Moved block to support merging mutiple resources using for_each together

[biggles007]

Terraform Version

1.8.5

Use Cases

Currently it's not possible to consolidate resources into the same resource name. Where two separate resources exist, both with using for_each with unique key values, as Terraform states the target resource exists in state. There are often times when the key values are unknown so specific moved blocks can't be statically assigned.

Attempted Solutions

Attempted using moved {} blocks against the resources without key values but got the following message from Terraform

Terraform tried to adjust resource instance addresses in the prior state based on change information recorded in the configuration, but some adjustments did not succeed due to existing objects already at the intended addresses

Proposal

The following code (obviously not valid resource arguments) would allow the want_to_consolidate resource to be moved into the example resource as Terraform would ensure that all keys were unique.

resource "azurerm_resource_group" "example"
  for_each = toset(["name1"])
}

resource "azurerm_resource_group" "want_to_consolidate"
  for_each = toset(["name2"])
}

moved {
  from = azurerm_resource_group.want_to_consolidate
  to = azurerm_resource_group.example
}

References

No response

[apparentlymart]

Thanks for suggesting this, @biggles007!

Currently all of the supported moved operations are changes that can in principle be reversed with the same number of declarations: if you move azurerm_resource_group.a to azurerm_resource_group.b (taking all of its instances) then you can later move back from azurerm_resource_group.b to azurerm_resource_group.a and take all of the instances back.

Merging the instances of multiple resources together into a single resource would be "lossy" in that Terraform would lose track of which instance keys came from which resource, and so if you wanted to reverse it you'd need to replace your single moved block with multiple blocks to move each instance separately.

I don't think that's a deal-breaker but I think it does suggest that this behavior might warrant an explicit opt-in, such as an additional argument in the moved block which gives Terraform permission to take individual instances of the object in from, rather than always trying to move it whole.

Aside from that I think everything else about this seems consistent with the rules for moved. In particular, in the situation where both azurerm_resource_group.want_to_consolidate and azurerm_resource_group.example have an instance with the same key, Terraform would propose to delete the instance from azurerm_resource_group.want_to_consolidate and emit a warning explaining that there was no free slot for it to move into.

---

In a real example the resource "azurerm_resource_group" "example" block would presumably need to be deleted in order for this configuration to be valid, because it's not valid for the object mentioned in from to still be present in the configuration at the same time as its moved block, and so bringing all of the above together I expect it would appear something like this:

resource "azurerm_resource_group" "example"
  for_each = toset(["name1", "name2"])
}

moved {
  from = azurerm_resource_group.want_to_consolidate
  to   = azurerm_resource_group.example

  merge_instances = true
}

Note that:

• The instance key name2 must be declared for azurerm_resource_group.example, because otherwise azurerm_resource_group.want_to_consolidate["name2"] would move to an address that isn't in the desired state and so Terraform would propose to delete it.

  If resource "azurerm_resource_group" "want_to_consolidate" were still in the configuration then this moved block would be invalid, because you can't move from something that's currently in the desired state. (moved blocks are a hint to Terraform about how it should deal with each object that's only in the prior state, without any corresponding object in the desired state.)

• Although this example is for resources, this same principle ought to work for module calls too, for consistency.

• The hypothetical new merge_instances argument tells Terraform to consider each instance separately, rather than treating the whole resource/module-call as a unit.

  This would presumably be valid only if both from and to refer to a whole resource or a whole module; it would be invalid to set merge_instances = true if either endpoint includes an instance key itself, like azurerm_resource_group.example["name2"].

[crw]

Thanks for this feature request! If you are viewing this issue and would like to indicate your interest, please use the 👍 reaction on the issue description to upvote this issue. We also welcome additional use case descriptions. Thanks again!