Terraform: Splat expressions (.*) may not be used here - 0.12-dev

[Constantin07]

Terraform Version

v0.12.0-dev

Terraform Configuration Files

This is just an excerpt from configuration whcih contains .*.

...
main.tf:resource "aws_route_table_association" "public" {
main.tf:  count = "${length(local.availability_zones)}"
main.tf:  subnet_id      = "${element(aws_subnet.public.*.id, count.index)}"
main.tf:  route_table_id = "${aws_route_table.public.id}"
main.tf:}
main.tf:resource "aws_route_table_association" "private" {
main.tf:  count = "${length(local.availability_zones)}"
main.tf:  subnet_id      = "${element(aws_subnet.private.*.id, count.index)}"
main.tf:  route_table_id = "${element(aws_route_table.private.*.id, count.index)}"
main.tf:}

...

Debug Output

Crash Output

Expected Behavior

The plan should run OK on 0.12 (as it does with 0.11.10 now).

Actual Behavior

Fails with the below error:

21:03:42 Initialize S3 backend
[Pipeline] sh
21:03:43 + terraform init -get=true -upgrade=true -verify-plugins=true -force-copy
21:03:43 Upgrading modules...
21:03:43 - core in ../modules/vpc
21:03:43 - key_pairs in ../modules/key_pairs
21:03:43 
21:03:43 Initializing the backend...
21:03:45 
21:03:45 Successfully configured the backend "s3"! Terraform will automatically
21:03:45 use this backend unless the backend configuration changes.
21:03:46 Error refreshing state: 7 problems:
21:03:46 
21:03:46 - Attribute name required: Splat expressions (.*) may not be used here.
21:03:46 - Attribute name required: Splat expressions (.*) may not be used here.
21:03:46 - Attribute name required: Splat expressions (.*) may not be used here.
21:03:46 - Attribute name required: Splat expressions (.*) may not be used here.
21:03:46 - Attribute name required: Splat expressions (.*) may not be used here.
21:03:46 - Attribute name required: Splat expressions (.*) may not be used here.
21:03:46 - Attribute name required: Splat expressions (.*) may not be used here.
[Pipeline] }
21:03:46 ERROR: script returned exit code 1

Steps to Reproduce

Just run tfplan init as per above example.

Additional Context

References

[apparentlymart]

Hi @Constantin07! Sorry for this weird behavior, and thanks for reporting it.

This one is definitely a strange one, since the error there is emerging from an attempt to read an existing state snapshot from the backend, rather than from the configuration itself.

My guess is that your existing state contains some resource dependency records that are in a format we didn't account for in the state file upgrade process. Probably they will look something like aws_subnet.private.*.

To confirm this, could you please take a look at the state associated with this workspace (e.g. run terraform state pull with Terraform v0.11.10) and see if you can find a depends_on property whose value contains something that looks like a splat expression? If you find such a thing, it'd be helpful if you could share just those lines from the state and then we can connect that with the codepath that generates it in v0.11 and prior, and we can make sure the state format migration handles it properly.

If you _don't_ see it inside depends_on, searching the rest of the file for .* to look for possibly other address syntaxes that might contain the splat marker would help narrow down where this is coming from.

(Please be aware that our usual advice that it is safe to run terraform init and terraform plan against an existing state does not apply to the alpha releases, since we've not yet verified fully the upgrade codepaths, so please use the alphas against existing workspaces with care!)

Thanks again for reporting this!

[Constantin07]

Hi @apparentlymart. Here are the depends_on records found in the state file with .*:

...
                "aws_network_acl.private": {
                    "type": "aws_network_acl",
                    "depends_on": [
                        "aws_subnet.private.*",
                        "aws_vpc.default"
                    ],
...
                "aws_route_table_association.private.0": {
                    "type": "aws_route_table_association",
                    "depends_on": [
                        "aws_route_table.private.*",
                        "aws_subnet.private.*",
                        "local.availability_zones"
                    ],
...
                "aws_route_table_association.private.1": {
                    "type": "aws_route_table_association",
                    "depends_on": [
                        "aws_route_table.private.*",
                        "aws_subnet.private.*",
                        "local.availability_zones"
                    ]
...
                "aws_route_table_association.public.0": {
                    "type": "aws_route_table_association",
                    "depends_on": [
                        "aws_route_table.public",
                        "aws_subnet.public.*",
                        "local.availability_zones"
                    ],
...
                "aws_route_table_association.public.1": {
                    "type": "aws_route_table_association",
                    "depends_on": [
                        "aws_route_table.public",
                        "aws_subnet.public.*",
                        "local.availability_zones"
                    ],
...

[apparentlymart]

Thanks, @Constantin07! Before the final v0.12.0 release we'll make sure the state upgrade logic is able to understand and update this style of reference.

[Constantin07]

Thanks @apparentlymart @svanharmelen. The issue is gone now.

19:55:49 Initialize S3 backend
[Pipeline] sh
19:55:49 + terraform init -get=true -upgrade=true -verify-plugins=true -force-copy
19:55:49 Upgrading modules...
19:55:49 - core in ../modules/vpc
19:55:49 - env in ../modules/env
19:55:49 - key_pairs in ../modules/key_pairs
19:55:49 
19:55:49 Initializing the backend...
19:55:51 
19:55:51 Successfully configured the backend "s3"! Terraform will automatically
19:55:51 use this backend unless the backend configuration changes.
19:55:55 
19:55:55 Initializing provider plugins...
19:55:55 - Checking for available provider plugins...
19:55:56 - Downloading plugin for provider "aws" (1.45.0)...
19:56:04 - Downloading plugin for provider "tls" (1.2.0)...
19:56:05 
19:56:05 Terraform has been successfully initialized!
19:56:05 
19:56:05 You may now begin working with Terraform. Try running "terraform plan" to see
19:56:05 any changes that are required for your infrastructure. All Terraform commands
19:56:05 should now work.
19:56:05 
19:56:05 If you ever set or change modules or backend configuration for Terraform,
19:56:05 rerun this command to reinitialize your working directory. If you forget, other
19:56:05 commands will detect it and remind you to do so if necessary.

[jippi]

$ terraform-012 version
Terraform v0.12.0-alpha2

I got bit by this today

$ terraform-012 init -get=true -upgrade=true -verify-plugins=true -force-copy

Error: Error loading state:
    64 problems:

- Attribute name required: Splat expressions (.*) may not be used here.
- Attribute name required: Splat expressions (.*) may not be used here.
- Attribute name required: Splat expressions (.*) may not be used here.
- Attribute name required: Splat expressions (.*) may not be used here.

I'm having stuff like this in my state file (also depends_on)

"resources": {
    "aws_db_subnet_group.database": {
        "type": "aws_db_subnet_group",
        "depends_on": [
            "aws_subnet.database.*"
        ],
        "primary": {
            "id": "primary",
            "attributes": {
                "arn": "arn:aws:rds:eu-central-1:119020956079:subgrp:primary",
                "description": "Database subnet group for primary",
                "id": "primary",
                "name": "primary",
                "subnet_ids.#": "3",
                "subnet_ids.2653107611": "subnet-09273b699042cac90",
                "subnet_ids.3824544077": "subnet-0aca75308f2da0e7b",
                "subnet_ids.478362207": "subnet-0e286034059c7ce1e",
                "tags.%": "1",
                "tags.Name": "primary"
            },
            "meta": {},
            "tainted": false
        },
        "deposed": [],
        "provider": "provider.aws"
    },
    "aws_elasticache_subnet_group.elasticache": {
        "type": "aws_elasticache_subnet_group",
        "depends_on": [
            "aws_subnet.elasticache.*"
        ],
        "primary": {
            "id": "primary",
            "attributes": {
                "description": "ElastiCache subnet group for primary",
                "id": "primary",
                "name": "primary",
                "subnet_ids.#": "3",
                "subnet_ids.1218109545": "subnet-05e8e449b6fc81819",
                "subnet_ids.2316096161": "subnet-0520fa833a1759743",
                "subnet_ids.2319648840": "subnet-0923137b6548c13bf"
            },
            "meta": {},
            "tainted": false
        },
        "deposed": [],
        "provider": "provider.aws"
    },

The state is managed by terraform-aws-modules/vpc/aws

with a config like this

# https://github.com/terraform-aws-modules/terraform-aws-vpc
module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = "primary"
  cidr = "172.18.0.0/16"

  azs = ["eu-central-1a", "eu-central-1b", "eu-central-1c"]

  # public got public IPv4 addresses
  public_subnets = ["172.18.0.0/21", "172.18.8.0/21", "172.18.16.0/21"]
  # private got no public ingress traffic, and outbout is through NAT gateway
  private_subnets = ["172.18.24.0/21", "172.18.32.0/21", "172.18.40.0/21"]
  # fully offline networks, can only be communicated to from private network
  intra_subnets = ["172.18.48.0/21", "172.18.56.0/21", "172.18.64.0/21"]
  # RDS subnet, fully offline and can't be used for anything else
  database_subnets = ["172.18.72.0/21", "172.18.80.0/21", "172.18.88.0/21"]
  # ElastiCache subnets
  elasticache_subnets = ["172.18.96.0/21", "172.18.104.0/21", "172.18.112.0/21"]
  # Redshift subnets
  redshift_subnets                 = ["172.18.120.0/21", "172.18.128.0/21", "172.18.136.0/21"]
  reuse_nat_ips                    = true
  external_nat_ip_ids              = ["${aws_eip.nat.*.id}"]
  enable_nat_gateway               = true
  single_nat_gateway               = false
  enable_vpn_gateway               = false
  enable_s3_endpoint               = true
  enable_dynamodb_endpoint         = false
  enable_dhcp_options              = true
  dhcp_options_domain_name         = "service.consul"
  dhcp_options_domain_name_servers = ["127.0.0.1", "172.18.0.2"]
}

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.