ibm_is_image data source silently fails if the image is not available

[seansund]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform IBM Provider Version

• terraform - v0.13.6
• IBM Cloud provider - v1.24.0

Affected Resource(s)

• ibm_is_image data source

Terraform Configuration Files

The following will fail during terraform plan

variable "image_name" {
  default = "ibm-centos-7-9-minimal-amd64-2"
}
variable "name" {
  default = "test"
}
variable "resource_group_id" {
  default = "test"
}
variable "vpc_id" {
  default = "test"
}
variable "subnet_id" {
}
variable "profile_name" {
  default = "cx2-2x4"
}
variable "ssh_key_ids" {
  type = list(string)
  default = []
}
variable "tags" {
  type = list(string)
  default = []
}
variable "init_script" {
  default = ""
}
variable "region" {
}
variable "ibmcloud_api_key" {}

terraform {
  required_version = ">= 0.13.2"

  required_providers {
    ibm = {
      source = "ibm-cloud/ibm"
      version = ">= 1.17"
    }
  }
}

provider ibm {
  region = var.region
  ibmcloud_api_key = var.ibmcloud_api_key
}

data ibm_is_image image {
  name = var.image_name
}

data ibm_is_subnet subnet {
  identifier = var.subnet_id
}

resource ibm_is_security_group group {
  name           = "${var.name}-group"
  vpc            = var.vpc_id
  resource_group = var.resource_group_id
}

resource "ibm_is_instance" "bastion" {
  name           = var.name
  vpc            = var.vpc_id
  zone           = data.ibm_is_subnet.subnet.zone
  profile        = var.profile_name
  image          = data.ibm_is_image.image.id
  keys           = var.ssh_key_ids
  resource_group = var.resource_group_id

  user_data = var.init_script

  primary_network_interface {
    subnet          = data.ibm_is_subnet.subnet.id
    security_groups = [ibm_is_security_group.group.id]
  }

  boot_volume {
    name = "${var.name}-boot"
  }

  tags = var.tags
}

Debug Output

https://gist.github.com/seansund/904be7acc65f3e8022241f8d46618c0a

Panic Output

N/A

Expected Behavior

When running terraform plan the ibm_is_image data source should fail with an error about the image not being available.

Actual Behavior

The data source quietly fails and the ibm_is_instance resource fails with this error:

Error: Missing required argument

  on test.tf line 68, in resource "ibm_is_instance" "bastion":
  68:   image          = data.ibm_is_image.image.id

The argument "image" is required, but no definition was found.

Steps to Reproduce

1. terraform plan

Important Factoids

References

[kavya498]

Agree with the datasource issue..
but

Error: Missing required argument

  on test.tf line 68, in resource "ibm_is_instance" "bastion":
  68:   image          = data.ibm_is_image.image.id

The argument "image" is required, but no definition was found.

id is a computed attribute.. and it will be known only after apply is successful on datasource.

This error is not possible during plan since you are referencing data.ibm_is_image.image.id
We get a value for image id only after the apply of image datasource is successful..

In plan stage, you ll see known after apply on that attribute.. So, Only during apply it ll come to know that value is nil and when it tries to apply is_instance resource it throws this error.. This is a typical terraform behaviour

[seansund]

That doesn't make any sense... The behavior is different at plan time depending on if the image exists or not. If the image exists data.ibm_is_image.image.id has a value of known after apply and the plan succeeds. However, if the image does not exist then data.ibm_is_image.id has a different value, perhaps null, that causes the plan of the ibm_is_instance that uses it to fail.

In the trace of the missing image I see this:

2021/05/06 20:02:09 [WARN] Provider "registry.terraform.io/ibm-cloud/ibm" produced an unexpected new value for data.ibm_is_image.image.
      - .name: was cty.StringVal("ibm-centos-7-9-minimal-amd64-2"), but now null

Also, if I pass an invalid id into the data.ibm_is_subnet.subnet block it fails at plan time with an error that a subnet with that id could not be found. The ibm_is_image data source should have the same behavior if the image does not exists.