tls_private_key value of 'count' cannot be computed

[Lasering]

Terraform Version

Terraform v0.11.2
+ provider.tls v1.0.1

Terraform Configuration Files

module "alameda" {
  // Omitted for clarity
}

module "tagus" {
  // Omitted for clarity
}

locals {
  both-regions-server-ips   = "${concat(module.alameda.server-ips, module.tagus.server-ips)}"  
}
resource "tls_private_key" "servers-keys" {
  count       = "${length(local.both-regions-server-ips)}"
  algorithm   = "ECDSA"
  ecdsa_curve = "P384"
}

Expected Behavior

Terraform should have no problem computing a count that references modules.

Actual Behavior

Error: Error running plan: 1 error(s) occurred:

* module.consul.tls_private_key.servers-keys: tls_private_key.servers-keys: value of 'count' cannot be computed

Additional Context

Attempts made to fix the problem (none worked, always get the some output as above):

1. Change count to: "${length(module.tagus.server-ips) + length(module.alameda.server-ips)}"
2. With the previous count add a depends_on to the modules directly.

The count works if I reference a variable directly "${var.some-var}". It doesn't work when the interpolations reference a module.

[apparentlymart]

Hi @Lasering! Sorry this isn't working as expected.

The "computed-ness" of that module output depends on how that output is defined. If the server-ips output is, for example, something like aws_instance.example.*.private_ip (or an equivalent for any other resource/provider) then in the current configuration language interpreter that result is "computed" if the aws_instance.example resources have not been created yet.

I think what you're seeing here is the same as #14677, which is one of the items that should be addressed by the configuration language improvements we're currently working on. The current behavior is that any list containing a computed element gets reduced to a wholly-computed list, which we then can't apply length(...) to. The new behavior will be to preserve the partially-computed list as-is and only activate the special behavior for computed values if that element is accessed, which will then get the behavior you need here.

In the mean time, so far users have tended to work around this (assuming that "splat syntax" is the source of that list) by exporting a separate output that uses the aws_instance.example.count notation that avoids creating that intermediate list and thus allows the count to be observed even when some elements are computed.

Once the improved configuration language interpreter is integrated (which is our current focus) what you originally wrote here should work as you expected.

Since this seems to be the same as #14677, I'm going to close this just to consolidate the discussion over there. Thanks for reporting this, and sorry again for this limitation.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.