fix: validate replace_triggered_by attribute references

[vietcgi]

Summary

• replace_triggered_by now reports an error when given an invalid attribute reference that does not exist in the target resource

Test plan

• Added unit test TestContext2Plan_triggeredByInvalidAttribute
• Existing replace_triggered_by tests pass
• Manual testing with null_resource confirms invalid references now produce errors
• Valid attribute references continue to work correctly

Fixes #36740

[SarahFrench]

Hi @vietcgi , thanks for your contribution!

I've left some minor comments on the changes in this PR, broadly it looks good but I have a small question around the nil/null checks.

In triage we discussed the original issue you're addressing and thought that ideally the solution would have two parts. Your proposed changes are the first part, by helping users identify when a bad reference is used during planning. Ideally users would also be able to use terraform validate to detect when their configuration has a bad reference in replace_triggered_by. This would let people identify when the defect first enters their configuration, instead of only identifying it when it first impacts a plan action. Would you be interested in implementing that second part in this PR, or separately? No worries if not, in that case I'd open a new issue for someone else to pick up.

[jbardin]

Hi @vietcgi,

Terraform needs to always account for resources which may contain dynamically typed values. The change proposed here would fail if those dynamically typed values were to change from one plan to the next. We can't exclude the replace_triggered_by references from traversing into dynamic types, because it's already been designed to do so. This means if we are going to have any more detailed diagnostics, those diagnostics will need to be derived from the target resource schema alone, and not rely on the current value type

[vietcgi]

Hi @jbardin,

Thanks for the feedback. You're righ. I've updated the implementation to use schema-based validation instead of value-based validation. The fix now uses StaticValidateTraversal to validate the attribute reference against the target resource's schema, which properly handles dynamically-typed attributes. This way we only error on truly invalid references that don't exist in the schema, rather than relying on the current value type which could change between plans.

[vietcgi]

Thanks @jbardin, good catch! Updated to use change.ProviderAddr directly. Much cleaner and handles cross-module provider configs correctly.

[jbardin]

Thanks!