local-exec environment populated by cdktf synth gets lowercased

[Jiafi]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

cdktf & Language Versions

cdktf version 0.14.3 Typescript

Affected Resource(s)

nullResource using the LocalExecProvisioner.

Debug Output

    new nullResource.Resource(this, 'postgresScript', {
      provisioners: [
        {
          // Pipe system password into script as input
          type: 'local-exec',
          command: `psql`,
          environment: {
            PGPASSWORD: "password",
          },
        },
      ],
    });

Generates

            {
            "local-exec": {
              "command": "psql",
              "environment": {
                "pgpassword": "passwordHere"
              }
            }

Expected Behavior

            {
            "local-exec": {
              "command": "psql",
              "environment": {
                "PGPASSWORD": "passwordHere"
              }
            }

Actual Behavior

            {
            "local-exec": {
              "command": "psql",
              "environment": {
                "pgpassword": "passwordHere"
              }
            }

Steps to Reproduce

Create a null provider and resource.

    new nullProvider.NullProvider(this, 'null', {});
    new nullResource.Resource(this, 'postgisAdminScript', {
      provisioners: [
        {
          // Pipe system password into script as input
          type: 'local-exec',
          // If this command fails, the password is printed out locally.  Need to figure out a better way of configuring the password
          command: `echo $PGPASSWORD`,
          environment: {
            PGPASSWORD: "password",
          },
        },
      ],
    });

Important Factoids

environment should respect the casing that is originally used in the environment Record.

It looks like all keys are being lower cased here

References

• 0000

[Jiafi]

https://github.com/hashicorp/terraform-cdk/pull/2446 Potential fix.

[ansgarm]

Hi @Jiafi 👋

Good catch, it seems like these lines are a bit too overambitious: https://github.com/hashicorp/terraform-cdk/blob/1908d763a5a676651579983100f92cb08c74777c/packages/cdktf/lib/terraform-resource.ts#L185-L189

We should confirm what exactly we need to convert there. Probably just the first layer but not deeper.

That said, you can workaround this problem using an escape hatch:

    new nullProvider.NullProvider(this, "null", {});
    const adminScript = new nullResource.Resource(
      this,
      "postgisAdminScript",
      {}
    );
    // using overrides to preserve casing of environment variables (open issue: https://github.com/hashicorp/terraform-cdk/issues/2443)
    adminScript.addOverride("provisioner", [
      {
        // Pipe system password into script as input
        type: "local-exec",
        // If this command fails, the password is printed out locally.  Need to figure out a better way of configuring the password
        command: `echo $PGPASSWORD`,
        environment: {
          PGPASSWORD: "password",
        },
      },
    ]);

[Jiafi]

@ansgarm Thanks for the workaround! It mostly worked but needed to be changed slightly. Needed local-exec as the key.

    new nullProvider.NullProvider(this, "null", {});
    const adminScript = new nullResource.Resource(
      this,
      "postgisAdminScript",
      {}
    );
    // using overrides to preserve casing of environment variables (open issue: https://github.com/hashicorp/terraform-cdk/issues/2443)
    adminScript.addOverride('provisioner', [
      {
        ['local-exec']: {
          command: `${postgisUserSetupScript.path} ${rds.rdsHostOutput} ${this.postgresDB} ${rds.rdsSystemUsernameOutput} ${this.postgresUser}`,
          environment: {
            PGPASSWORD: rds.rdsSystemPasswordOutput,
          },
        },
      },
    ]);

[ansgarm]

Ah, whoops 😅 Glad you figured it out!