actions can not be used in depends_on

internal/configs/config_test.go

@@ -581,3 +581,19 @@ func TestConfigImportProviderWithNoResourceProvider(t *testing.T) {
 Use the provider argument in the target resource block to configure the provider for a resource with explicit provider configuration.`,
 	})
 }
+
+func TestConfigActionInResourceDependsOn(t *testing.T) {
+	src, err := os.ReadFile("testdata/invalid-modules/action-in-depends_on/action-in-resource-depends_on.tf")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	parser := testParser(map[string]string{
+		"main.tf": string(src),
+	})
+
+	_, diags := parser.LoadConfigFile("main.tf")
+	assertExactDiagnostics(t, diags, []string{
+		`main.tf:5,17-42: Invalid depends_on Action Reference; The depends_on attribute cannot reference action blocks directly. You must reference a resource or data source instead.`,
+	})
+}

internal/configs/depends_on.go

@@ -17,8 +17,18 @@ func DecodeDependsOn(attr *hcl.Attribute) ([]hcl.Traversal, hcl.Diagnostics) {
 
 		traversal, travDiags := hcl.AbsTraversalForExpr(expr)
 		diags = append(diags, travDiags...)
+
 		if len(traversal) != 0 {
-			ret = append(ret, traversal)
+			if traversal.RootName() == "action" {
+				diags = append(diags, &hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Invalid depends_on Action Reference",
+					Detail:   "The depends_on attribute cannot reference action blocks directly. You must reference a resource or data source instead.",
+					Subject:  expr.Range().Ptr(),
+				})
+			} else {
+				ret = append(ret, traversal)
+			}
 		}
 	}
 

internal/configs/testdata/invalid-modules/action-in-depends_on/action-in-resource-depends_on.tf

@@ -0,0 +1,11 @@
+action "aws_action" "example" {
+}
+
+resource "aws_instance" "web" {
+  depends_on = [action.aws_action.example]
+  ami        = "ami-1234"
+  security_groups = [
+    "foo",
+    "bar",
+  ]
+}

internal/terraform/node_resource_validate.go

@@ -811,6 +811,21 @@ func validateDependsOn(ctx EvalContext, dependsOn []hcl.Traversal) (diags tfdiag
 			})
 		}
 
+		// We don't allow depends_on on actions because their ordering is depending on the resource
+		// that triggers them, therefore users should use a depends_on on the resource instead.
+
+		if ref != nil {
+			switch ref.Subject.(type) {
+			case addrs.Action, addrs.ActionInstance:
+				diags = diags.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Invalid depends_on reference",
+					Detail:   "Actions can not be referenced in depends_on. Use depends_on on the resource that triggers the action instead.",
+					Subject:  traversal.SourceRange().Ptr(),
+				})
+			}
+		}
+
 		// The ref must also refer to something that exists. To test that,
 		// we'll just eval it and count on the fact that our evaluator will
 		// detect references to non-existent objects.