Terraform validate and apply

Terraform Providers Azure
, ,
1

Hi,
I am using the following example to better understand terraform validation capabilities:

terraform {
  required_version = ">= 0.12"
}

provider "azurerm" {
  environment = "public"
  version     = ">= 2.0.0"
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example"
  location = "West Europe"
}

resource "azurerm_virtual_network" "example" {
  name                = "example-network"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_subnet" "example" {
  name                 = "internal"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.2.0/24"]
}

resource "azurerm_network_interface" "example" {
  name                = "example-nic"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.example.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_linux_virtual_machine" "example" {
  name                = "example-machine"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_F2s_v2"
  network_interface_ids = [azurerm_network_interface.example.id]

  disable_password_authentication = false
  admin_username      = "user"
  admin_ssh_key {
    username   = "user"
    public_key = "pub_key"
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "UbuntuServer"
    sku       = "16.04-LTS"
    version   = "latest"
  }
}

As you can see it is simply deploying a VM in vnet.

If I run terraform validate and terraform plan, no errors/warning will be showed.
Instead if I run terraform apply, I get the following error:

Error: An `admin_password` must be specified if `disable_password_authentication` is set to `false`

From my understanding the terraform validate command should point out this error but it is not.
Am I wrong? Are there any other command/tools that are able to statically validate terraform code?

Thanks