从 2 个字符串到列表的 Terraform 输出

Question

In terraform I have 2 data outputs:

data "aws_instances" "daas_resolver_ip_1" {
  instance_tags = {
    Name = "${var.env_type}.${var.environment}.ns1.${var.aws_region}.a."
  }
}

data "aws_instances" "daas_resolver_ip_2" {
  instance_tags = {
    Name = "${var.env_type}.${var.environment}.ns2.${var.aws_region}.b."
  }
}

I want to get the private_ip from each of those combine those into a list and be used as follows:

  dhcp_options_domain_name_servers  = ["${data.aws_instances.daas_resolver_ip_1.private_ip}", "${data.aws_instances.daas_resolver_ip_1.private_ip}"]

How can I achieve this? At the moment this is the error I get:

Error: module.pmc_environment.module.pmc_vpc.aws_vpc_dhcp_options.vpc: domain_name_servers: should be a list

Answer 1

I believe what you've encountered here is a common limitation of Terraform 0.11. If this is a new configuration then starting with Terraform 0.12 should avoid the problem entirely, as this limitation was addressed in the Terraform 0.12 major release.

The underlying problem here is that the private_ip values of at least one of these resources is unknown during planning (it will be selected by the remote system during apply) but then Terraform 0.11's type checker is failing because it cannot prove that these unknown values will eventually produce a list of strings as the dhcp_options_domain_name_servers requires.

---

Terraform 0.12 addresses this by tracking type information for unknown values and propagating types through expressions so that eg in this case it could know that the result is a list of two strings but the strings themselves are not known yet. From Terraform 0.11's perspective, this is just an unknown value with no type information at all, and is therefore not considered to be a list, causing this error message.

---

A workaround for Terraform 0.11 is to use the -target argument to ask Terraform to deal with the operations it needs to learn the private_ip values first, and then run Terraform again as normal once those values are known:

terraform apply -target=module.pmc_environment.module.pmc_vpc.data.aws_instances.daas_resolver_ip_1 -target=module.pmc_environment.module.pmc_vpc.data.aws_instances.daas_resolver_ip_2
terraform apply

The first terraform apply with -target set should deal with the two data resources, and then the subsequent terraform apply with no arguments should then be able to see what the two IP addresses are.

This will work only if all of the values contributing to the data resource configurations remain stable after the initial creation step. You'd need to repeat this two-step process on subsequent changes if any of var.env_type , var.environment , or var.aws_region become unknown as a result of other planned actions.