value of 'count' cannot be computed with data list

[jw-maynard]

Terraform Version

root@63de1d7df42e:/conf/terraform# terraform -v
Terraform v0.11.7

Terraform Configuration Files

data "terraform_remote_state" "s3_buckets" {
  backend = "s3"

  config {
    key            = "devopssandbox/s3_buckets"
    bucket         = "devops-terraform-${var.region}"
    region         = "${var.region}"
    dynamodb_table = "terraform.lock"
    profile        = "${var.region}"
  }
}

module "kubernetes_cluster" {
  ...
  extra_instance_profile_policies = ["${
    data.terraform_remote_state.s3_buckets.*.rw_policy_arns
  }"]
  ...
}

------

module "kubernetes_ec2_profile" {
  source          = "../ec2_instance_iam_profile"
  name            = "K8_EC2_${var.env_name}-${var.name}-${var.region}"
  policy_arn_list = "${var.extra_instance_profile_policies}"
}

------

resource "aws_iam_role_policy_attachment" "attachment" {
  count      = "${length(var.policy_arn_list)}"
  role       = "${aws_iam_role.role.name}"
  policy_arn = "${var.policy_arn_list[count.index]}"
}

Expected Behavior

I would expect this to be able to count the number of items it needs to create since the S3 bucket module referenced by the data object is already applied.

If I use a different S3 module that has just a single policy ARN as an output then I don't get that error. It only seems to be when the output of the module is a list.

Actual Behavior

I get the error that 'count' cannot be computed.

[jw-maynard]

@jbardin Any thoughts about fixing this or a way to work around it? I've tried multiple ways to try to 'trick' terraform into counting these items including doing a length() call in the outputs of the S3 bucket module and trying to use that in the other module but I keep running into the cannot be calculated error.

[apparentlymart]

Hi @jw-maynard! Sorry for this annoying behavior, and for the slow response.

It looks like this issue has the same root cause as #14677, which I verified as fixed over in #12570. This fix will be included in the forthcoming v0.12.0 final release. The crux of the problem is that Terraform v0.11 and earlier have a rule that a list containing an unknown value is simplified into a wholly-unknown list, which then in turn causes length to return an unknown number, etc.

It's not entirely clear to me, to be honest, why the data source here was producing computed results in the first place: as you said, it ought to be known by the time the plan is created since the data source is dealt with during the refresh step. My guess would be that it's related to the fact that in v0.11 and prior terraform_remote_state is a bit of a special case where each of the output it defines are exposed as dynamic attributes (not part of the data source schema) and so Terraform is forced to make some conservative assumptions about that during planning.

If you are able to share a more complete configuration here I might be able to figure that out and come up with a simpler repro to verify on v0.12.0-alpha2, but at least those unknown values should become a moot point in v0.12.0 because we're removing that simplification rule so that a list with an unknown value inside of it can still itself have a known length.

Since there's a fix for this in master ready to be included in the next release, I'm going to close this out. Thanks for reporting it, and sorry again for the slow response.

[jw-maynard]

@apparentlymart Thanks for taking a look. When we start migrating to 0.12 we'll have a lot of workarounds to unwind. If something like this crops up again I'll just post a new issue. Thanks again!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.