Malformed config.tf file when first creating backend layer

[juanmatias]

Describe the Bug

When crating a fresh backend layer, the s3 key must be commented out and init must be done with leverage tofu init --skip-validation.

The process fails as follows:

 ❯ leverage tofu init --skip-validation
[18:28:59.333] ERROR    Malformed config.tf file. Unable to parse.

Expected Behavior

The backend layer should be correctly initialized, so it can be applied and then, with command leverage tofu init the backend should be migrated to the newly created bucket.

Steps to Reproduce

Steps to reproduce the behavior:

1. Create a new backend layer
2. Go to to the new layer
3. Ensure s3 key is commented out in the config.tf file
4. Run leverage tofu init --skip-validation
5. See error as described above

Environment (please complete the following information):

Anything that will help us triage the bug will help. Here are some ideas:

❯ leverage --version
leverage, version 3.0.0
❯ uname -s -r -v -m -o
Linux 7.1.5-zen1-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Sun, 26 Jul 2026 00:48:55 +0000 x86_64 GNU/Linux
❯ python --version                                                                                                    
Python 3.14.6                    
❯ tofu --version                                                                   
OpenTofu v1.10.8                                                                     

Additional Context

Additional analysis and possible fix added as comment.

[juanmatias]

Report: Root Cause of leverage tofu init Error

Error

New backend layer.
In config.tf the s3 key lines are commented out.

Error:

❯ leverage tofu init --skip-validation
[18:28:59.333] ERROR    Malformed config.tf file. Unable to parse.

Testing it with s3 key lines uncommented worked ok (failed because bucket does not exist).

Testing it with s3 key lines deleted failed with same message.

Root Cause — 3 bugs in the installed leverage CLI

All three bugs are in /home/jdelacamara/Work/OvenLabs/code/ovenlabs-leverage-infra/.venv/lib/python3.14/site-packages/leverage/_backend_config.py.

────────────────────────────────────────────────────────────────────────────────

Bug 1 — Exception swallowing (wrong error message shown)

get_backend_key() has a try/except tree. The else branch correctly detects the commented-out backend block and raises an ExitError with a specific message:

  Malformed config.tf file. Missing backend block.
  In some cases you may want to skip this check by using the --skip-validation flag...

But ExitError extends Exception, so the bare except Exception handler catches it and re-raises with the generic:

  Malformed config.tf file. Unable to parse.

The helpful message is silently discarded.

Fix: Added except ExitError: raise before the generic handler.

────────────────────────────────────────────────────────────────────────────────

Bug 2 — get_backend_key raises instead of returning None

Its return type is Optional[str], and both callers handle None gracefully:

• invoke_for_all_commands (tf.py:275): if not get_backend_key(...) → calls set_backend_key
• _validate_layout (tf.py:510): if backend_key := get_backend_key(...) → logs "No backend key found"

Yet the else branch raised ExitError instead of returning None.

Fix: Changed else: raise ExitError(...) to else: return None.

────────────────────────────────────────────────────────────────────────────────

Bug 3 — set_backend_key requires a pre-existing backend block

set_backend_key had a strict validation gate checking that the backend "s3" block exists before adding the key. For bootstrap tf-backend layers, the block is intentionally commented out (# Uncomment after
first \apply``). This created a catch-22: the code path wanted to set the key, but its own validation prevented it.

Fix: Changed the validation from a hard error to a no-op — if no backend block exists, set_backend_key simply returns without modifying the file.

────────────────────────────────────────────────────────────────────────────────

Why --skip-validation also failed

--skip-validation skips validate_for_all_commands() → _validate_layout(), but the same code path still runs get_backend_key() → set_backend_key() in invoke_for_all_commands() (tf.py:274-278). Bug 2 (exception instead of None) caused that path to fail regardless of the flag.

[juanmatias]

Workaroud report

All edits were in a single file. Here's the summary:

File Changed

/home/jdelacamara/Work/OvenLabs/code/ovenlabs-leverage-infra/.venv/lib/python3.14/site-packages/leverage/_backend_config.py

Fix 1 — get_backend_key(): return None instead of raising

Before:

  if (structure_checks):
      return config_tf["terraform"][0]["backend"][0]["s3"].get("key")
  else:
      raise ExitError(1, f"Malformed config.tf file. Missing backend block.\n...")

After:

  if (structure_checks):
      return config_tf["terraform"][0]["backend"][0]["s3"].get("key")
  else:
      return None

The else branch raised ExitError when the backend block was missing (commented out). Both callers (invoke_for_all_commands and _validate_layout in tf.py) already handle a None return gracefully — they either
call set_backend_key or log "No backend key found."

────────────────────────────────────────────────────────────────────────────────
────────────────────────────────────────────────────────────────────────────────

Fix 2 — get_backend_key(): exception chaining (defensive)

Before:

  except lark.exceptions.UnexpectedInput as error:
      raise ExitError(1, ...)
  except Exception:
      raise ExitError(1, "Malformed config.tf file. Unable to parse.")

After:

  except lark.exceptions.UnexpectedInput as error:
      raise ExitError(1, ...)
  except ExitError:
      raise
  except Exception as e:
      raise ExitError(1, f"Malformed config.tf file. Unable to parse: {e}")

Added except ExitError: raise so any ExitError raised inside the try block propagates instead of being swallowed by the bare Exception handler. Also prints the real exception in the catch-all so genuine parse
failures aren't opaque.

────────────────────────────────────────────────────────────────────────────────

Fix 3 — set_backend_key(): no-op instead of error when backend block missing

Before (hard error):

  if not (structure_checks):
      raise ExitError(1, f"Malformed config.tf: File must contain a terraform block with an S3 backend.\n...")

  backend_config = config_tf["terraform"][0]["backend"][0]["s3"]
  key_exists = "key" in backend_config
  modified_content = _modify_backend_key(content, key, key_exists)
  config_file_path.write_text(modified_content)

After (graceful skip):

  if (structure_checks):
      backend_config = config_tf["terraform"][0]["backend"][0]["s3"]
      key_exists = "key" in backend_config
      modified_content = _modify_backend_key(content, key, key_exists)
      config_file_path.write_text(modified_content)
  else:
      # No backend block yet (e.g. bootstrap tf-backend layer with commented-out backend)
      pass

The validation gate was inverted from a hard error to a conditional. If no backend "s3" block exists (commented out), it silently skips — the user will uncomment and re-run tofu init after apply.