A module accepts an instance_count input. Any value above 20 must stop the run before Terraform makes a single provider API call. A teammate proposes a check block that asserts var.instance_count <= 20. Which approach meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
Here's the trick: a check block is a smoke alarm, not a sprinkler. It beeps, but the run keeps going. If you need a hard stop before anything happens, you want validation on the variable itself.
Full Explanation
Terraform offers several custom-condition mechanisms with different timing and severity. Input variable validation runs as soon as the value is known, before Terraform builds a plan, and a false condition produces an error that halts the operation; for a rule about one input's acceptable range, it is the earliest and most precise place to enforce it. A check block runs as the last step of plan and apply and reports a failed assertion as a warning, so Terraform continues and would still create 25 instances. A postcondition blocks downstream work, but it evaluates after Terraform has planned and applied the resource it is attached to, so the API calls the requirement forbids would already have happened. Output preconditions are not evaluated ahead of the module's resources; outputs depend on those resources, and the precondition guards the output value rather than the input that drives resource creation. Exam caveat: since Terraform 1.9 validation conditions may also reference other variables and objects, but a single-input range rule still belongs on that input. Operational check: run terraform plan with instance_count = 25 and confirm the run ends with the validation error message and no planned actions.