Terraform: Conditional expression assigned to local cannot be evaluated during plan

[woodrow]

Terraform Version

Terraform v0.12.0
+ provider.aws v2.12.0

(I've also tried with Terraform v0.12.1-dev built from 2c176fdf4ba6849af93041ff743ce97ee273373e)

Terraform Configuration Files

Root module:

module "test_role" {
  source = "./modules/iam_role"
  role_name = "test_role"
}

module "test_role_with_inline" {
  source = "./modules/iam_role"
  role_name = "test_role_with_inline"
  inline_policy = {}
}

iam_role module:

variable "role_name" {
  type = string
}

variable "inline_policy" {
  default = null
}

locals {
  default_inline_policy = null
  inline_policy = var.inline_policy == null ? local.default_inline_policy : var.inline_policy
}

resource "aws_iam_role" "iam_role" {
  name = var.role_name
  assume_role_policy = jsonencode({})
}

resource "aws_iam_role_policy" "iam_role-inline" {
  name = "${aws_iam_role.iam_role.id}-inline"
  role = aws_iam_role.iam_role.id
  policy = jsonencode(local.inline_policy)
  count = local.inline_policy == null ? 0 : 1
}

Expected Behavior

Plan should have been able to evaluate the local variable, and succeed in generating a plan creating two aws_iam_role resources and one aws_iam_role_policy resource.

Actual Behavior

Error: Invalid count argument

  on modules/iam_role/main.tf line 15, in resource "aws_iam_role_policy" "iam_role-inline":
  15:   count = local.inline_policy == null ? 0 : 1

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

It appears that this local.inline_policy is (not yet known) during the plan process, even though it (AFAICT) has all of the information needed to evaluate that expression.

Steps to Reproduce

git clone [email protected]:woodrow/terraform-21450-reproducer.git && cd terraform-21450-reproducer/reproducer-0.12

terraform init

terraform plan

[davidsuart]

I'm seeing this error as well but I can add a little extra circumstance ...

For me, it seems to be about count in a _resource_ block being derived from a local variable. A _data_ block does not suffer the same problem but if you then pipe an output from that data block into a subsequent resource block it triggers again.

Examples:

local value direct to data count, does not error, works fine:

locals {
  list_of_zone_ids = concat(module.zone.zone_ids)
}

data "aws_route53_zone" "zone_data" {
  count   = length(local.list_of_zone_ids)
  ...
}

... but run that data block as an input to a resource block then it will error:

resource "null_resource" "zone_meta" {
  count = length(data.aws_route53_zone.zone_data)
  ...
}

I'm using the same v0.12.0 as @woodrow.

Terraform v0.12.0
+ provider.aws v2.12.0
+ provider.null v2.1.2

[IvanovOleg]

count = "${local.test ? length(local.array) : 0}" doesn't work in 0.12

[symonds]

count = "${var.sg_id != "" ? 1 : 0}"

Doesn't work in 0.12.1 and is blocking any progress

[tiwood]

I'm on 0.12.4 and still have these issues:

locals {
  backendPoolType        = split("/", var.backend_address_pool_id)[17]
  )
}

resource "azurerm_network_interface_backend_address_pool_association" "lb_backend_pool" {
  network_interface_id    = azurerm_network_interface.default.id
  ip_configuration_name   = "if-ipconf-${local.name}"
  backend_address_pool_id = var.backend_address_pool_id

  // only if we detected a Azure Load Balancer Resource ID in the variable
  // backend_address_pool_id we're going to deploy this resource.
  count = local.backendPoolType == "loadBalancers" ? 1 : 0
}

resource "azurerm_network_interface_application_gateway_backend_address_pool_association" "appgw_backend_pool" {
  network_interface_id    = azurerm_network_interface.default.id
  ip_configuration_name   = "if-ipconf-${local.name}"
  backend_address_pool_id = var.backend_address_pool_id

  // only if we detected a Azure Application Gateway Resource ID in the variable
  // backend_address_pool_id we're going to deploy this resource.
  count = local.backendPoolType == "applicationGateways" ? 1 : 0
}

I'm getting the following errors:

Error: Invalid count argument

  on .terraform/modules/dns_vm/main.tf line 198, in resource "azurerm_network_interface_backend_address_pool_association" "lb_backend_pool":
 198:   count = local.backendPoolType == "loadBalancer" ? 1 : 0

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.


Error: Invalid count argument

  on .terraform/modules/dns_vm/main.tf line 211, in resource "azurerm_network_interface_application_gateway_backend_address_pool_association" "appgw_backend_pool":
 211:   count = local.backendPoolType == "applicationGateways" ? 1 : 0

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

@jbardin am I missing something?

[jbardin]

@tiwood,

Guessing from the name, is var.backend_address_pool_id an ID provided by another resource? If that's the case, then the error message: The "count" value depends on resource attributes that cannot be determined until apply is the applicable part here. Count values must be resolvable during the plan, otherwise terraform can't create a plan for the resources if it can't determine how many to create.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.