Write the variable blocks for everything a file refers to and does not declare. The types come from how each one is used, which is a guess, and the page says so on every one.
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Generate. Nothing leaves this tab.
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
The count reference guesses a number and the rest guess string, each labelled as a guess
resource "aws_instance" "web" {
ami = var.ami_id
instance_type = var.instance_type
count = var.instance_count
}Marked sensitive, with the reminder that sensitive does nothing about state
resource "aws_db_instance" "main" {
password = var.db_password
}These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Everything becomes any, and a wrong shape is caught wherever it is finally used rather than where it was set, often several modules away.
Instead:Give every variable a type. Narrow it as far as the real values allow.
Inference from usage cannot tell list(string) from set(string) or from a list of objects. The wrong one fails later and further away.
Instead:Check each against what callers actually pass before committing the file.
A default that is not right for every caller becomes the value nobody meant to choose, silently, in whichever environment forgot to set it.
Instead:Leave it required and pass -input=false in automation so a missing value fails immediately.
It costs one line and it catches the wrong shape where the value is set, rather than several modules deeper where it is finally used.
list(string) is inferred from indexing or iteration, and the real type could be a set, a list of objects, or list(any). The wrong guess fails at the point the value is used rather than at the declaration, so each one is worth checking against what callers actually pass.
And a wrong value is not caught anywhere near where it was set. It surfaces wherever the value finally lands, often several modules down, as an error about a type that appears nowhere in the file the person is reading.
A default is a decision about what happens when nobody chooses, and for most module inputs the honest answer is that there is no sensible default. Remember that a required variable with no value PROMPTS rather than failing, so automation needs -input=false or it hangs.
A region is a string and only some strings are regions. Without a validation block, a typo surfaces as a provider error naming an endpoint nobody recognises. With one, it fails at the variable with a message you wrote.
terraform-docs renders the table from these, so an empty description produces a blank column in the module's documentation. Say what the value is for rather than restating the name.
It stops Terraform printing the value in plan and apply output. It does nothing about state, where the resolved value is written in plaintext, and nothing about the tfvars file it might be set in. Reading a credential from a secret manager with a data source keeps it out of the variable entirely.