State files from projects using TF >=1.5 and the `check` block cannot be loaded as remote state by TF >=1.3, <1.5

[evan-cleary]

Terraform Version

Terraform v1.4.6
on darwin_amd64

Terraform Configuration Files

https://github.com/evan-cleary/tf1_5-state-compatibility

Debug Output

https://gist.github.com/evan-cleary/d036479be1c61dc2c09625928c90aec1

Expected Behavior

We expected that state files generated by the 1.X family would be compatible within the 1.X family.

Actual Behavior

Terraform state files generated by version >= 1.5 cannot be loaded as remote state data source by terraform configurations >=1.3, < 1.5 if the source configuration uses check blocks.

Produces error:
Error: unsupported checkable object kind "check"

Steps to Reproduce

Provided repository has an example set of terraform configurations that replicate the seen behavior.

If you have tfenv installed on your system you can run ./run_test.sh to see behavior.

If you do not have tfenv installed on your system

1. Download TF 1.4.6, or any version >=1.3, <1.5, binary and place terraform binary in tf1_X directory
2. Download TF 1.5.X binary and place terraform binary in tf1_5 directory
3. Run ./run_test.sh

Additional Context

We have multiple terraform configuration in our organizations with varying versions of terraform 1.X throughout. If any one project upgrades to >= 1.5 and uses the new check blocks, this would break automation for any configuration that utilizes that projects remote state.

Experimentation has determined that tf >=1.5 state files can be loaded by version >=1.0, <1.3

References

No response

[crw]

Thanks for this report. Please note that this level of backwards compatibility is explicitly called out as not being supported in the Terraform v1.x Compatibility Promises. That said, I will leave this issue open as a solution may be possible. Thanks!

[evan-cleary]

@crw Any reason the state file version was not updated to V5 under this condition? Is compatibility within a state file version not guaranteed?

The current implementation of the check_results section parsing results in a breaking change to state file parsing every time a CheckableKind is added.

Comments around check_result parsing indicates there was, at one point, an intent for forward compatibility.

terraform/internal/states/statefile/version4.go

Lines 648 to 653 in 9e9a78e

	default:
	// We'll treat anything else as invalid just as a concession to
	// forward-compatible parsing, in case a later version of Terraform
	// introduces a new status.
	return addrs.CheckableKindInvalid
	}

[alisdair]

Thanks for reporting this!

This narrow incompatibility was unforeseen, and we'd like to find a way to address it. We're currently looking into options for a fix. I'll update this ticket when we have a decision and a plan.