formatlist returns a list with a single unknown value when given a DynamicValue

[LevonBecker]

Terraform Version

Terraform v1.0.4

Providers

.
├── provider[registry.terraform.io/hashicorp/aws] ~> 3.52
├── provider[terraform.io/builtin/terraform]
├── module.security_group
│   └── provider[registry.terraform.io/hashicorp/aws] ~> 3.52
├── module.cloudwatch_log_group
│   └── provider[registry.terraform.io/hashicorp/aws] ~> 3.52
├── module.iam_instance_profile
│   ├── provider[registry.terraform.io/hashicorp/template] ~> 2.2
│   ├── provider[registry.terraform.io/hashicorp/aws] ~> 3.52
│   └── provider[registry.terraform.io/hashicorp/local] ~> 1.4
└── module.key_pair
    └── provider[registry.terraform.io/hashicorp/aws] ~> 3.52

Providers required by state:

    provider[registry.terraform.io/hashicorp/aws]

    provider[terraform.io/builtin/terraform]

Terraform Configuration Files

data "terraform_remote_state" "network1" {
  backend                       = "s3"
  config = {
    bucket                      = var.common.tfstate_bucket_name
    region                      = var.common.tfstate_bucket_region
    key                         = "${var.common.tfstate_bucket_key_prefix}/${terraform.workspace}/network1.tfstate"
  }
}

data "terraform_remote_state" "network2" {
  backend                       = "s3"
  config = {
    bucket                      = var.common.tfstate_bucket_name
    region                      = var.common.tfstate_bucket_region
    key                         = "${var.common.tfstate_bucket_key_prefix}/var.network2.workspace/network2.tfstate"
  }
}

locals {
  cidr_list_office              = var.access_lists.office # map access_lists = { office = "42.53.122.211/32", workspaces = "48.23.126.200/32" }
  cidr_nats_list                = flatten(formatlist("%s/32", data.terraform_remote_state.network2.outputs.nat_public_ip)) # << this
  cidr_nats_map                 = zipmap(["nat_a", "nat_b", "nat_c"], local.cidr_nats_list) # << this, doesn't seem to expand local.cidr_nats_list. instead seems like it reads it as a string
  public_access_cidrs           = merge(local.cidr_list_office, local.cidr_nats_map) # << and this

  sg_basic_rules                 = tomap({
                                    "ingress_vpc"       = {
                                      "description"   = "vpc"
                                      "type"          = "ingress"
                                      "from_port"     = "0"
                                      "to_port"       = "0"
                                      "protocol"      = "-1"
                                      "cidr_blocks"   = [data.terraform_remote_state.network1.outputs.vpc.cidr_block]
                                    }
                                    "egress"          = {
                                      "description"   = ""
                                      "type"          = "egress"
                                      "from_port"     = "0"
                                      "to_port"       = "0"
                                      "protocol"      = "-1"
                                      "cidr_blocks"   = ["0.0.0.0/0"]
                                    }
                                  })

  sg_public_rules             = {for k, v in local.public_access_cidrs : k => {
                                                                              "description" = k
                                                                              "type" = "ingress"
                                                                              "from_port" = "22"
                                                                              "to_port" = "22"
                                                                              "protocol" = "tcp"
                                                                              "cidr_blocks" = [v]
                                                                            }
                                  }

Console Output (Fake IPs)

Loading up the .tf files in Terraform Console works correctly.

> local.cidr_nats_list
[
  "11.241.124.211/32",
  "19.131.72.213/32",
  "8.52.233.15/32",
]
> local.cidr_nats_map
{
  "nat_a" = "111.241.124.211/32"
  "nat_b" = "19.131.72.213/32"
  "nat_c" = "8.52.233.15/32"
}
> local.public_access_cidrs
{
  "office" = "42.53.122.211/32"
  "workspaces" = "48.23.126.200/32"
  "nat_a" = "111.241.124.211/32"
  "nat_b" = "19.131.72.213/32"
  "nat_c" = "8.52.233.15/32"
}
>

Terraform CLI (Refresh) Error

│ Error: Error in function call
│
│   on local.tf line 37, in locals:
│   37:   cidr_nats_map                 = zipmap(["nat_a", "nat_b", "nat_c"], local.cidr_nats_list)
│     ├────────────────
│     │ local.cidr_nats_list is tuple with 1 element
│
│ Call to function "zipmap" failed: number of keys (3) does not match number of values (1).

Debug Output (Cherry Picked)

terraform refresh

[DEBUG] ReferenceTransformer: "local.cidr_nats_map (expand)" references: [local.cidr_nats_list (expand)]
[DEBUG] ReferenceTransformer: "local.public_access_cidrs (expand)" references: [local.cidr_list_office (expand) local.cidr_nats_map (expand)]
[DEBUG] ReferenceTransformer: "local.cidr_nats_list (expand)" references: [data.terraform_remote_state.network2]
...
╷
│ Error: Error in function call
│
│   on local.tf line 38, in locals:
│   38:   cidr_nats_map                 = zipmap(["nat_a", "nat_b", "nat_c"], local.cidr_nats_list)
│     ├────────────────
│     │ local.cidr_nats_list is tuple with 1 element
│
│ Call to function "zipmap" failed: number of keys (3) does not match number of values (1).
╵
2021-08-10T09:37:16.779-0700 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = transport is closing"
2021-08-10T09:37:16.782-0700 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/hashicorp/aws/3.53.0/darwin_amd64/terraform-provider-aws_v3.53.0_x5 pid=20768
2021-08-10T09:37:16.782-0700 [DEBUG] provider: plugin exited

It says expand... /shrug

Expected Behavior

Terraform functions should work the same in Terraform console as compile/refresh-plan-apply.

Actual Behavior

The function logic works fine in Terraform Console, but fails on compile. It seems like zipmap is not expanding the variable and just reading it as a string. I'm guessing there is a different way or added syntax to make it work which would be great to know, but I still say the terraform console should respond the same as a run with terraform functions.

Steps to Reproduce

Setup .tf similar as above. Be sure to use all the same functions. formatlist, zipmap seem to be the area I'm seeing and issue.

1. terraform init
2. terraform refresh

Run terraform console with those same .tf files and see it work just fine.

References

I didn't find anything similar in my search...

[jbardin]

Thanks @LevonBecker,

zipmap is showing that the argument is already a container with a single item. It seems the culprit here is formatlist, which is taking a dynamic value and converting it into a list with a single unknown value.

A simpler example:

variable "any" {
  type = any
}

locals {
  formatted = formatlist("%s", var.any)
  result    = zipmap(["a", "b", "c"], local.formatted)
}

[jbardin]

Submitted upstream in zclconf/go-cty#115

[LevonBecker]

Boom! That fixed it! Thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.