Terrascan fails to load .tf files that contain provider functions

[folksgl]

Terrascan does not seem to be able to properly parse .tf files that utilize Terraform Provider Functions. The following causes error cli/run.go:141 scan run failed{error 26 0 failed to load iac file

# Uses the azurerm provider function provider::azurerm::parse_resource_id(id).
# The user must either not provide a log analytics ID, or it must pass the provider function parsing to be valid.
variable "log_analytics_workspace_id" {
  type        = string
  description = "The ID of the Azure Log Analytics workspace where diagnostic logs will be sent."
  default     = null
  validation {
    condition     = var.log_analytics_workspace_id == null || can(provider::azurerm::parse_resource_id(var.log_analytics_workspace_id))
    error_message = "Provided Log Analytics Workspace ID could not be parsed. Please ensure you provide the full resource ID."
  }
}

[cooperglavin]

Any idea when this will get resolved? This is currently blocking our usage of Terrascan as we leverage azurerm provider functions more and more.

[amentee]

@folksgl @cooperglavin can you put your whole tf file that you trying to scan ?

[cooperglavin]

@amentee

I spun up a quick directory with a variables.tf that only includes the sample snippet from the original comment:

variables.tf:

# Uses the azurerm provider function provider::azurerm::parse_resource_id(id).
# The user must either not provide a log analytics ID, or it must pass the provider function parsing to be valid.
variable "log_analytics_workspace_id" {
  type        = string
  description = "The ID of the Azure Log Analytics workspace where diagnostic logs will be sent."
  default     = null
  validation {
    condition     = var.log_analytics_workspace_id == null || can(provider::azurerm::parse_resource_id(var.log_analytics_workspace_id))
    error_message = "Provided Log Analytics Workspace ID could not be parsed. Please ensure you provide the full resource ID."
  }
}

And got the following scan error when running $ terrascan scan:

-----------------------------------------------------------------------

        IaC Type            :   terraform
        Directory           :   /home/cglavin/terrascan_fail
        Error Message       :   diagnostic errors while loading terraform config dir '/home/cglavin/terrascan_fail'. error from terraform:
/home/cglavin/terrascan_fail/variables.tf:8,75-76: Missing argument separator; A comma is required to separate each function argument from the next.

-----------------------------------------------------------------------

Note - line 8 is the provider function: condition = var.log_analytics_workspace_id == null || can(provider::azurerm::parse_resource_id(var.log_analytics_workspace_id)), char 75-76 refers to the :: between provider and azurerm.

Let me know if there's any more information I can provide - atm it seems unable to parse the provider function and provide any feedback on the variables.tf file.

[amentee]

@cooperglavin It seems that provider function call does not work in variables.tf since variables blocks are checked very early, before providers are even configured . provider::azurerm::parse_resource_id() runs inside the provider plugin, which isn’t available until later (plan/apply phase).

You can try regex to make it work. Below is what I did but you can tweak.

variable "log_analytics_workspace_id" {
  type        = string
  description = "The ID of the Azure Log Analytics workspace where diagnostic logs will be sent."
  default     = null

  validation {
    condition     = var.log_analytics_workspace_id == null || can(regex("^/subscriptions/[0-9a-fA-F-]+/resourceGroups/[^/]+/providers/Microsoft.OperationalInsights/workspaces/[^/]+$", var.log_analytics_workspace_id))
    error_message = "Provided Log Analytics Workspace ID could not be parsed. Please ensure you provide the full resource ID."
  }
}


(base) sachinkum@KKV3077GPJ ~ % /usr/local/bin/terrascan scan -f terrascan_fail/variables.tf 



Scan Summary -

	File/Folder         :	/Users/sachinkum/terrascan_fail/variables.tf
	IaC Type            :	terraform
	Scanned At          :	2025-08-23 04:08:48.871937 +0000 UTC
	Policies Validated  :	785
	Violated Policies   :	0
	Low                 :	0
	Medium              :	0
	High                :	0
(base) sachinkum@KKV3077GPJ ~ % 

To use azure parse id , I believe it would be somewhere in your main.tf after the provider initialization - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/functions/parse_resource_id . Please let me know if that solves your issue

[folksgl]

@amentee We have been routinely using provider functions to validate variable.tf inputs within validation blocks across a wide number of repositories internally. Provider functions are supported by the language here, so I would assume that Terrascan should also allow it. The failure we are facing is not a terraform error, but an error during Terrascan's loading/parsing of the file.