config: validate provisioner splats can only reference others

config/config.go

@@ -404,6 +404,20 @@ func (c *Config) Validate() error {
 					break
 				}
 			}
+
+			for _, v := range p.RawConfig.Variables {
+				rv, ok := v.(*ResourceVariable)
+				if !ok {
+					continue
+				}
+
+				if rv.Multi && rv.Index == -1 && rv.Type == r.Type && rv.Name == r.Name {
+					errs = append(errs, fmt.Errorf(
+						"%s: connection info cannot contain splat variable "+
+							"referencing itself", n))
+					break
+				}
+			}
 		}
 	}
 

config/config_test.go

@@ -193,6 +193,20 @@ func TestConfigValidate_provConnSplatSelf(t *testing.T) {
 	}
 }
 
+func TestConfigValidate_provSplatOther(t *testing.T) {
+	c := testConfig(t, "validate-prov-splat-other")
+	if err := c.Validate(); err != nil {
+		t.Fatalf("should be valid: %s", err)
+	}
+}
+
+func TestConfigValidate_provSplatSelf(t *testing.T) {
+	c := testConfig(t, "validate-prov-splat-self")
+	if err := c.Validate(); err == nil {
+		t.Fatal("should not be valid")
+	}
+}
+
 func TestConfigValidate_unknownThing(t *testing.T) {
 	c := testConfig(t, "validate-unknownthing")
 	if err := c.Validate(); err == nil {

config/test-fixtures/validate-prov-splat-other/main.tf

@@ -0,0 +1,7 @@
+resource "aws_instance" "foo" {}
+
+resource "aws_instance" "bar" {
+    provisioner "local-exec" {
+        command = "${element(aws_instance.foo.*.private_ip, 0)}"
+    }
+}

config/test-fixtures/validate-prov-splat-self/main.tf

@@ -0,0 +1,7 @@
+resource "aws_instance" "foo" {}
+
+resource "aws_instance" "bar" {
+    provisioner "local-exec" {
+        command = "${element(aws_instance.bar.*.private_ip, 0)}"
+    }
+}