Invalid for_each argument when trying to deploy v3-single-zone

[eladb]

Technical Details

• OS: MacOS
• Terraform Version: v1.5.7
• Provider Version 5.54.1
• Module Version 3.0.0 (and also tried 3.0.1)
• Module Affected tf-aws-open-next-zone
• Deployment Model Single zone]

Describe the bug

I am trying to deploy v3-single-zone without any modifications and I get an aInvalid for_each argument` error.

Steps to Reproduce

git clone git@github.com:RJPearson94/terraform-aws-open-next-examples.git
cd terraform-aws-open-next-examples/v3-single-zone
terragrunt init
terragrunt apply

Expected behaviour

I expected the example to work out of the box :-)

Logs

│ Error: Invalid for_each argument
│
│   on main.tf line 525, in resource "aws_lambda_permission" "additional_server_function_url_permission":
│  525:   for_each = merge([
│  526:     for key, additional_server_function in local.additional_server_functions : {
│  527:       for lambda_permission_key, lambda_permissions in local.lambda_permissions : "${key}-${lambda_permission_key}" => merge({ name = key }, additional_server_function, lambda_permissions)
│  528:     } if try(var.additional_server_functions.function_overrides[key].backend_deployment_type, var.additional_server_functions.backend_deployment_type) != "REGIONAL_LAMBDA_WITH_OAC"
│  529:   ]...)
│     ├────────────────
│     │ local.additional_server_functions is map of object with 1 element
│     │ local.lambda_permissions will be known only after apply
│     │ var.additional_server_functions.backend_deployment_type is "REGIONAL_LAMBDA"
│     │ var.additional_server_functions.function_overrides is empty map of object
│
│ The "for_each" map includes keys derived from resource attributes that
│ cannot be determined until apply, and so Terraform cannot determine the
│ full set of keys that will identify the instances of this resource.
│
│ When working with unknown values in for_each, it's better to define the map
│ keys statically in your configuration and place apply-time results only in
│ the map values.
│
│ Alternatively, you could use the -target planning option to first apply
│ only the resources that the for_each value depends on, and then apply a
│ second time to fully converge.
╵
ERRO[0012] terraform invocation failed in /Users/eladb/playground/nextjs/terraform-aws-open-next-examples/v3-single-zone/.terragrunt-cache/4hSie1eENVfRenBiEDLpPwtvy4s/WZq5uaBnondhezazcPLKTiwZRgY/modules/tf-aws-open-next-zone  error=[/Users/eladb/playground/nextjs/terraform-aws-open-next-examples/v3-single-zone/.terragrunt-cache/4hSie1eENVfRenBiEDLpPwtvy4s/WZq5uaBnondhezazcPLKTiwZRgY/modules/tf-aws-open-next-zone] exit status 1 prefix=[/Users/eladb/playground/nextjs/terraform-aws-open-next-examples/v3-single-zone]
ERRO[0012] 1 error occurred:
	* [/Users/eladb/playground/nextjs/terraform-aws-open-next-examples/v3-single-zone/.terragrunt-cache/4hSie1eENVfRenBiEDLpPwtvy4s/WZq5uaBnondhezazcPLKTiwZRgY/modules/tf-aws-open-next-zone] exit status 1

[RJPearson94]

Hi @eladb,

Thanks for using the module, and I apologise you've run into this issue.
So, the examples were used to test the module; however, I don't currently test v1.5.7.

I've been able to replicate the issue with v1.5.7. However, I found that if you use Terraform 1.6.1 or above, the module deploys the example correctly
Are you able to try a newer version of Terraform, or are you constrained by the license change?

Kind Regards
Rob

[eladb]

We might be restricted by the license change 🤦‍♀️. Let me check if I can figure out the issue and contribute a fix. Will that be ok?

[RJPearson94]

No worries @eladb.
If you can contribute that would be fantastic. I’ve not had the time to look further into the issue but may have some time over the weekend.
I am just slightly cautious about any changes as this is used as part of the resource name but hopefully there is a way to fix this for v1.5.7 which doesn’t resort in the resource names changing

[RJPearson94]

Hi @eladb,

Apologies for the delay in responding. I think I might have figured out the issue with v1.5.7.

It looks like in Terraform v1.5.7, if you use the try and one functions together, Terraform marks the result as computed. If you remove either function, then the value is resolved correctly.

I need to do some additional testing however, I wanted to give you a quick update.

[eladb]

Thanks, appreciate the update. Haven't had time to dive into this yet, so let me know if this is fixed.

[RJPearson94]

Hi @eladb,
I have run into challenges with the multi-zone deployment, which has held this up slightly.
As this requires further investigation, I am going to break the multi-zone issue out into a separate issue and release the fix for the single-zone.
I will hopefully have the changes out ASAP

[RJPearson94]

Hi @eladb,

This should have been resolves as part of v3.0.2

[RJPearson94]

The v3-single-zone example has also been updated to use v3.0.2