Terraform: Can't conditionally define list

[walterdolce]

Hi @apparentlymart,
This is a follow-up to #13733 as I have just come across this.

It seems the following is not working for me:

resource "aws_instance" "ec2" {
      vpc_security_group_ids = "${split(" ", terraform.env == "production" ? "${aws_security_group.first_sg.id} ${aws_security_group.second_sg.id} ${aws_security_group.production_sg.id}" : "${aws_security_group.first_sg.id} ${aws_security_group.second_sg.id} ${aws_security_group.staging_sg.id}")}"

}

Neither that works, nor the following (which is my first attempt at conditionally adding an item to a list:

resource "aws_instance" "ec2" {
    vpc_security_group_ids = [
        "${terraform.env == "production" ? "${aws_security_group.production_sg.id}" : "${aws_security_group.staging_sg.id}" }",
         "${aws_security_group.first_sg.id}",
         "${aws_security_group.second_sg.id}",
    ]
}

Terraform Version

Terraform v0.10.8

[apparentlymart]

Hi @walterdolce,

Can you share the error you got when you tried both of these options? At first glance it seems like it should work, but I assume there's some detail here I'm not seeing just from reading the config.

[walterdolce]

Hi @apparentlymart, thanks for coming back to me on this!

In the first example, the error reported is simply "Parameter X in resource Y should be a list". However, in the second example, there is no error but terraform always thinks that ${terraform.env} is set to production even when it's not.

[apparentlymart]

It sounds like there's some strange bug going on here. It might be a weird handling of those ids being <computed>, causing Terraform to see the result as not being a list.

We're currently in the process of integrating a new parser/evaluator for the configuration language which should make this sort of thing work better, so unfortunately a solution here may have to wait until we get further along with that work. The new evaluator specifically separates the idea of <computed> from the idea of type checking, so it's possible to know that the result is a list even if the concrete value isn't yet known, and thus I think the new evaluator will work as expected here. (It also allows conditional expressions to be used with lists, so it'll also avoid the weirdness with split.)

[walterdolce]

Thanks so much @apparentlymart for the clarification. Anything I can do to help with this let me know!

[apparentlymart]

Hi again @walterdolce!

Looking back at this now after working through some other issues, it seems that this one is actually covering the same root cause as #12263, even though the symptoms are slightly different. This fix is merged into master and will be included in the forthcoming v0.12.0 final release.

Thanks for reporting this, and for your patience while we figured out what was going on here.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.