3.2.2. terraform validate

💡 First Principle: validate checks whether a configuration is internally coherent — correct syntax, valid references, consistent types — without ever leaving your machine, which is exactly why it's fast and why it can't catch problems that only exist in the real world.

terraform validate verifies that the configuration is syntactically valid and internally consistent: it checks that arguments are well-formed, references resolve, and types line up against provider schemas. It requires init first (to have the provider schemas) but does not access remote state, contact providers' APIs, or compare against real infrastructure.

Because it's purely local and structural, validate catches things like a typo'd attribute name or a reference to a nonexistent resource, but it cannot catch a region that doesn't exist in your account, an exhausted quota, or a permissions problem — those surface only at plan or apply.

⚠️ Exam Trap: The most-tested fact here: validate does not require credentials or network access to a provider's API, and does not guarantee a successful apply. If an answer says validate "confirms the configuration will deploy" or "checks the cloud account," it's wrong.

Reflection Question: Name one configuration problem validate will catch and one it cannot — and explain what distinguishes them.