validate const is mutually exclusive with sensitive and ephemeral in variables

internal/configs/named_values.go

@@ -144,6 +144,25 @@ func decodeVariableBlock(block *hcl.Block, override bool) (*Variable, hcl.Diagno
 		v.ConstSet = true
 	}
 
+	if v.Const {
+		if v.Sensitive {
+			diags = append(diags, &hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Const variable cannot be sensitive",
+				Detail:   "A variable that is marked as \"const\" cannot also be marked as \"sensitive\".",
+				Subject:  v.DeclRange.Ptr(),
+			})
+		}
+		if v.Ephemeral {
+			diags = append(diags, &hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Const variable cannot be ephemeral",
+				Detail:   "A variable that is marked as \"const\" cannot also be marked as \"ephemeral\".",
+				Subject:  v.DeclRange.Ptr(),
+			})
+		}
+	}
+
 	if attr, exists := content.Attributes["nullable"]; exists {
 		valDiags := gohcl.DecodeExpression(attr.Expr, nil, &v.Nullable)
 		diags = append(diags, valDiags...)

internal/configs/testdata/error-files/const-ephemeral-variable.tf

@@ -0,0 +1,6 @@
+variable "example" { # ERROR: Const variable cannot be ephemeral
+  type      = string
+  default   = "hello"
+  const     = true
+  ephemeral = true
+}

internal/configs/testdata/error-files/const-sensitive-variable.tf

@@ -0,0 +1,6 @@
+variable "example" { # ERROR: Const variable cannot be sensitive
+  type      = string
+  default   = "hello"
+  const     = true
+  sensitive = true
+}