Catching Errors Before They Cause Damage
Terraform 1.2 introduced precondition and postcondition blocks — a way to encode assumptions and guarantees directly in your infrastructure code. Think of them as assert statements for infrastructure.
A precondition validates inputs before a resource is created or modified — for example, asserting that a resolved AMI's architecture is actually the one the instance type expects, and failing plan with a clear message if not. A postcondition validates the result after a resource is created, ensuring the cloud returned what you expected — asserting that the created instance actually got a public IP, and failing loudly if the subnet's auto-assign setting silently produced one without.
Preconditions and postconditions differ from validation blocks on variables in an important way: they can reference data sources, resource attributes, and local values — not just the variable's own value. This makes them suitable for cross-resource consistency checks that variable validation cannot express.