource value is invalid and
+// must not be used.
+func ParseAbsResource(traversal hcl.Traversal) (AbsResource, tfdiags.Diagnostics) {
+	addr, diags := ParseTarget(traversal)
+	if diags.HasErrors() {
+		return AbsResource{}, diags
+	}
+
+	switch tt := addr.Subject.(type) {
+
+	case AbsResource:
+		return tt, diags
+
+	case AbsResourceInstance: // Catch likely user error with specialized message
+		// Assume that the last element of the traversal must be the index,
+		// since that's required for a valid resource instance address.
+		indexStep := traversal[len(traversal)-1]
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid address",
+			Detail:   "A resource address is required. This instance key identifies a specific resource instance, which is not expected here.",
+			Subject:  indexStep.SourceRange().Ptr(),
+		})
+		return AbsResource{}, diags
+
+	case ModuleInstance: // Catch likely user error with specialized message
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid address",
+			Detail:   "A resource address is required here. The module path must be followed by a resource specification.",
+			Subject:  traversal.SourceRange().Ptr(),
+		})
+		return AbsResource{}, diags
+
+	default: // Generic message for other address types
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid address",
+			Detail:   "A resource address is required here.",
+			Subject:  traversal.SourceRange().Ptr(),
+		})
+		return AbsResource{}, diags
+
+	}
+}
+
+// ParseAbsResourceStr is a helper wrapper around ParseAbsResource that takes a
+// string and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address may be incomplete.
+//
+// Since this function has no context about the source of the given string,
+// any returned diagnostics will not have meaningful source location
+// information.
+func ParseAbsResourceStr(str string) (AbsResource, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+	diags = diags.Append(parseDiags)
+	if parseDiags.HasErrors() {
+		return AbsResource{}, diags
+	}
+
+	addr, addrDiags := ParseAbsResource(traversal)
+	diags = diags.Append(addrDiags)
+	return addr, diags
+}
+
+// ParseAbsResourceInstance attempts to interpret the given traversal as an
+// absolute resource instance address, using the same syntax as expected by
+// ParseTarget.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the AbsResource value is invalid and
+// must not be used.
+func ParseAbsResourceInstance(traversal hcl.Traversal) (AbsResourceInstance, tfdiags.Diagnostics) {
+	addr, diags := ParseTarget(traversal)
+	if diags.HasErrors() {
+		return AbsResourceInstance{}, diags
+	}
+
+	switch tt := addr.Subject.(type) {
+
+	case AbsResource:
+		return tt.Instance(NoKey), diags
+
+	case AbsResourceInstance:
+		return tt, diags
+
+	case ModuleInstance: // Catch likely user error with specialized message
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid address",
+			Detail:   "A resource instance address is required here. The module path must be followed by a resource instance specification.",
+			Subject:  traversal.SourceRange().Ptr(),
+		})
+		return AbsResourceInstance{}, diags
+
+	default: // Generic message for other address types
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid address",
+			Detail:   "A resource address is required here.",
+			Subject:  traversal.SourceRange().Ptr(),
+		})
+		return AbsResourceInstance{}, diags
+
+	}
+}
+
+// ParseAbsResourceInstanceStr is a helper wrapper around
+// ParseAbsResourceInstance that takes a string and parses it with the HCL
+// native syntax traversal parser before interpreting it.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address may be incomplete.
+//
+// Since this function has no context about the source of the given string,
+// any returned diagnostics will not have meaningful source location
+// information.
+func ParseAbsResourceInstanceStr(str string) (AbsResourceInstance, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+	diags = diags.Append(parseDiags)
+	if parseDiags.HasErrors() {
+		return AbsResourceInstance{}, diags
+	}
+
+	addr, addrDiags := ParseAbsResourceInstance(traversal)
+	diags = diags.Append(addrDiags)
+	return addr, diags
+}

addrs/parse_target_test.go

+package addrs
+
+import (
+	"testing"
+
+	"github.com/go-test/deep"
+	"github.com/hashicorp/hcl2/hcl"
+	"github.com/hashicorp/hcl2/hcl/hclsyntax"
+	"github.com/hashicorp/terraform/tfdiags"
+)
+
+func TestParseTarget(t *testing.T) {
+	tests := []struct {
+		Input   string
+		Want    *Target
+		WantErr string
+	}{
+		{
+			`module.foo`,
+			&Target{
+				Subject: ModuleInstance{
+					{
+						Name: "foo",
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 11, Byte: 10},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo[2]`,
+			&Target{
+				Subject: ModuleInstance{
+					{
+						Name:        "foo",
+						InstanceKey: IntKey(2),
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 14, Byte: 13},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo[2].module.bar`,
+			&Target{
+				Subject: ModuleInstance{
+					{
+						Name:        "foo",
+						InstanceKey: IntKey(2),
+					},
+					{
+						Name: "bar",
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 25, Byte: 24},
+				},
+			},
+			``,
+		},
+		{
+			`aws_instance.foo`,
+			&Target{
+				Subject: AbsResource{
+					Resource: Resource{
+						Mode: ManagedResourceMode,
+						Type: "aws_instance",
+						Name: "foo",
+					},
+					Module: RootModuleInstance,
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 17, Byte: 16},
+				},
+			},
+			``,
+		},
+		{
+			`aws_instance.foo[1]`,
+			&Target{
+				Subject: AbsResourceInstance{
+					Resource: ResourceInstance{
+						Resource: Resource{
+							Mode: ManagedResourceMode,
+							Type: "aws_instance",
+							Name: "foo",
+						},
+						Key: IntKey(1),
+					},
+					Module: RootModuleInstance,
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 20, Byte: 19},
+				},
+			},
+			``,
+		},
+		{
+			`data.aws_instance.foo`,
+			&Target{
+				Subject: AbsResource{
+					Resource: Resource{
+						Mode: DataResourceMode,
+						Type: "aws_instance",
+						Name: "foo",
+					},
+					Module: RootModuleInstance,
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 22, Byte: 21},
+				},
+			},
+			``,
+		},
+		{
+			`data.aws_instance.foo[1]`,
+			&Target{
+				Subject: AbsResourceInstance{
+					Resource: ResourceInstance{
+						Resource: Resource{
+							Mode: DataResourceMode,
+							Type: "aws_instance",
+							Name: "foo",
+						},
+						Key: IntKey(1),
+					},
+					Module: RootModuleInstance,
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 25, Byte: 24},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo.aws_instance.bar`,
+			&Target{
+				Subject: AbsResource{
+					Resource: Resource{
+						Mode: ManagedResourceMode,
+						Type: "aws_instance",
+						Name: "bar",
+					},
+					Module: ModuleInstance{
+						{Name: "foo"},
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 28, Byte: 27},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo.module.bar.aws_instance.baz`,
+			&Target{
+				Subject: AbsResource{
+					Resource: Resource{
+						Mode: ManagedResourceMode,
+						Type: "aws_instance",
+						Name: "baz",
+					},
+					Module: ModuleInstance{
+						{Name: "foo"},
+						{Name: "bar"},
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 39, Byte: 38},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo.module.bar.aws_instance.baz["hello"]`,
+			&Target{
+				Subject: AbsResourceInstance{
+					Resource: ResourceInstance{
+						Resource: Resource{
+							Mode: ManagedResourceMode,
+							Type: "aws_instance",
+							Name: "baz",
+						},
+						Key: StringKey("hello"),
+					},
+					Module: ModuleInstance{
+						{Name: "foo"},
+						{Name: "bar"},
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 48, Byte: 47},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo.data.aws_instance.bar`,
+			&Target{
+				Subject: AbsResource{
+					Resource: Resource{
+						Mode: DataResourceMode,
+						Type: "aws_instance",
+						Name: "bar",
+					},
+					Module: ModuleInstance{
+						{Name: "foo"},
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 33, Byte: 32},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo.module.bar.data.aws_instance.baz`,
+			&Target{
+				Subject: AbsResource{
+					Resource: Resource{
+						Mode: DataResourceMode,
+						Type: "aws_instance",
+						Name: "baz",
+					},
+					Module: ModuleInstance{
+						{Name: "foo"},
+						{Name: "bar"},
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 44, Byte: 43},
+				},
+			},
+			``,
+		},
+		{
+			`module.foo.module.bar.data.aws_instance.baz["hello"]`,
+			&Target{
+				Subject: AbsResourceInstance{
+					Resource: ResourceInstance{
+						Resource: Resource{
+							Mode: DataResourceMode,
+							Type: "aws_instance",
+							Name: "baz",
+						},
+						Key: StringKey("hello"),
+					},
+					Module: ModuleInstance{
+						{Name: "foo"},
+						{Name: "bar"},
+					},
+				},
+				SourceRange: tfdiags.SourceRange{
+					Start: tfdiags.SourcePos{Line: 1, Column: 1, Byte: 0},
+					End:   tfdiags.SourcePos{Line: 1, Column: 53, Byte: 52},
+				},
+			},
+			``,
+		},
+
+		{
+			`aws_instance`,
+			nil,
+			`Resource specification must include a resource type and name.`,
+		},
+		{
+			`module`,
+			nil,
+			`Prefix "module." must be followed by a module name.`,
+		},
+		{
+			`module["baz"]`,
+			nil,
+			`Prefix "module." must be followed by a module name.`,
+		},
+		{
+			`module.baz.bar`,
+			nil,
+			`Resource specification must include a resource type and name.`,
+		},
+		{
+			`aws_instance.foo.bar`,
+			nil,
+			`Resource instance key must be given in square brackets.`,
+		},
+		{
+			`aws_instance.foo[1].baz`,
+			nil,
+			`Unexpected extra operators after address.`,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Input, func(t *testing.T) {
+			traversal, travDiags := hclsyntax.ParseTraversalAbs([]byte(test.Input), "", hcl.Pos{Line: 1, Column: 1})
+			if travDiags.HasErrors() {
+				t.Fatal(travDiags.Error())
+			}
+
+			got, diags := ParseTarget(traversal)
+
+			switch len(diags) {
+			case 0:
+				if test.WantErr != "" {
+					t.Fatalf("succeeded; want error: %s", test.WantErr)
+				}
+			case 1:
+				if test.WantErr == "" {
+					t.Fatalf("unexpected diagnostics: %s", diags.Err())
+				}
+				if got, want := diags[0].Description().Detail, test.WantErr; got != want {
+					t.Fatalf("wrong error\ngot:  %s\nwant: %s", got, want)
+				}
+			default:
+				t.Fatalf("too many diagnostics: %s", diags.Err())
+			}
+
+			if diags.HasErrors() {
+				return
+			}
+
+			for _, problem := range deep.Equal(got, test.Want) {
+				t.Errorf(problem)
+			}
+		})
+	}
+}

addrs/path_attr.go

+package addrs
+
+// PathAttr is the address of an attribute of the "path" object in
+// the interpolation scope, like "path.module".
+type PathAttr struct {
+	referenceable
+	Name string
+}
+
+func (pa PathAttr) String() string {
+	return "path." + pa.Name
+}

addrs/provider_config.go

+package addrs
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform/tfdiags"
+
+	"github.com/hashicorp/hcl2/hcl"
+	"github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// ProviderConfig is the address of a provider configuration.
+type ProviderConfig struct {
+	Type string
+
+	// If not empty, Alias identifies which non-default (aliased) provider
+	// configuration this address refers to.
+	Alias string
+}
+
+// NewDefaultProviderConfig returns the address of the default (un-aliased)
+// configuration for the provider with the given type name.
+func NewDefaultProviderConfig(typeName string) ProviderConfig {
+	return ProviderConfig{
+		Type: typeName,
+	}
+}
+
+// ParseProviderConfigCompact parses the given absolute traversal as a relative
+// provider address in compact form. The following are examples of traversals
+// that can be successfully parsed as compact relative provider configuration
+// addresses:
+//
+//     aws
+//     aws.foo
+//
+// This function will panic if given a relative traversal.
+//
+// If the returned diagnostics contains errors then the result value is invalid
+// and must not be used.
+func ParseProviderConfigCompact(traversal hcl.Traversal) (ProviderConfig, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+	ret := ProviderConfig{
+		Type: traversal.RootName(),
+	}
+
+	if len(traversal) < 2 {
+		// Just a type name, then.
+		return ret, diags
+	}
+
+	aliasStep := traversal[1]
+	switch ts := aliasStep.(type) {
+	case hcl.TraverseAttr:
+		ret.Alias = ts.Name
+		return ret, diags
+	default:
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid provider configuration address",
+			Detail:   "The provider type name must either stand alone or be followed by an alias name separated with a dot.",
+			Subject:  aliasStep.SourceRange().Ptr(),
+		})
+	}
+
+	if len(traversal) > 2 {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid provider configuration address",
+			Detail:   "Extraneous extra operators after provider configuration address.",
+			Subject:  traversal[2:].SourceRange().Ptr(),
+		})
+	}
+
+	return ret, diags
+}
+
+// ParseProviderConfigCompactStr is a helper wrapper around ParseProviderConfigCompact
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseProviderConfigCompact.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// then the returned address is invalid.
+func ParseProviderConfigCompactStr(str string) (ProviderConfig, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+	diags = diags.Append(parseDiags)
+	if parseDiags.HasErrors() {
+		return ProviderConfig{}, diags
+	}
+
+	addr, addrDiags := ParseProviderConfigCompact(traversal)
+	diags = diags.Append(addrDiags)
+	return addr, diags
+}
+
+// Absolute returns an AbsProviderConfig from the receiver and the given module
+// instance address.
+func (pc ProviderConfig) Absolute(module ModuleInstance) AbsProviderConfig {
+	return AbsProviderConfig{
+		Module:         module,
+		ProviderConfig: pc,
+	}
+}
+
+func (pc ProviderConfig) String() string {
+	if pc.Type == "" {
+		// Should never happen; always indicates a bug
+		return "provider.<invalid>"
+	}
+
+	if pc.Alias != "" {
+		return fmt.Sprintf("provider.%s.%s", pc.Type, pc.Alias)
+	}
+
+	return "provider." + pc.Type
+}
+
+// StringCompact is an alternative to String that returns the form that can
+// be parsed by ParseProviderConfigCompact, without the "provider." prefix.
+func (pc ProviderConfig) StringCompact() string {
+	if pc.Alias != "" {
+		return fmt.Sprintf("%s.%s", pc.Type, pc.Alias)
+	}
+	return pc.Type
+}
+
+// AbsProviderConfig is the absolute address of a provider configuration
+// within a particular module instance.
+type AbsProviderConfig struct {
+	Module         ModuleInstance
+	ProviderConfig ProviderConfig
+}
+
+// ParseAbsProviderConfig parses the given traversal as an absolute provider
+// address. The following are examples of traversals that can be successfully
+// parsed as absolute provider configuration addresses:
+//
+//     provider.aws
+//     provider.aws.foo
+//     module.bar.provider.aws
+//     module.bar.module.baz.provider.aws.foo
+//     module.foo[1].provider.aws.foo
+//
+// This type of address is used, for example, to record the relationships
+// between resources and provider configurations in the state structure.
+// This type of address is not generally used in the UI, except in error
+// messages that refer to provider configurations.
+func ParseAbsProviderConfig(traversal hcl.Traversal) (AbsProviderConfig, tfdiags.Diagnostics) {
+	modInst, remain, diags := parseModuleInstancePrefix(traversal)
+	ret := AbsProviderConfig{
+		Module: modInst,
+	}
+	if len(remain) < 2 || remain.RootName() != "provider" {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid provider configuration address",
+			Detail:   "Provider address must begin with \"provider.\", followed by a provider type name.",
+			Subject:  remain.SourceRange().Ptr(),
+		})
+		return ret, diags
+	}
+	if len(remain) > 3 {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid provider configuration address",
+			Detail:   "Extraneous operators after provider configuration alias.",
+			Subject:  hcl.Traversal(remain[3:]).SourceRange().Ptr(),
+		})
+		return ret, diags
+	}
+
+	if tt, ok := remain[1].(hcl.TraverseAttr); ok {
+		ret.ProviderConfig.Type = tt.Name
+	} else {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid provider configuration address",
+			Detail:   "The prefix \"provider.\" must be followed by a provider type name.",
+			Subject:  remain[1].SourceRange().Ptr(),
+		})
+		return ret, diags
+	}
+
+	if len(remain) == 3 {
+		if tt, ok := remain[2].(hcl.TraverseAttr); ok {
+			ret.ProviderConfig.Alias = tt.Name
+		} else {
+			diags = diags.Append(&hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Invalid provider configuration address",
+				Detail:   "Provider type name must be followed by a configuration alias name.",
+				Subject:  remain[2].SourceRange().Ptr(),
+			})
+			return ret, diags
+		}
+	}
+
+	return ret, diags
+}
+
+// ParseAbsProviderConfigStr is a helper wrapper around ParseAbsProviderConfig
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseAbsProviderConfig.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address is invalid.
+func ParseAbsProviderConfigStr(str string) (AbsProviderConfig, tfdiags.Diagnostics) {
+	var diags tfdiags.Diagnostics
+
+	traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+	diags = diags.Append(parseDiags)
+	if parseDiags.HasErrors() {
+		return AbsProviderConfig{}, diags
+	}
+
+	addr, addrDiags := ParseAbsProviderConfig(traversal)
+	diags = diags.Append(addrDiags)
+	return addr, diags
+}
+
+// ProviderConfigDefault returns the address of the default provider config
+// of the given type inside the recieving module instance.
+func (m ModuleInstance) ProviderConfigDefault(name string) AbsProviderConfig {
+	return AbsProviderConfig{
+		Module: m,
+		ProviderConfig: ProviderConfig{
+			Type: name,
+		},
+	}
+}
+
+// ProviderConfigAliased returns the address of an aliased provider config
+// of with given type and alias inside the recieving module instance.
+func (m ModuleInstance) ProviderConfigAliased(name, alias string) AbsProviderConfig {
+	return AbsProviderConfig{
+		Module: m,
+		ProviderConfig: ProviderConfig{
+			Type:  name,
+			Alias: alias,
+		},
+	}
+}
+
+// Inherited returns an address that the receiving configuration address might
+// inherit from in a parent module. The second bool return value indicates if
+// such inheritance is possible, and thus whether the returned address is valid.
+//
+// Inheritance is possible only for default (un-aliased) providers in modules
+// other than the root module. Even if a valid address is returned, inheritence
+// may not be performed for other reasons, such as if the calling module
+// provided explicit provider configurations within the call for this module.
+// The ProviderTransformer graph transform in the main terraform module has
+// the authoritative logic for provider inheritance, and this method is here
+// mainly just for its benefit.
+func (pc AbsProviderConfig) Inherited() (AbsProviderConfig, bool) {
+	// Can't inherit if we're already in the root.
+	if len(pc.Module) == 0 {
+		return AbsProviderConfig{}, false
+	}
+
+	// Can't inherit if we have an alias.
+	if pc.ProviderConfig.Alias != "" {
+		return AbsProviderConfig{}, false
+	}
+
+	// Otherwise, we might inherit from a configuration with the same
+	// provider name in the parent module instance.
+	parentMod := pc.Module.Parent()
+	return pc.ProviderConfig.Absolute(parentMod), true
+}
+
+func (pc AbsProviderConfig) String() string {
+	if len(pc.Module) == 0 {
+		return pc.ProviderConfig.String()
+	}
+	return fmt.Sprintf("%s.%s", pc.Module.String(), pc.ProviderConfig.String())
+}

addrs/provider_config_test.go

+package addrs
+
+import (
+	"testing"
+
+	"github.com/go-test/deep"
+
+	"github.com/hashicorp/hcl2/hcl"
+	"github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+func TestParseProviderConfigCompact(t *testing.T) {
+	tests := []struct {
+		Input    string
+		Want     ProviderConfig
+		WantDiag string
+	}{
+		{
+			`aws`,
+			ProviderConfig{
+				Type: "aws",
+			},
+			``,
+		},
+		{
+			`aws.foo`,
+			ProviderConfig{
+				Type:  "aws",
+				Alias: "foo",
+			},
+			``,
+		},
+		{
+			`aws["foo"]`,
+			ProviderConfig{},
+			`The provider type name must either stand alone or be followed by an alias name separated with a dot.`,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Input, func(t *testing.T) {
+			traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(test.Input), "", hcl.Pos{})
+			if len(parseDiags) != 0 {
+				t.Errorf("unexpected diagnostics during parse")
+				for _, diag := range parseDiags {
+					t.Logf("- %s", diag)
+				}
+				return
+			}
+
+			got, diags := ParseProviderConfigCompact(traversal)
+
+			if test.WantDiag != "" {
+				if len(diags) != 1 {
+					t.Fatalf("got %d diagnostics; want 1", len(diags))
+				}
+				gotDetail := diags[0].Description().Detail
+				if gotDetail != test.WantDiag {
+					t.Fatalf("wrong diagnostic detail\ngot:  %s\nwant: %s", gotDetail, test.WantDiag)
+				}
+				return
+			} else {
+				if len(diags) != 0 {
+					t.Fatalf("got %d diagnostics; want 0", len(diags))
+				}
+			}
+
+			for _, problem := range deep.Equal(got, test.Want) {
+				t.Error(problem)
+			}
+		})
+	}
+}
+func TestParseAbsProviderConfig(t *testing.T) {
+	tests := []struct {
+		Input    string
+		Want     AbsProviderConfig
+		WantDiag string
+	}{
+		{
+			`provider.aws`,
+			AbsProviderConfig{
+				Module: RootModuleInstance,
+				ProviderConfig: ProviderConfig{
+					Type: "aws",
+				},
+			},
+			``,
+		},
+		{
+			`provider.aws.foo`,
+			AbsProviderConfig{
+				Module: RootModuleInstance,
+				ProviderConfig: ProviderConfig{
+					Type:  "aws",
+					Alias: "foo",
+				},
+			},
+			``,
+		},
+		{
+			`module.baz.provider.aws`,
+			AbsProviderConfig{
+				Module: ModuleInstance{
+					{
+						Name: "baz",
+					},
+				},
+				ProviderConfig: ProviderConfig{
+					Type: "aws",
+				},
+			},
+			``,
+		},
+		{
+			`module.baz.provider.aws.foo`,
+			AbsProviderConfig{
+				Module: ModuleInstance{
+					{
+						Name: "baz",
+					},
+				},
+				ProviderConfig: ProviderConfig{
+					Type:  "aws",
+					Alias: "foo",
+				},
+			},
+			``,
+		},
+		{
+			`module.baz["foo"].provider.aws`,
+			AbsProviderConfig{
+				Module: ModuleInstance{
+					{
+						Name:        "baz",
+						InstanceKey: StringKey("foo"),
+					},
+				},
+				ProviderConfig: ProviderConfig{
+					Type: "aws",
+				},
+			},
+			``,
+		},
+		{
+			`module.baz[1].provider.aws`,
+			AbsProviderConfig{
+				Module: ModuleInstance{
+					{
+						Name:        "baz",
+						InstanceKey: IntKey(1),
+					},
+				},
+				ProviderConfig: ProviderConfig{
+					Type: "aws",
+				},
+			},
+			``,
+		},
+		{
+			`module.baz[1].module.bar.provider.aws`,
+			AbsProviderConfig{
+				Module: ModuleInstance{
+					{
+						Name:        "baz",
+						InstanceKey: IntKey(1),
+					},
+					{
+						Name: "bar",
+					},
+				},
+				ProviderConfig: ProviderConfig{
+					Type: "aws",
+				},
+			},
+			``,
+		},
+		{
+			`aws`,
+			AbsProviderConfig{},
+			`Provider address must begin with "provider.", followed by a provider type name.`,
+		},
+		{
+			`aws.foo`,
+			AbsProviderConfig{},
+			`Provider address must begin with "provider.", followed by a provider type name.`,
+		},
+		{
+			`provider`,
+			AbsProviderConfig{},
+			`Provider address must begin with "provider.", followed by a provider type name.`,
+		},
+		{
+			`provider.aws.foo.bar`,
+			AbsProviderConfig{},
+			`Extraneous operators after provider configuration alias.`,
+		},
+		{
+			`provider["aws"]`,
+			AbsProviderConfig{},
+			`The prefix "provider." must be followed by a provider type name.`,
+		},
+		{
+			`provider.aws["foo"]`,
+			AbsProviderConfig{},
+			`Provider type name must be followed by a configuration alias name.`,
+		},
+		{
+			`module.foo`,
+			AbsProviderConfig{},
+			`Provider address must begin with "provider.", followed by a provider type name.`,
+		},
+		{
+			`module.foo["provider"]`,
+			AbsProviderConfig{},
+			`Provider address must begin with "provider.", followed by a provider type name.`,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Input, func(t *testing.T) {
+			traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(test.Input), "", hcl.Pos{})
+			if len(parseDiags) != 0 {
+				t.Errorf("unexpected diagnostics during parse")
+				for _, diag := range parseDiags {
+					t.Logf("- %s", diag)
+				}
+				return
+			}
+
+			got, diags := ParseAbsProviderConfig(traversal)
+
+			if test.WantDiag != "" {
+				if len(diags) != 1 {
+					t.Fatalf("got %d diagnostics; want 1", len(diags))
+				}
+				gotDetail := diags[0].Description().Detail
+				if gotDetail != test.WantDiag {
+					t.Fatalf("wrong diagnostic detail\ngot:  %s\nwant: %s", gotDetail, test.WantDiag)
+				}
+				return
+			} else {
+				if len(diags) != 0 {
+					t.Fatalf("got %d diagnostics; want 0", len(diags))
+				}
+			}
+
+			for _, problem := range deep.Equal(got, test.Want) {
+				t.Error(problem)
+			}
+		})
+	}
+}

addrs/referenceable.go

+package addrs
+
+// Referenceable is an interface implemented by all address types that can
+// appear as references in configuration language expressions.
+type Referenceable interface {
+	// All implementations of this interface must be covered by the type switch
+	// in lang.Scope.buildEvalContext.
+	referenceableSigil()
+
+	// String produces a string representation of the address that could be
+	// parsed as a HCL traversal and passed to ParseRef to produce an identical
+	// result.
+	String() string
+}
+
+type referenceable struct {
+}
+
+func (r referenceable) referenceableSigil() {
+}