JSON 출력 형식 개요

JSON 출력 형식 개요 (JSON Output Format Overview)

Terraform이 터미널에 출력하는 JSON 출력에 대한 개요 정보를 제공해요. terraform show -json 명령으로 계획(plan) 파일이나 상태 파일의 JSON 표현을 생성할 수 있어요. 이 페이지는 그 형식의 각 객체와 하위 객체를 설명해요.

출처: 문서

본문

이 주제는 Terraform이 터미널에 출력하는 JSON 출력에 대한 개요 정보를 제공해요.

소개

Terraform이 변경을 계획할 때 사람이 읽을 수 있는 요약을 터미널에 출력해요. -out=를 붙여 실행하면 훨씬 더 상세한 바이너리 계획 파일도 작성할 수 있으며, 나중에 그 변경을 적용하는 데 사용할 수 있어요.

Terraform은 계획 파일의 변경 사항에 대한 기계가 읽을 수 있는 JSON 표현을 출력할 수 있어요. 또한 상태 파일을 같은 형식으로 변환해 데이터 로딩을 단순화하고 더 나은 장기 호환성을 제공할 수도 있어요.

terraform show -json 을 사용해 계획 또는 상태 파일의 JSON 표현을 생성하세요. 자세한 내용은 the terraform show 문서를 참조하세요.

출력에는 format_version 키가 포함되며, 이 값은 Terraform 1.1.0 기준으로 "1.0"이에요. 이 버전의 의미는 다음과 같아요:

  • 하위 호환되는 변경이나 추가 사항에 대해서는 부 버전을 증가시킬 거예요(예: "1.1"). 향후 부 버전과의 호환성을 유지하려면 인식되지 않는 이름의 객체 속성은 무시하세요.
  • 하위 호환되지 않는 변경 사항에 대해서는 주 버전을 증가시킬 거예요(예: "2.0"). 지원되지 않는 주 버전을 보고하는 입력은 거부하세요.

형식 요약

다음 섹션들은 의사(pseudo)-JSON 표기법을 사용해 예시로 JSON 출력 형식을 설명해요. 중요한 요소는 //로 접두어가 붙은 주석으로 설명돼요.

과도한 반복을 피하기 위해 전체 형식을 몇 개의 개별 하위 객체로 나누어 별도의 제목 아래에 설명했어요. 꺾쇠 괄호(0처럼)로 감싼 참조는 실제 출력에서 지정된 하위 객체의 인스턴스로 대체되는 자리 표시자예요.

JSON 출력 형식은 다음 객체와 하위 객체로 구성돼요:

상태 표현

상태는 공통 값 표현 (values representation)에 포함되지 않은 중요한 메타데이터가 없으므로, ``는 다음 형식을 사용해요:

{
  // "values" is a values representation object derived from the values in the
  // state. Because the state is always fully known, this is always complete.
  "values":

  "terraform_version": "version.string"
}

계획 표현

계획은 이전 상태, 그 상태에 적용되는 구성, 그리고 이를 달성하기 위해 Terraform이 만들 계획인 변경 집합으로 구성돼요.

호출자가 소비하기 쉽도록 계획 표현은 최종 상태의 값에 대한 부분 표현( 값 표현 (value representation) 사용)을 포함해, 호출자가 이전 상태를 분석하는 것과 유사한 코드로 계획된 결과를 쉽게 분석할 수 있게 해요.

{
  "format_version": "1.0",

  // "prior_state" is a representation of the state that the configuration is
  // being applied to, using the state representation described above.
  "prior_state":  ,

  // "applyable" indicates that it would make sense for a wrapping automation
  // to try to apply this plan, possibly after asking a human operator for
  // approval.
  //
  // Other attributes may give additional context about why the plan is not
  // applyable, but wrapping automations should use this flag as their
  // primary condition to accommodate potential changes to the exact definition
  // of "applyable" in future Terraform versions.
  "applyable": true,

  // "complete" indicates that Terraform expects that after applying this
  // plan the actual state will match the desired state.
  //
  // An incomplete plan is expected to require at least one additional
  // plan/apply round to achieve convergence, and so wrapping automations
  // should ideally either automatically start a new plan/apply round after
  // this plan is applied, or prompt the operator that they should do so.
  //
  // Other attributes may give additional context about why the plan is not
  // complete, but wrapping automations should use this flag as their
  // primary condition to accommodate potential changes to the exact definition
  // of "complete" in future Terraform versions.
  "complete": true,

  // "errored" indicates whether planning failed. An errored plan cannot be applied,
  // but the actions planned before failure may help to understand the error.
  "errored": false,

  // "configuration" is a representation of the configuration being applied to the
  // prior state, using the configuration representation described above.
  "configuration": ,

  // "planned_values" is a description of what is known so far of the outcome in
  // the standard value representation, with any as-yet-unknown values omitted.
  "planned_values": ,

  // "proposed_unknown" is a representation of the attributes, including any
  // potentially-unknown attributes. Each value is replaced with "true" or
  // "false" depending on whether it is known in the proposed plan.
  "proposed_unknown": ,

  // "variables" is a representation of all the variables provided for the given
  // plan. This is structured as a map similar to the output map so we can add
  // additional fields in later.
  "variables": {
    "varname": {
      "value": "varvalue"
    },
  },

  // "resource_changes" is a description of the individual change actions that
  // Terraform plans to use to move from the prior state to a new state
  // matching the configuration.
  "resource_changes": [
    // Each element of this array describes the action to take
    // for one instance object. All resources in the
    // configuration are included in this list.
    {
      // "address" is the full absolute address of the resource instance this
      // change applies to, in the same format as addresses in a value
      // representation.
      "address": "module.child.aws_instance.foo[0]",

      // "previous_address" is the full absolute address of this resource
      // instance as it was known after the previous Terraform run.
      // Included only if the address has changed, e.g. by handling
      // a "moved" block in the configuration.
      "previous_address": "module.instances.aws_instance.foo[0]",

      // "module_address", if set, is the module portion of the above address.
      // Omitted if the instance is in the root module.
      "module_address": "module.child",

      // "mode", "type", "name", and "index" have the same meaning as in a
      // value representation.
      "mode": "managed",
      "type": "aws_instance",
      "name": "foo",
      "index": 0,

      // "deposed", if set, indicates that this action applies to a "deposed"
      // object of the given instance rather than to its "current" object.
      // Omitted for changes to the current object. "address" and "deposed"
      // together form a unique key across all change objects in a particular
      // plan. The value is an opaque key representing the specific deposed
      // object.
      "deposed": "deadbeef",

      // "change" describes the change that will be made to the indicated
      // object. The  is detailed in a section below.
      "change": ,

      // "action_reason" is some optional extra context about why the
      // actions given inside "change" were selected. This is the JSON
      // equivalent of annotations shown in the normal plan output like
      // "is tainted, so must be replaced" as opposed to just "must be
      // replaced".
      //
      // These reason codes are display hints only and the set of possible
      // hints may change over time. Users of this must be prepared to
      // encounter unrecognized reasons and treat them as unspecified reasons.
      //
      // The current set of possible values is:
      // - "replace_because_tainted": the object in question is marked as
      //   "tainted" in the prior state, so Terraform planned to replace it.
      // - "replace_because_cannot_update": the provider indicated that one
      //   of the requested changes isn't possible without replacing the
      //   existing object with a new object.
      // - "replace_by_request": the user explicitly called for this object
      //   to be replaced as an option when creating the plan, which therefore
      //   overrode what would have been a "no-op" or "update" action otherwise.
      // - "delete_because_no_resource_config": Terraform found no resource
      //   configuration corresponding to this instance.
      // - "delete_because_no_module": The resource instance belongs to a
      //   module instance that's no longer declared, perhaps due to changing
      //   the "count" or "for_each" argument on one of the containing modules.
      // - "delete_because_wrong_repetition": The instance key portion of the
      //   resource address isn't of a suitable type for the corresponding
      //   resource's configured repetition mode (count, for_each, or neither).
      // - "delete_because_count_index": The corresponding resource uses count,
      //   but the instance key is out of range for the currently-configured
      //   count value.
      // - "delete_because_each_key": The corresponding resource uses for_each,
      //   but the instance key doesn't match any of the keys in the
      //   currently-configured for_each value.
      // - "read_because_config_unknown": For a data resource, Terraform cannot
      //   read the data during the plan phase because of values in the
      //   configuration that won't be known until the apply phase.
      // - "read_because_dependency_pending": For a data resource, Terraform
      //   cannot read the data during the plan phase because the data
      //   resource depends on at least one managed resource that also has
      //   a pending change in the same plan.
      //
      // If there is no special reason to note, Terraform will omit this
      // property altogether.
      "action_reason": "replace_because_tainted"
    }
  ],

  // "resource_drift" is a description of the changes Terraform detected
  // when it compared the most recent state to the prior saved state.
  "resource_drift": [
    {
        // "resource_drift" uses the same object structure as
        // "resource_changes".
    }
  ],

  // "relevant_attributes" lists the sources of all values contributing to
  // changes in the plan. You can use "relevant_attributes" to filter
  // "resource_drift" and determine which external changes may have affected the
  // plan result.
  "relevant_attributes": [
    {
      "resource": "aws_instance.foo",
      "attribute": "attr",
    }
  ]

  // "output_changes" describes the planned changes to the output values of the
  // root module.
  "output_changes": {
    // Keys are the defined output value names.
    "foo": {

      // "change" describes the change that will be made to the indicated output
      // value, using the same representation as for resource changes except
      // that the only valid actions values are:
      //   ["create"]
      //   ["update"]
      //   ["delete"]
      // In the Terraform CLI 0.12.0 release, Terraform is not yet fully able to
      // track changes to output values, so the actions indicated may not be
      // fully accurate, but the "after" value will always be correct.
      "change": ,
    }
  },

  // "checks" describes the partial results for any checkable objects, such as
  // resources with postconditions, with as much information as Terraform can
  // recognize at plan time. Some objects will have status "unknown" to
  // indicate that their status will only be determined after applying the plan.
  "checks"
}

이 전체 계획 구조를 완전히 확장한 것이 terraform show -json 명령으로 출력될 내용이에요.

값 표현

값 표현은 상태와 계획 출력 모두에서 현재 상태(항상 완전함)와 계획된 상태(apply 전까지 알 수 없는 값을 생략함)를 설명하는 데 사용돼요.

다음 예시는 ``의 구조를 보여줘요:

{
  // "outputs" describes the outputs from the root module. Outputs from
  // descendant modules are not available because they are not retained in all
  // of the underlying structures we will build this values representation from.
  "outputs": {
    "private_ip": {
      "value": "192.168.3.2",
      "type": "string",
      "sensitive": false
    }
  },

  // "root_module" describes the resources and child modules in the root module.
  "root_module": {
    "resources": [
      {
        // "address" is the absolute resource address, which callers must consider
        // opaque but may do full string comparisons with other address strings or
        // pass this verbatim to other Terraform commands that are documented to
        // accept absolute resource addresses. The module-local portions of this
        // address are extracted in other properties below.
        "address": "aws_instance.example[1]",

        // "mode" can be "managed", for resources, or "data", for data resources
        "mode": "managed",
        "type": "aws_instance",
        "name": "example",

        // If the count or for_each meta-arguments are set for this resource, the
        // additional key "index" is present to give the instance index key. This
        // is omitted for the single instance of a resource that isn't using count
        // or for_each.
        "index": 1,

        // "provider_name" is the name of the provider that is responsible for
        // this resource. This is only the provider name, not a provider
        // configuration address, and so no module path nor alias will be
        // indicated here. This is included to allow the property "type" to be
        // interpreted unambiguously in the unusual situation where a provider
        // offers a resource type whose name does not start with its own name,
        // such as the "googlebeta" provider offering "google_compute_instance".
        "provider_name": "aws",

        // "schema_version" indicates which version of the resource type schema
        // the "values" property conforms to.
        "schema_version": 2,

        // "values" is the JSON representation of the attribute values of the
        // resource, whose structure depends on the resource type schema. Any
        // unknown values are omitted or set to null, making them
        // indistinguishable from absent values; callers which need to distinguish
        // unknown from unset must use the plan-specific or configuration-specific
        // structures described in later sections.
        "values": {
          "id": "i-abc123",
          "instance_type": "t2.micro",
          // etc, etc
        },

        // "sensitive_values" is the JSON representation of the sensitivity of
        // the resource's attribute values. Only attributes which are sensitive
        // are included in this structure.
        "sensitive_values": {
          "id": true,
        }
      }
    ]

    "child_modules": [
      // Each entry in "child_modules" has the same structure as the root_module
      // object, with the additional "address" property shown below.
      {
        // "address" is the absolute module address, which callers must treat as
        // opaque but may do full string comparisons with other module address
        // strings and may pass verbatim to other Terraform commands that are
        // documented as accepting absolute module addresses.
        "address": "module.child",

        // "resources" is the same as in "root_module" above
        "resources": [
            {
              "address": "module.child.aws_instance.foo",
              // etc, etc
            }
        ],

        // Each module object can optionally have its own
        // nested "child_modules", recursively describing the
        // full module tree.
        "child_modules": [ ... ],
      }
    ]
  }
}

속성 및 출력 값의 변환은 Terraform의 jsonencode 함수가 사용하는 HCL 타입에서 JSON 타입으로의 직관적인 매핑과 동일해요. 이 매핑은 일부 정보를 잃어요. 목록, 집합, 튜플은 모두 JSON 배열로 내려가고 맵과 객체는 모두 JSON 객체로 내려가요. 알 수 없는 값과 null 값은 모두 부재 또는 null로 취급돼요.

출력 값에는 "type" 필드가 포함되는데, 이는 값의 타입 직렬화 (a serialization of the value's type)예요. 기본 타입의 경우 "number" 또는 "bool" 같은 문자열 값이에요. 복합 타입은 ["map","string"] 또는 ["object",{"a":"number"}] 같은 중첩 JSON 배열로 표현돼요. 이는 올바른 타입으로 출력 값을 재구성하는 데 사용할 수 있어요.

각 리소스 인스턴스의 "현재" 객체만 설명돼요. "Deposed" 객체는 이 구조에 전혀 반영되지 않아요. 계획 표현에서는 자세한 내용을 위해 변경 표현을 참조할 수 있어요.

이 구조의 의도는 구성 자체의 표현식에서 사용할 수 있는 것과 유사한 수준의 세부 정보에 호출자가 접근할 수 있게 하는 것이에요. 이 공통 표현은 만들어진 데이터 구조에 비해 정보를 잃기 때문에 모든 사용 사례에 적합하지는 않아요. 더 복잡한 요구 사항에는 더 상세한 변경 및 구성 표현을 사용하세요.

구성 표현

구성은 평가되지 않은 표현식 노드와 기타 복잡성을 포함하므로 Terraform에서 가장 복잡한 구조예요.

구성 모델은 표현식 평가 이전 단계에서 생성되므로 구성에 대한 값 표현을 만들 수는 없어요. 대신 구성의 물리적 구조를 설명해 가능한 곳에서 상수 값을 제공하고 호출자가 존재하는 다른 객체에 대한 참조를 분석할 수 있게 해요:

{
  // "provider_configs" describes all of the provider configurations throughout
  // the configuration tree, flattened into a single map for convenience since
  // provider configurations are the one concept in Terraform that can span
  // across module boundaries.
  "provider_config": {

    // Keys in the provider_configs map are to be considered opaque by callers,
    // and used just for lookups using the "provider_config_key" property in each
    // resource object.
    "opaque_provider_ref_aws": {

      // "name" is the name of the provider without any alias
      "name": "aws",

      // "full_name" is the fully-qualified provider name
      "full_name": "registry.terraform.io/hashicorp/aws",

      // "alias" is the alias set for a non-default configuration, or unset for
      // a default configuration.
      "alias": "foo",

      // "module_address" is included only for provider configurations that are
      // declared in a descendant module, and gives the opaque address for the
      // module that contains the provider configuration.
      "module_address": "module.child",

      // "expressions" describes the provider-specific content of the
      // configuration block, as a block expressions representation (see section
      // below).
      "expressions":
    }
  },

  // "root_module" describes the root module in the configuration, and serves
  // as the root of a tree of similar objects describing descendant modules.
  "root_module": {

    // "outputs" describes the output value configurations in the module.
    "outputs": {

      // Property names here are the output value names
      "example": {
        "expression": ,
        "sensitive": false
      }
    },

    // "resources" describes the "resource" and "data" blocks in the module
    // configuration.
    "resources": [
      {
        // "address" is the opaque absolute address for the resource itself.
        "address": "aws_instance.example",

        // "mode", "type", and "name" have the same meaning as for the resource
        // portion of a value representation.
        "mode": "managed",
        "type": "aws_instance",
        "name": "example",

        // "provider_config_key" is the key into "provider_configs" (shown
        // above) for the provider configuration that this resource is
        // associated with. If the provider configuration was passed into
        // this module from the parent module, the key will point to the
        // original provider config block.
        "provider_config_key": "opaque_provider_ref_aws",

        // "provisioners" is an optional field which describes any provisioners.
        // Connection info will not be included here.
        "provisioners": [
          {
            "type": "local-exec",

            // "expressions" describes the provisioner configuration
            "expressions":
          },
        ],

        // "expressions" describes the resource-type-specific content of the
        // configuration block.
        "expressions": ,

        // "schema_version" is the schema version number indicated by the
        // provider for the type-specific arguments described in "expressions".
        "schema_version": 2,

        // "count_expression" and "for_each_expression" describe the expressions
        // given for the corresponding meta-arguments in the resource
        // configuration block. These are omitted if the corresponding argument
        // isn't set.
        "count_expression": ,
        "for_each_expression":
      },
    ],

    // "module_calls" describes the "module" blocks in the module. During
    // evaluation, a module call with count or for_each may expand to multiple
    // module instances, but in configuration only the block itself is
    // represented.
    "module_calls": {

      // Key is the module call name chosen in the configuration.
      "child": {

        // "resolved_source" is the resolved source address of the module, after
        // any normalization and expansion. This could be either a
        // go-getter-style source address or a local path starting with "./" or
        // "../". If the user gave a registry source address then this is the
        // final location of the module as returned by the registry, after
        // following any redirect indirection.
        "resolved_source": "./child"

        // "expressions" describes the expressions for the arguments within the
        // block that correspond to input variables in the child module.
        "expressions": ,

        // "count_expression" and "for_each_expression" describe the expressions
        // given for the corresponding meta-arguments in the module
        // configuration block. These are omitted if the corresponding argument
        // isn't set.
        "count_expression": ,
        "for_each_expression": ,

        // "module" is a representation of the configuration of the child module
        // itself, using the same structure as the "root_module" object,
        // recursively describing the full module tree.
        "module":
      }
    }
  }
}

표현식 표현

구성의 각 평가되지 않은 표현식은 다음 구조의 `` 객체로 표현돼요:

{
  // "constant_value" is set only if the expression contains no references to
  // other objects, in which case it gives the resulting constant value. This is
  // mapped as for the individual values in a value representation.
  "constant_value": "hello",

  // Alternatively, "references" will be set to a list of references in the
  // expression. Multi-step references will be unwrapped and duplicated for each
  // significant traversal step, allowing callers to more easily recognize the
  // objects they care about without attempting to parse the expressions.
  // Callers should only use string equality checks here, since the syntax may
  // be extended in future releases.
  "references": [
    "data.template_file.foo[1].vars[\"baz\"]",
    "data.template_file.foo[1].vars", // implied by previous
    "data.template_file.foo[1]", // implied by previous
    "data.template_file.foo", // implied by previous
    "module.foo.bar",
    "module.foo", // implied by the previous
    "var.example[0]",
    "var.example", // implied by the previous

    // Partial references like "data" and "module" are not included, because
    // Terraform considers "module.foo" to be an atomic reference, not an
    // attribute access.
  ]
}

참고: dynamic 블록의 표현식은 구성 표현에 포함되지 않아요.

블록 표현식 표현

어떤 경우에는 특정 특수 인자들이 이미 처리되고 제거된 후 블록의 전체 내용을 표현해야 해요. 이를 위해 `` 구조가 있어요:

{
  // Attribute arguments are mapped directly with the attribute name as key and
  // an  as value.
  "ami": ,
  "instance_type": ,

  // Nested block arguments are mapped as either a single nested
  //  or an array object of these, depending on the
  // block nesting mode chosen in the schema.
  //  - "single" nesting is a direct
  //  - "list" and "set" produce arrays
  //  - "map" produces an object
  "root_block_device": ,
  "ebs_block_device": [

  ]
}

현재로서는 호출자가 특정 리소스 유형의 스키마에 대한 가정을 하드코딩해 이러한 표현식 표현을 처리할 것으로 기대해요. 이후 릴리스에서는 스키마 자체에 대한 기계가 읽을 수 있는 설명을 반환하는 새 검사 명령을 추가해 시각화 도구와 같은 프로그램에서 더 제네릭하게 처리할 수 있게 할 거예요.

변경 표현

``는 표시된 객체에 대한 변경을 설명해요.

{
  // "actions" are the actions that will be taken on the object selected by the
  // properties below.
  // Valid actions values are:
  //    ["no-op"]
  //    ["create"]
  //    ["read"]
  //    ["update"]
  //    ["delete", "create"]
  //    ["create", "delete"]
  //    ["delete"]
  // The two "replace" actions are represented in this way to allow callers to
  // e.g. just scan the list for "delete" to recognize all three situations
  // where the object will be deleted, allowing for any new deletion
  // combinations that might be added in future.
  "actions": ["update"],

  // "before" and "after" are representations of the object value both before
  // and after the action. For ["create"] and ["delete"] actions, either
  // "before" or "after" is unset (respectively). For ["no-op"], the before and
  // after values are identical. The "after" value will be incomplete if there
  // are values within it that won't be known until after apply.
  "before": ,
  "after": ,

  // "after_unknown" is an object value with similar structure to "after", but
  // with all unknown leaf values replaced with "true", and all known leaf
  // values omitted. This can be combined with "after" to reconstruct a full
  // value after the action, including values which will only be known after
  // apply.
  "after_unknown": {
    "id": true
  },

  // "before_sensitive" and "after_sensitive" are object values with similar
  // structure to "before" and "after", but with all sensitive leaf values
  // replaced with true, and all non-sensitive leaf values omitted. These
  // objects should be combined with "before" and "after" to prevent accidental
  // display of sensitive values in user interfaces.
  "before_sensitive": {},
  "after_sensitive": {
    "triggers": {
      "boop": true
    }
  },

  // "replace_paths" is an array of arrays representing a set of paths into the
  // object value which resulted in the action being "replace". This will be
  // omitted if the action is not replace, or if no paths caused the
  // replacement (for example, if the resource was tainted). Each path
  // consists of one or more steps, each of which will be a number or a
  // string.
  "replace_paths": [["triggers"]],

  // "importing" is present only when the object is being imported as part
  // of this change.
  "importing": {
    // "id" is the import ID of the object being imported.
    "id": "foo"
  }
}

체크 표현

경고: 체크의 JSON 표현은 실험적이며 Terraform CLI의 부 릴리스에서도 피드백에 따라 일부 세부 사항이 향후 Terraform 버전에서 변경될 수 있어요.

``는 구성의 체크 가능한 객체의 현재 상태를 설명해요. 예를 들어 하나 이상의 precondition 또는 postcondition이 있는 리소스는 체크 가능한 객체의 예시이며, 그 체크 상태는 해당 조건의 결과를 나타내요.

[
  {
    // "address" describes the address of the checkable object whose status
    // this object is describing.
    "address": {
      // "kind" specifies what kind of checkable object this is. Different
      // kinds of object will have different additional properties inside the
      // address object, but all kinds include both "kind" and "to_display".
      // The two valid kinds are "resource" and "output_value".
      "kind": "resource",

      // "to_display" contains an opaque string representation of the address
      // of the object that is suitable for display in a UI. For consumers that
      // have special handling depending on the value of "kind", this property
      // is a good fallback to use when the application doesn't recognize the
      // "kind" value.
      "to_display": "aws_instance.example",

      // "mode" is included for kind "resource" only, and specifies the resource
      // mode which can either be "managed" (for "resource" blocks) or "data"
      // (for "data" blocks).
      "mode": "managed",

      // "type" is included for kind "resource" only, and specifies the resource
      // type.
      "type": "aws_instance",

      // "name" is the local name of the object. For a resource this is the
      // second label in the resource block header, and for an output value
      // this is the single label in the output block header.
      "name": "example",

      // "module" is included if the object belongs to a module other than
      // the root module, and provides an opaque string representation of the
      // module this object belongs to. This example is of a root module
      // resource and so "module" is not included.
    }

    // "status" is the aggregate status of all of the instances of the object
    // being described by this object.
    // The possible values are "pass", "fail", "error", and "unknown".
    "status": "fail",

    // "instances" describes the current status of each of the instances of
    // the object being described. An object can have multiple instances if
    // it is either a resource which has "count" or "for_each" set, or if
    // it's contained within a module that has "count" or "for_each" set.
    //
    // If "instances" is empty or omitted, that can either mean that the object
    // has no instances at all (e.g. count = 0) or that an error blocked
    // evaluation of the repetition argument. You can distinguish these cases
    // using the "status" property, which will be "pass" or "error" for a
    // zero-instance object and "unknown" for situations where an error blocked
    // evalation.
    "instances": [
      {
        // "address" is an object similar to the property of the same name in
        // the containing object. Merge the instance-level address into the
        // object-level address, overwriting any conflicting property names,
        // to create a full description of the instance's address.
        "address": {
          // "to_display" overrides the property of the same name in the main
          // object's address, to include any module instance or resource
          // instance keys that uniquely identify this instance.
          "to_display": "aws_instance.example[0]",

          // "instance_key" is included for resources only and specifies the
          // resource-level instance key, which can either be a number or a
          // string. Omitted for single-instance resources.
          "instance_key": 0,

          // "module" is included if the object belongs to a module other than
          // the root module, and provides an opaque string representation of the
          // module instance this object belongs to.
        },

        // "status" describes the result of running the configured checks
        // against this particular instance of the object, with the same
        // possible values as the "status" in the parent object.
        //
        // "fail" means that the condition evaluated successfully but returned
        // false, while "error" means that the condition expression itself
        // was invalid.
        "status": "fail",

        // "problems" might be included for statuses "fail" or "error", in
        // which case it describes the individual conditions that failed for
        // this instance, if any.
        // When a condition expression is invalid, Terraform returns that as
        // a normal error message rather than as a problem in this list.
        "problems": [
          {
            // "message" is the string that resulted from evaluating the
            // error_message argument of the failing condition.
            "message": "Server does not have a public IPv6 address."
          }
        ]
      },
    ]
  }
]

"checks" 모델은 정적 체크 가능한 객체와 해당 객체의 인스턴스를 모두 포함해서, 오류가 구성의 전체 평가를 방해하더라도 체크 가능한 객체 집합이 일관되도록 보장해요. 관련 체크가 있는 구성의 모든 객체(예: precondition 또는 postcondition이 있는 리소스)는 런타임 오류가 Terraform이 "count" 또는 "for_each" 인자를 평가하여 해당 객체의 어떤 인스턴스가 동적으로 존재하는지 결정하는 것을 방해하더라도 항상 체크 가능한 객체로 포함돼요.

UI에서 체크를 요약할 때는 개별 인스턴스만 나열하고 최상위 객체는 일반적으로 무시하는 것을 권장해요. 그러나 객체에 인스턴스가 0개인 경우 UI는 최상위 객체를 대신 표시해 자리 표시자 역할을 하게 해서, 최근 실행에서 체크를 평가하지 못했더라도 사용자가 Terraform이 체크의 존재를 인식했다는 것을 볼 수 있게 해야 해요.

더 알아보기 (Learn more)