logging: should be a list error when aws_s3_bucket resource has local variables in the logging

[DJviolin]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.7
* provider.aws: version = "~> 1.25"

Affected Resource(s)

• aws_s3_bucket

Terraform Configuration Files

modules/private-bucket/variables.tf:

variable "tags" {
  description = "A mapping of tags to assign to the bucket."
  type        = "map"
  default     = {}
}

variable "logging" {
  description = "A list of logging to assign to the bucket."
  type        = "list"
  default = []
}

modules/private-bucket/main.tf:

resource "aws_s3_bucket" "private_bucket" {
  bucket = "${var.bucket}"
  acl    = "private"
  policy = "${data.aws_iam_policy_document.policy.json}"
  tags   = "${var.tags}"

  # logging should be a list
  logging = "${var.logging}"

  # ...
}

main.tf:

module "private_bucket" {
  source = "modules/private-bucket"
  bucket = "${local.private_bucket_name}"

  tags {
    Name        = "Serverless stack private bucket"
    Environment = "${local.stage}"
  }

  # this config not throws an error on `terraform plan`
  /* logging = [{
    target_bucket = "target-bucket-name"
    target_prefix = "s3/target-prefix/"
  }] */

  # this config do throws an error on `terraform plan`
  logging = [{
    target_bucket = "${local.logs_bucket_name}"
    target_prefix = "s3/${local.private_bucket_name}/"
  }]
}

Debug Output

Panic Output

Error: module.private_bucket.aws_s3_bucket.private_bucket: logging: should be a list

Expected Behavior

It should be work with local variables. The logging list should not appear in the configuration if I not define anything.

Actual Behavior

This build executes terraform plan without problem if I use strings, but throws error when I use local variables.

Steps to Reproduce

1. terraform init
2. terraform plan -out=./.terraform/plan

Important Factoids

The problem that I want to solve is if I not define a logging array in main.tf on the module call, then I don't want to initialize the logging. But this is not part of this error reporting.

References

• #0000

[bflad]

Hi @DJviolin 👋 Sorry you are running into this unexpected behavior here.

Does your situation work if you change your code to either of the following?

# Potential Terraform 0.11 workaround 1
resource "aws_s3_bucket" "private_bucket" {
  # ... other configuration ...
  logging = ["${var.logging}"]
}

# Potential Terraform 0.11 workaround 2
resource "aws_s3_bucket" "private_bucket" {
  # ... other configuration ...
  logging = "${list(var.logging)}"
}

The long story here is that the current configuration language of Terraform (HCL) in Terraform version through Terraform 0.11 does not currently support strong typing throughout its specification and it can sometimes get confused when working with computed values or passing information into modules. The good news is that this is likely being addressed in the next major version of Terraform: https://www.hashicorp.com/blog/terraform-0-1-2-preview

Given some current sketches of the updated HCL specification, the above should be able to be replaced with the simpler configuration below with Terraform 0.12 (not released yet):

# Possible configuration with Terraform 0.12 -- implementation may change during development
resource "aws_s3_bucket" "private_bucket" {
  # ... other configuration ...
  logging = var.logging
}

There are some upstream issues in Terraform core that track this updated handling and potentially are good references for trying to further track the fix for your situation:

• Unable to pass "type: List" variables from data source to modules terraform#17837
• Module output variables cannot be used to create a list input terraform#16916
• Can't conditionally define list terraform#16831

If neither of the above workaround configurations doesn't help in the current versions of Terraform, I'd suggest double checking for a more appropriate upstream issue (as this is not an issue with the AWS provider or its resources) or submitting a new Terraform core issue so we can ensure this behavior is fixed in the next version of Terraform. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!