var.role_policy_arns

[yevgenypats]

Description

Please provide a clear and concise description of the issue you are encountering, and a reproduction of your configuration (see the examples/* directory for references that you can copy+paste and tailor to match your configs if you are unable to copy your exact configuration). The reproduction MUST be executable by running terraform init && terraform apply without any further changes.

If your request is for a new feature, please use the Feature request template.

• [ ] ✋ I have searched the open/closed issues and my issue is not listed.

⚠️ Note

Before you submit an issue, please perform the following first:

1. Remove the local .terraform directory (! ONLY if state is stored remotely, which hopefully you are following that best practice!): rm -rf .terraform/
2. Re-initialize the project root to pull down modules: terraform init
3. Re-attempt your terraform plan or apply and check if the issue still persists

Versions

• Module version [Required]: v4.20.1

• Terraform version:

  Terraform v1.1.8 on darwin_arm64

• provider registry.terraform.io/hashicorp/aws v4.9.0

• provider registry.terraform.io/hashicorp/cloudinit v2.2.0

• provider registry.terraform.io/hashicorp/helm v2.5.0

• provider registry.terraform.io/hashicorp/random v3.1.2

• provider registry.terraform.io/hashicorp/tls v3.3.0

• Provider version(s):

Reproduction Code [Required]

Steps to reproduce the behavior:

https://github.com/cloudquery/terraform-aws-cloudquery/tree/acd82e3429544b94960e2a34414b1d405d6b874e/examples/complete

Running terraform apply will product the following error:

│ Error: Invalid for_each argument
│ 
│   on .terraform/modules/cloudquery.cluster_irsa/modules/iam-role-for-service-accounts-eks/main.tf line 42, in resource "aws_iam_role_policy_attachment" "this":
│   42:   for_each = toset([for arn in var.role_policy_arns : arn if var.create_role])
│     ├────────────────
│     │ var.create_role is true
│     │ var.role_policy_arns is a list of string, known only after apply
│ 
│ The "for_each" value depends on resource
│ attributes that cannot be determined until
│ apply, so Terraform cannot predict how many
│ instances will be created. To work around
│ this, use the -target argument to first
│ apply only the resources that the for_each
│ depends on.

Expected behavior

Actual behavior

Terminal Output Screenshot(s)

Additional context

[bryantbiggs]

Duplicate of #193

[antonbabenko]

@yevgenypats I have been looking into this right now, and it seemed to me that this issue was not very consistent.

The linked example in the cloudquery repository creates 55+ resources, and sometimes it produces this error, but in most cases, it doesn't. When I reduced the scope of that example (by disabling the creation of the VPC resources, for example), it worked without a problem.

For the time being, using terraform apply -target=... prior to the main terraform apply should be a solution for cases like this (not necessarily limited to this module).

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.