configs: Refined error messages for mismatched provider passing

This set of diagnostic messages is under a number of unusual constraints
that make them tough to get right:
 - They are discussing a couple finicky concepts which authors are
   likely to be encountering for the first time in these error messages:
   the idea of "local names" for providers, the relationship between those
   and provider source addresses, and additional ("aliased") provider
   configurations.
 - They are reporting concerns that span across a module call boundary,
   and so need to take care to be clear about whether they are talking
   about a problem in the caller or a problem in the callee.
 - Some of them are effectively deprecation warnings for features that
   might be in use by a third-party module that the user doesn't control,
   in which case they have no recourse to address them aside from opening
   a feature request with the upstream module maintainer.
 - Terraform has, for backward-compatibility reasons, a lot of implied
   default behaviors regarding providers and provider configurations,
   and these errors can arise in situations where Terraform's assumptions
   don't match the author's intent, and so we need to be careful to
   explain what Terraform assumed in order to make the messages
   understandable.

After seeing some confusion with these messages in the community, and
being somewhat confused by some of them myself, I decided to try to edit
them a bit for consistency of terminology (both between the messages and
with terminology in our docs), being explicit about caller vs. callee
by naming them in the messages, and making explicit what would otherwise
be implicit with regard to the correspondences between provider source
addresses and local names.

My assumed audience for all of these messages is the author of the caller
module, because it's the caller who is responsible for creating the
relationship between caller and callee. As much as possible I tried to
make the messages include specific actions for that author to take to
quiet the warning or fix the error, but some of the warnings are only
fixable by the callee's maintainer and so those messages are, in effect,
a suggestion to send a request to the author to stop using a deprecated
feature.

I think these new messages are also not ideal by any means, because it's
just tough to pack so much information into concise messages while being
clear and consistent, but I hope at least this will give users seeing
these messages enough context to infer what's going on, possibly with the
help of our documentation.

I intentionally didn't change which cases Terraform will return warnings
or errors -- only the message texts -- although I did highlight in a
comment in one of the tests that what it is a asserting seems a bit
suspicious to me. I don't intend to address that here; instead, I intend
that note to be something to refer to if we later see a bug report that
calls that behavior into question.

This does actually silence some _unrelated_ warnings and errors in cases
where a provider block has an invalid provider local name as its label,
because our other functions for dealing with provider addresses are
written to panic if given invalid addresses under the assumption that
earlier code will have guarded against that. Doing this allowed for the
provider configuration validation logic to safely include more information
about the configuration as helpful context, without risking tripping over
known-invalid configuration and panicking in the process.

internal/configs/config_build.go

@@ -31,7 +31,7 @@ func BuildConfig(root *Module, walker ModuleWalker) (*Config, hcl.Diagnostics) {
 		cfg.resolveProviderTypes()
 	}
 
-	diags = append(diags, validateProviderConfigs(nil, cfg, false)...)
+	diags = append(diags, validateProviderConfigs(nil, cfg, nil)...)
 
 	return cfg, diags
 }

internal/configs/config_build_test.go

@@ -224,7 +224,7 @@ func TestBuildConfigInvalidModules(t *testing.T) {
 				}
 
 				if !found {
-					t.Errorf("Expected error diagnostic containing %q", msg)
+					t.Errorf("Expected error diagnostic containing:\n    %s", msg)
 				}
 			}
 
@@ -241,7 +241,7 @@ func TestBuildConfigInvalidModules(t *testing.T) {
 				}
 
 				if !found {
-					t.Errorf("Unexpected error: %q", diag)
+					t.Errorf("Unexpected error:\n    %s", diag)
 				}
 			}
 
@@ -255,7 +255,7 @@ func TestBuildConfigInvalidModules(t *testing.T) {
 				}
 
 				if !found {
-					t.Errorf("Expected warning diagnostic containing %q", msg)
+					t.Errorf("Expected warning diagnostic containing:\n    %s", msg)
 				}
 			}
 
@@ -272,7 +272,7 @@ func TestBuildConfigInvalidModules(t *testing.T) {
 				}
 
 				if !found {
-					t.Errorf("Unexpected warning: %q", diag)
+					t.Errorf("Unexpected warning:\n    %s", diag)
 				}
 			}
 

internal/configs/provider.go

@@ -46,6 +46,11 @@ func decodeProviderBlock(block *hcl.Block) (*Provider, hcl.Diagnostics) {
 	name := block.Labels[0]
 	nameDiags := checkProviderNameNormalized(name, block.DefRange)
 	diags = append(diags, nameDiags...)
+	if nameDiags.HasErrors() {
+		// If the name is invalid then we mustn't produce a result because
+		// downstreams could try to use it as a provider type and then crash.
+		return nil, diags
+	}
 
 	provider := &Provider{
 		Name:      name,

internal/configs/provider_validation.go

@@ -2,6 +2,7 @@ package configs
 
 import (
 	"fmt"
+	"sort"
 	"strings"
 
 	"github.com/hashicorp/hcl/v2"
@@ -20,10 +21,11 @@ import (
 // passed in through the module call.
 //
 // The call argument is the ModuleCall for the provided Config cfg. The
-// noProviderConfig argument is passed down the call stack, indicating that the
+// noProviderConfigRange argument is passed down the call stack, indicating
-// module call, or a parent module call, has used a feature that precludes
+// that the module call, or a parent module call, has used a feature (at the
-// providers from being configured at all within the module.
+// specified source location) that precludes providers from being configured at
-func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConfig bool) (diags hcl.Diagnostics) {
+// all within the module.
+func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConfigRange *hcl.Range) (diags hcl.Diagnostics) {
 	mod := cfg.Module
 
 	for name, child := range cfg.Children {
@@ -32,8 +34,24 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 		// if the module call has any of count, for_each or depends_on,
 		// providers are prohibited from being configured in this module, or
 		// any module beneath this module.
-		nope := noProviderConfig || mc.Count != nil || mc.ForEach != nil || mc.DependsOn != nil
+		// NOTE: If noProviderConfigRange was already set but we encounter
-		diags = append(diags, validateProviderConfigs(mc, child, nope)...)
+		// a nested conflicting argument then we'll overwrite the caller's
+		// range, which allows us to report the problem as close to its
+		// cause as possible.
+		switch {
+		case mc.Count != nil:
+			noProviderConfigRange = mc.Count.Range().Ptr()
+		case mc.ForEach != nil:
+			noProviderConfigRange = mc.ForEach.Range().Ptr()
+		case mc.DependsOn != nil:
+			if len(mc.DependsOn) > 0 {
+				noProviderConfigRange = mc.DependsOn[0].SourceRange().Ptr()
+			} else {
+				// Weird! We'll just use the call itself, then.
+				noProviderConfigRange = mc.DeclRange.Ptr()
+			}
+		}
+		diags = append(diags, validateProviderConfigs(mc, child, noProviderConfigRange)...)
 	}
 
 	// the set of provider configuration names passed into the module, with the
@@ -42,11 +60,11 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 
 	// the set of empty configurations that could be proxy configurations, with
 	// the source range of the empty configuration block.
-	emptyConfigs := map[string]*hcl.Range{}
+	emptyConfigs := map[string]hcl.Range{}
 
 	// the set of provider with a defined configuration, with the source range
 	// of the configuration block declaration.
-	configured := map[string]*hcl.Range{}
+	configured := map[string]hcl.Range{}
 
 	// the set of configuration_aliases defined in the required_providers
 	// block, with the fully qualified provider type.
@@ -54,26 +72,22 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 
 	// the set of provider names defined in the required_providers block, and
 	// their provider types.
-	localNames := map[string]addrs.AbsProviderConfig{}
+	localNames := map[string]addrs.Provider{}
 
 	for _, pc := range mod.ProviderConfigs {
 		name := providerName(pc.Name, pc.Alias)
 		// Validate the config against an empty schema to see if it's empty.
 		_, pcConfigDiags := pc.Config.Content(&hcl.BodySchema{})
 		if pcConfigDiags.HasErrors() || pc.Version.Required != nil {
-			configured[name] = &pc.DeclRange
+			configured[name] = pc.DeclRange
 		} else {
-			emptyConfigs[name] = &pc.DeclRange
+			emptyConfigs[name] = pc.DeclRange
 		}
 	}
 
 	if mod.ProviderRequirements != nil {
 		for _, req := range mod.ProviderRequirements.RequiredProviders {
-			addr := addrs.AbsProviderConfig{
+			localNames[req.Name] = req.Type
-				Module:   cfg.Path,
-				Provider: req.Type,
-			}
-			localNames[req.Name] = addr
 			for _, alias := range req.Aliases {
 				addr := addrs.AbsProviderConfig{
 					Module:   cfg.Path,
@@ -125,11 +139,15 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 			// configuration. We ignore empty configs, because they will
 			// already produce a warning.
 			if !(confOK || localOK) {
+				defAddr := addrs.NewDefaultProvider(name)
 				diags = append(diags, &hcl.Diagnostic{
 					Severity: hcl.DiagWarning,
-					Summary:  fmt.Sprintf("Provider %s is undefined", name),
+					Summary:  "Reference to undefined provider",
-					Detail: fmt.Sprintf("No provider named %s has been declared in %s.\n", name, moduleText) +
+					Detail: fmt.Sprintf(
-						fmt.Sprintf("If you wish to refer to the %s provider within the module, add a provider configuration, or an entry in the required_providers block.", name),
+						"There is no explicit declaration for local provider name %q in %s, so Terraform is assuming you mean to pass a configuration for provider %q.\n\nTo clarify your intent and silence this warning, add to %s a required_providers entry named %q with source = %q, or a different source address if appropriate.",
+						name, moduleText, defAddr.ForDisplay(),
+						parentModuleText, name, defAddr.ForDisplay(),
+					),
 					Subject: &passed.InParent.NameRange,
 				})
 				continue
@@ -139,12 +157,16 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 			// there won't be a configuration available at runtime if the
 			// parent module did not pass one in.
 			if !cfg.Path.IsRoot() && !(confOK || passedOK) {
+				defAddr := addrs.NewDefaultProvider(name)
 				diags = append(diags, &hcl.Diagnostic{
 					Severity: hcl.DiagWarning,
-					Summary:  fmt.Sprintf("No configuration passed in for provider %s in %s", name, cfg.Path),
+					Summary:  "Missing required provider configuration",
-					Detail: fmt.Sprintf("Provider %s is referenced within %s, but no configuration has been supplied.\n", name, moduleText) +
+					Detail: fmt.Sprintf(
-						fmt.Sprintf("Add a provider named %s to the providers map for %s in %s.", name, cfg.Path, parentModuleText),
+						"The configuration for %s expects to inherit a configuration for provider %s with local name %q, but %s doesn't pass a configuration under that name.\n\nTo satisfy this requirement, add an entry for %q to the \"providers\" argument in the module %q block.",
-					Subject: &passed.InParent.NameRange,
+						moduleText, defAddr.ForDisplay(), name, parentModuleText,
+						name, parentCall.Name,
+					),
+					Subject: parentCall.DeclRange.Ptr(),
 				})
 			}
 		}
@@ -156,11 +178,20 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 	}
 
 	// there cannot be any configurations if no provider config is allowed
-	if len(configured) > 0 && noProviderConfig {
+	if len(configured) > 0 && noProviderConfigRange != nil {
+		// We report this from the perspective of the use of count, for_each,
+		// or depends_on rather than from inside the module, because the
+		// recipient of this message is more likely to be the author of the
+		// calling module (trying to use an older module that hasn't been
+		// updated yet) than of the called module.
 		diags = append(diags, &hcl.Diagnostic{
 			Severity: hcl.DiagError,
-			Summary:  fmt.Sprintf("Module %s contains provider configuration", cfg.Path),
+			Summary:  "Module is incompatible with count, for_each, and depends_on",
-			Detail:   "Providers cannot be configured within modules using count, for_each or depends_on.",
+			Detail: fmt.Sprintf(
+				"The module at %s is a legacy module which contains its own local provider configurations, and so calls to it may not use the count, for_each, or depends_on arguments.\n\nIf you also control the module %q, consider updating this module to instead expect provider configurations to be passed by its caller.",
+				cfg.Path, cfg.SourceAddr,
+			),
+			Subject: noProviderConfigRange,
 		})
 	}
 
@@ -170,7 +201,10 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 			diags = append(diags, &hcl.Diagnostic{
 				Severity: hcl.DiagError,
 				Summary:  "Cannot override provider configuration",
-				Detail:   fmt.Sprintf("Provider %s is configured within the module %s and cannot be overridden.", name, cfg.Path),
+				Detail: fmt.Sprintf(
+					"The configuration of %s has its own local configuration for %s, and so it cannot accept an overridden configuration provided by %s.",
+					moduleText, name, parentModuleText,
+				),
 				Subject: &passed.InChild.NameRange,
 			})
 		}
@@ -188,9 +222,12 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 
 		diags = append(diags, &hcl.Diagnostic{
 			Severity: hcl.DiagError,
-			Summary:  fmt.Sprintf("No configuration for provider %s", name),
+			Summary:  "Missing required provider configuration",
-			Detail: fmt.Sprintf("Configuration required for %s.\n", providerAddr) +
+			Detail: fmt.Sprintf(
-				fmt.Sprintf("Add a provider named %s to the providers map for %s in %s.", name, cfg.Path, parentModuleText),
+				"The child module requires an additional configuration for provider %s, with the local name %q.\n\nRefer to the module's documentation to understand the intended purpose of this additional provider configuration, and then add an entry for %s in the \"providers\" meta-argument in the module block to choose which provider configuration the module should use for that purpose.",
+				providerAddr.Provider.ForDisplay(), name,
+				name,
+			),
 			Subject: &parentCall.DeclRange,
 		})
 	}
@@ -214,7 +251,7 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 
 		localAddr, localName := localNames[name]
 		if localName {
-			providerAddr = localAddr
+			providerAddr.Provider = localAddr
 		}
 
 		aliasAddr, configAlias := configAliases[name]
@@ -225,20 +262,30 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 		_, emptyConfig := emptyConfigs[name]
 
 		if !(localName || configAlias || emptyConfig) {
-			severity := hcl.DiagError
 
 			// we still allow default configs, so switch to a warning if the incoming provider is a default
 			if providerAddr.Provider.IsDefault() {
-				severity = hcl.DiagWarning
-			}
-
 				diags = append(diags, &hcl.Diagnostic{
-				Severity: severity,
+					Severity: hcl.DiagWarning,
-				Summary:  fmt.Sprintf("Provider %s is undefined", name),
+					Summary:  "Reference to undefined provider",
-				Detail: fmt.Sprintf("Module %s does not declare a provider named %s.\n", cfg.Path, name) +
+					Detail: fmt.Sprintf(
-					fmt.Sprintf("If you wish to specify a provider configuration for the module, add an entry for %s in the required_providers block within the module.", name),
+						"There is no explicit declaration for local provider name %q in %s, so Terraform is assuming you mean to pass a configuration for %q.\n\nIf you also control the child module, add a required_providers entry named %q with the source address %q.",
+						name, moduleText, providerAddr.Provider.ForDisplay(),
+						name, providerAddr.Provider.ForDisplay(),
+					),
 					Subject: &passed.InChild.NameRange,
 				})
+			} else {
+				diags = append(diags, &hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Reference to undefined provider",
+					Detail: fmt.Sprintf(
+						"The child module does not declare any provider requirement with the local name %q.\n\nIf you also control the child module, you can add a required_providers entry named %q with the source address %q to accept this provider configuration.",
+						name, name, providerAddr.Provider.ForDisplay(),
+					),
+					Subject: &passed.InChild.NameRange,
+				})
+			}
 		}
 
 		// The provider being passed in must also be of the correct type.
@@ -264,40 +311,126 @@ func validateProviderConfigs(parentCall *ModuleCall, cfg *Config, noProviderConf
 		}
 
 		if !providerAddr.Provider.Equals(parentAddr.Provider) {
+			// If this module declares the same source address for a different
+			// local name then we'll prefer to suggest changing to match
+			// the child module's chosen name, assuming that it was the local
+			// name that was wrong rather than the source address.
+			var otherLocalName string
+			for localName, sourceAddr := range localNames {
+				if sourceAddr.Equals(parentAddr.Provider) {
+					otherLocalName = localName
+					break
+				}
+			}
+
+			const errSummary = "Provider type mismatch"
+			if otherLocalName != "" {
 				diags = append(diags, &hcl.Diagnostic{
 					Severity: hcl.DiagError,
-				Summary:  fmt.Sprintf("Invalid type for provider %s", providerAddr),
+					Summary:  errSummary,
-				Detail: fmt.Sprintf("Cannot use configuration from %s for %s. ", parentAddr, providerAddr) +
+					Detail: fmt.Sprintf(
-					"The given provider configuration is for a different provider type.",
+						"The assigned configuration is for provider %q, but local name %q in %s represents %q.\n\nTo pass this configuration to the child module, use the local name %q instead.",
+						parentAddr.Provider.ForDisplay(), passed.InChild.Name,
+						parentModuleText, providerAddr.Provider.ForDisplay(),
+						otherLocalName,
+					),
 					Subject: &passed.InChild.NameRange,
 				})
+			} else {
+				// If there is no declared requirement for the provider the
+				// caller is trying to pass under any name then we'll instead
+				// report it as an unsuitable configuration to pass into the
+				// child module's provider configuration slot.
+				diags = append(diags, &hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  errSummary,
+					Detail: fmt.Sprintf(
+						"The local name %q in %s represents provider %q, but %q in %s represents %q.\n\nEach provider has its own distinct configuration schema and provider types, so this module's %q can be assigned only a configuration for %s, which is not required by %s.",
+						passed.InParent, parentModuleText, parentAddr.Provider.ForDisplay(),
+						passed.InChild, moduleText, providerAddr.Provider.ForDisplay(),
+						passed.InChild, providerAddr.Provider.ForDisplay(),
+						moduleText,
+					),
+					Subject: passed.InParent.NameRange.Ptr(),
+				})
+			}
 		}
 	}
 
-	// Empty configurations are no longer needed
+	// Empty configurations are no longer needed. Since the replacement for
+	// this calls for one entry per provider rather than one entry per
+	// provider _configuration_, we'll first gather them up by provider
+	// and then report a single warning for each, whereby we can show a direct
+	// example of what the replacement should look like.
+	type ProviderReqSuggestion struct {
+		SourceAddr      addrs.Provider
+		SourceRanges    []hcl.Range
+		RequiredConfigs []string
+		AliasCount      int
+	}
+	providerReqSuggestions := make(map[string]*ProviderReqSuggestion)
 	for name, src := range emptyConfigs {
-		detail := fmt.Sprintf("Remove the %s provider block from %s.", name, cfg.Path)
+		providerLocalName := name
-
+		if idx := strings.IndexByte(providerLocalName, '.'); idx >= 0 {
-		isAlias := strings.Contains(name, ".")
+			providerLocalName = providerLocalName[:idx]
-		_, isConfigAlias := configAliases[name]
-		_, isLocalName := localNames[name]
-
-		if isAlias && !isConfigAlias {
-			localName := strings.Split(name, ".")[0]
-			detail = fmt.Sprintf("Remove the %s provider block from %s. Add %s to the list of configuration_aliases for %s in required_providers to define the provider configuration name.", name, cfg.Path, name, localName)
 		}
 
-		if !isAlias && !isLocalName {
+		sourceAddr, ok := localNames[name]
-			// if there is no local name, add a note to include it in the
+		if !ok {
-			// required_provider block
+			sourceAddr = addrs.NewDefaultProvider(providerLocalName)
-			detail += fmt.Sprintf("\nTo ensure the correct provider configuration is used, add %s to the required_providers configuration", name)
 		}
 
+		suggestion := providerReqSuggestions[providerLocalName]
+		if suggestion == nil {
+			providerReqSuggestions[providerLocalName] = &ProviderReqSuggestion{
+				SourceAddr: sourceAddr,
+			}
+			suggestion = providerReqSuggestions[providerLocalName]
+		}
+
+		if providerLocalName != name {
+			// It's an aliased provider config, then.
+			suggestion.AliasCount++
+		}
+
+		suggestion.RequiredConfigs = append(suggestion.RequiredConfigs, name)
+		suggestion.SourceRanges = append(suggestion.SourceRanges, src)
+	}
+	for name, suggestion := range providerReqSuggestions {
+		var buf strings.Builder
+
+		fmt.Fprintf(
+			&buf,
+			"Earlier versions of Terraform used empty provider blocks (\"proxy provider configurations\") for child modules to declare their need to be passed a provider configuration by their callers. That approach was ambiguous and is now deprecated.\n\nIf you control this module, you can migrate to the new declaration syntax by removing all of the empty provider %q blocks and then adding or updating an entry like the following to the required_providers block of %s:\n",
+			name, moduleText,
+		)
+		fmt.Fprintf(&buf, "    %s = {\n", name)
+		fmt.Fprintf(&buf, "      source = %q\n", suggestion.SourceAddr.ForDisplay())
+		if suggestion.AliasCount > 0 {
+			// A lexical sort is fine because all of these strings are
+			// guaranteed to start with the same provider local name, and
+			// so we're only really sorting by the alias part.
+			sort.Strings(suggestion.RequiredConfigs)
+			fmt.Fprintln(&buf, "      configuration_aliases = [")
+			for _, addrStr := range suggestion.RequiredConfigs {
+				fmt.Fprintf(&buf, "        %s,\n", addrStr)
+			}
+			fmt.Fprintln(&buf, "      ]")
+
+		}
+		fmt.Fprint(&buf, "    }")
+
+		// We're arbitrarily going to just take the one source range that
+		// sorts earliest here. Multiple should be rare, so this is only to
+		// ensure that we produce a deterministic result in the edge case.
+		sort.Slice(suggestion.SourceRanges, func(i, j int) bool {
+			return suggestion.SourceRanges[i].String() < suggestion.SourceRanges[j].String()
+		})
 		diags = append(diags, &hcl.Diagnostic{
 			Severity: hcl.DiagWarning,
-			Summary:  "Empty provider configuration blocks are not required",
+			Summary:  "Redundant empty provider block",
-			Detail:   detail,
+			Detail:   buf.String(),
-			Subject:  src,
+			Subject:  suggestion.SourceRanges[0].Ptr(),
 		})
 	}
 

internal/configs/testdata/config-diagnostics/empty-configs/warnings

@@ -1,4 +1,4 @@
-empty-configs/mod/main.tf:10,1-15: Empty provider configuration blocks are not required; Remove the foo provider block from module.mod
+empty-configs/mod/main.tf:10,1-15: Redundant empty provider block; Earlier versions of Terraform used empty provider blocks ("proxy provider configurations") for child modules to declare their need to be passed a provider configuration by their callers. That approach was ambiguous and is now deprecated.
-empty-configs/mod/main.tf:13,1-15: Empty provider configuration blocks are not required; Remove the foo.bar provider block from module.mod
+If you control this module, you can migrate to the new declaration syntax by removing all of the empty provider "foo" blocks and then adding or updating an entry like the following to the required_providers block of module.mod:
-empty-configs/mod/main.tf:17,1-15: Empty provider configuration blocks are not required; Remove the baz provider block from module.mod.\nTo ensure the correct provider configuration is used, add baz to the required_providers configuration
+empty-configs/mod/main.tf:17,1-15: Redundant empty provider block; Earlier versions of Terraform used empty provider blocks ("proxy provider configurations") for child modules to declare their need to be passed a provider configuration by their callers. That approach was ambiguous and is now deprecated.
-empty-configs/mod/main.tf:20,1-15: Empty provider configuration blocks are not required; Remove the baz.bing provider block from module.mod. Add baz.bing to the list of configuration_aliases for baz in required_providers to define the provider configuration name
+If you control this module, you can migrate to the new declaration syntax by removing all of the empty provider "baz" blocks and then adding or updating an entry like the following to the required_providers block of module.mod:

internal/configs/testdata/config-diagnostics/incorrect-type/errors

@@ -1 +1 @@
-incorrect-type/main.tf:15,5-8: Invalid type for provider module.mod.provider["example.com/vendor/foo"]; Cannot use configuration from provider["registry.terraform.io/hashicorp/foo"] for module.mod.provider["example.com/vendor/foo"]
+incorrect-type/main.tf:15,11-14: Provider type mismatch; The local name "foo" in the root module represents provider "hashicorp/foo", but "foo" in module.mod represents "example.com/vendor/foo".

internal/configs/testdata/config-diagnostics/incorrect-type/warnings

@@ -1 +1 @@
-incorrect-type/main.tf:16,5-8: Provider baz is undefined; Module module.mod does not declare a provider named baz.\nIf you wish to specify a provider configuration for the module
+incorrect-type/main.tf:16,5-8: Reference to undefined provider; There is no explicit declaration for local provider name "baz" in module.mod, so Terraform is assuming you mean to pass a configuration for "hashicorp/baz".

internal/configs/testdata/config-diagnostics/invalid-provider/warnings

@@ -1 +0,0 @@
-Empty provider configuration blocks are not required

internal/configs/testdata/config-diagnostics/nested-provider/errors

@@ -1,3 +1 @@
-Module module.child.module.child2 contains provider configuration; Providers cannot be configured within modules using count, for_each or depends_on
+nested-provider/root.tf:2,11-12: Module is incompatible with count, for_each, and depends_on; The module at module.child.module.child2 is a legacy module which contains its own local provider configurations, and so calls to it may not use the count, for_each, or depends_on arguments.
-
-

internal/configs/testdata/config-diagnostics/override-provider/errors

@@ -1 +1 @@
-override-provider/main.tf:17,5-8: Cannot override provider configuration; Provider bar is configured within the module module.mod and cannot be overridden.
+override-provider/main.tf:17,5-8: Cannot override provider configuration; The configuration of module.mod has its own local configuration for bar, and so it cannot accept an overridden configuration provided by the root module.

internal/configs/testdata/config-diagnostics/pass-inherited-provider/main.tf

@@ -5,3 +5,19 @@ provider "test" {
 module "mod" {
   source = "./mod"
 }
+
+# FIXME: This test is for an awkward interaction that we've preserved for
+# compatibility with what was arguably a bug in earlier versions: if a
+# child module tries to use an inherited provider configuration explicitly by
+# name then Terraform would historically use the wrong provider configuration.
+#
+# Since we weren't able to address that bug without breaking backward
+# compatibility, instead we emit a warning to prompt the author to be explicit,
+# passing in the configuration they intend to use.
+#
+# This case is particularly awkward because a change in the child module
+# (previously referring to a provider only implicitly, but now naming it
+# explicitly) can cause a required change in _this_ module (the caller),
+# even though the author of the child module would've seen no explicit warning
+# that they were making a breaking change. Hopefully we can improve on this
+# in a future language edition.

internal/configs/testdata/config-diagnostics/pass-inherited-provider/warnings

@@ -1 +1 @@
-pass-inherited-provider/mod/main.tf:15,16-20: No configuration passed in for provider test in module.mod; Provider test is referenced within module.mod, but no configuration has been supplied
+pass-inherited-provider/main.tf:5,1-13: Missing required provider configuration; The configuration for module.mod expects to inherit a configuration for provider hashicorp/test with local name "test", but the root module doesn't pass a configuration under that name.

internal/configs/testdata/config-diagnostics/required-alias/errors

@@ -1 +1 @@
-required-alias/main.tf:1,1-13: No configuration for provider foo.bar; Configuration required for module.mod.provider["registry.terraform.io/hashicorp/foo"].bar
+required-alias/main.tf:1,1-13: Missing required provider configuration; The child module requires an additional configuration for provider hashicorp/foo, with the local name "foo.bar".

internal/configs/testdata/config-diagnostics/unexpected-provider/warnings

@@ -1,2 +1 @@
-unexpected-provider/main.tf:13,5-8: Provider foo is undefined; Module module.mod does not declare a provider named foo.
+unexpected-provider/main.tf:13,5-8: Reference to undefined provider; There is no explicit declaration for local provider name "foo" in module.mod, so Terraform is assuming you mean to pass a configuration for "hashicorp/foo".
-

internal/configs/testdata/config-diagnostics/unknown-root-provider/warnings

@@ -1 +1 @@
-unknown-root-provider/main.tf:5,11-14: Provider bar is undefined; No provider named bar has been declared in the root module
+unknown-root-provider/main.tf:5,11-14: Reference to undefined provider; There is no explicit declaration for local provider name "bar" in the root module, so Terraform is assuming you mean to pass a configuration for provider "hashicorp/bar".