Pulumi convert fails, cannot assign expression of type to location of type (terraform-aws-github-runner)

[sam-drew]

What happened?

Tried to run $ pulumi convert --from terraform --language typescript --out pulumi on terraform project terraform-aws-github-runner. The conversion from terraform appeared to work okay, but the codegen failed with the following error:

Pulumi Version:   v3.116.1
error: variables.pp:604,13-614,4: cannot assign expression of type {
  config: { dryRun: false, minimumDaysOld: 1, tokenPath: null },
  enabled: true,
  lambdaMemorySize: 512,
  lambdaTimeout: 60,
  scheduleExpression: string,
} to location of type   {
    config:   {
        dryRun: bool | output(bool),
        minimumDaysOld: number | output(number),
        tokenPath: output(string) | string,
      }
    | output({ dryRun: bool, minimumDaysOld: number, tokenPath: string })
    | output({ dryRun: bool, minimumDaysOld: number, tokenPath: string }?)?,
    enabled: bool | output(bool) | output(bool?)?,
    lambdaMemorySize: number | output(number) | output(number?)?,
    lambdaTimeout: number | output(number) | output(number?)?,
    scheduleExpression: output(string) | output(string?) | string?,
  }
| output({
    config: { dryRun: bool, minimumDaysOld: number, tokenPath: string }?,
    enabled: bool?,
    lambdaMemorySize: number?,
    lambdaTimeout: number?,
    scheduleExpression: string?,
  }): ; 
error: main.pp:163,1-261,2: /var/folders/kp/cnhpgmjj4ybb30hvfqk3y7fr0000gn/T/pulumi-convert1083240879/modules/runners/variables.pp:465,13-475,4: cannot assign expression of type {
  config: { dryRun: false, minimumDaysOld: 1, tokenPath: null },
  lambdaMemorySize: 512,
  lambdaTimeout: 60,
  scheduleExpression: string,
  state: string,
} to location of type   {
    config:   {
        dryRun: bool | output(bool),
        minimumDaysOld: number | output(number),
        tokenPath: output(string) | string,
      }
    | output({ dryRun: bool, minimumDaysOld: number, tokenPath: string })
    | output({ dryRun: bool, minimumDaysOld: number, tokenPath: string }?)?,
    lambdaMemorySize: number | output(number) | output(number?)?,
    lambdaTimeout: number | output(number) | output(number?)?,
    scheduleExpression: output(string) | output(string?) | string?,
    state: output(string) | output(string?) | string?,
  }
| output({
    config: { dryRun: bool, minimumDaysOld: number, tokenPath: string }?,
    lambdaMemorySize: number?,
    lambdaTimeout: number?,
    scheduleExpression: string?,
    state: string?,
  }): ; ; /var/folders/kp/cnhpgmjj4ybb30hvfqk3y7fr0000gn/T/pulumi-convert1083240879/modules/runners/variables.pp:465,13-475,4: cannot assign expression of type {
  config: { dryRun: false, minimumDaysOld: 1, tokenPath: null },
  lambdaMemorySize: 512,
  lambdaTimeout: 60,
  scheduleExpression: string,
  state: string,
} to location of type   {
    config:   {
        dryRun: bool | output(bool),
        minimumDaysOld: number | output(number),
        tokenPath: output(string) | string,
      }
    | output({ dryRun: bool, minimumDaysOld: number, tokenPath: string })
    | output({ dryRun: bool, minimumDaysOld: number, tokenPath: string }?)?,
    lambdaMemorySize: number | output(number) | output(number?)?,
    lambdaTimeout: number | output(number) | output(number?)?,
    scheduleExpression: output(string) | output(string?) | string?,
    state: output(string) | output(string?) | string?,
  }
| output({
    config: { dryRun: bool, minimumDaysOld: number, tokenPath: string }?,
    lambdaMemorySize: number?,
    lambdaTimeout: number?,
    scheduleExpression: string?,
    state: string?,
  }): ; 
error: could not generate output program

Example

To reproduce: clone terraform-aws-github-runner, terraform init in that directory, then run $ pulumi convert --from terraform --language typescript --out pulumi, observe error.

Output of pulumi about

CLI
Version 3.116.1
Go Version go1.22.2
Go Compiler gc

Host
OS darwin
Version 14.4.1
Arch arm64

Backend
Name pulumi.com
URL https://app.pulumi.com
User Unknown
Organizations
Token type personal

Additional context

I'm quite new to Pulumi, so it's quite possible I've missed something obvious!

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[justinvp]

Hi @sam-drew. Thanks for opening the issue and sorry for the trouble.

It looks like the converter is having trouble with a couple of variables in this module. If I comment out the problematic variables, I can get the converter to succeed. From there, there are still manual fix-ups to work through, but the converter can save a ton of time converting TF to Pulumi vs. doing it manually.

diff --git a/main.tf b/main.tf
index 645bb6d2..219d69c2 100644
--- a/main.tf
+++ b/main.tf
@@ -287,7 +287,7 @@ module "runners" {
   pool_runner_owner                          = var.pool_runner_owner
   pool_lambda_reserved_concurrent_executions = var.pool_lambda_reserved_concurrent_executions
 
-  ssm_housekeeper = var.runners_ssm_housekeeper
+  # ssm_housekeeper = var.runners_ssm_housekeeper
 }
 
 module "runner_binaries" {
diff --git a/modules/multi-runner/runners.tf b/modules/multi-runner/runners.tf
index 859e477e..0479b6f9 100644
--- a/modules/multi-runner/runners.tf
+++ b/modules/multi-runner/runners.tf
@@ -109,5 +109,5 @@ module "runners" {
   pool_lambda_reserved_concurrent_executions = var.pool_lambda_reserved_concurrent_executions
   associate_public_ipv4_address              = var.associate_public_ipv4_address
 
-  ssm_housekeeper = var.runners_ssm_housekeeper
+  # ssm_housekeeper = var.runners_ssm_housekeeper
 }
diff --git a/modules/multi-runner/variables.tf b/modules/multi-runner/variables.tf
index efdbfd82..ce601d32 100644
--- a/modules/multi-runner/variables.tf
+++ b/modules/multi-runner/variables.tf
@@ -588,29 +588,29 @@ variable "associate_public_ipv4_address" {
   default     = false
 }
 
-variable "runners_ssm_housekeeper" {
-  description = <<EOF
-  Configuration for the SSM housekeeper lambda. This lambda deletes token / JIT config from SSM.
-
-  `schedule_expression`: is used to configure the schedule for the lambda.
-  `enabled`: enable or disable the lambda trigger via the EventBridge.
-  `lambda_memory_size`: lambda memery size limit.
-  `lambda_timeout`: timeout for the lambda in seconds.
-  `config`: configuration for the lambda function. Token path will be read by default from the module.
-  EOF
-  type = object({
-    schedule_expression = optional(string, "rate(1 day)")
-    enabled             = optional(bool, true)
-    lambda_memory_size  = optional(number, 512)
-    lambda_timeout      = optional(number, 60)
-    config = object({
-      tokenPath      = optional(string)
-      minimumDaysOld = optional(number, 1)
-      dryRun         = optional(bool, false)
-    })
-  })
-  default = { config = {} }
-}
+# variable "runners_ssm_housekeeper" {
+#   description = <<EOF
+#   Configuration for the SSM housekeeper lambda. This lambda deletes token / JIT config from SSM.
+
+#   `schedule_expression`: is used to configure the schedule for the lambda.
+#   `enabled`: enable or disable the lambda trigger via the EventBridge.
+#   `lambda_memory_size`: lambda memery size limit.
+#   `lambda_timeout`: timeout for the lambda in seconds.
+#   `config`: configuration for the lambda function. Token path will be read by default from the module.
+#   EOF
+#   type = object({
+#     schedule_expression = optional(string, "rate(1 day)")
+#     enabled             = optional(bool, true)
+#     lambda_memory_size  = optional(number, 512)
+#     lambda_timeout      = optional(number, 60)
+#     config = object({
+#       tokenPath      = optional(string)
+#       minimumDaysOld = optional(number, 1)
+#       dryRun         = optional(bool, false)
+#     })
+#   })
+#   default = { config = {} }
+# }
 
 variable "metrics_namespace" {
   description = "The namespace for the metrics created by the module. Merics will only be created if explicit enabled."
diff --git a/modules/runners/variables.tf b/modules/runners/variables.tf
index 82fd2cf9..b2602216 100644
--- a/modules/runners/variables.tf
+++ b/modules/runners/variables.tf
@@ -632,29 +632,29 @@ variable "associate_public_ipv4_address" {
   default     = false
 }
 
-variable "ssm_housekeeper" {
-  description = <<EOF
-  Configuration for the SSM housekeeper lambda. This lambda deletes token / JIT config from SSM.
-
-  `schedule_expression`: is used to configure the schedule for the lambda.
-  `state`: state of the cloudwatch event rule. Valid values are `DISABLED`, `ENABLED`, and `ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS`.
-  `lambda_memory_size`: lambda memery size limit.
-  `lambda_timeout`: timeout for the lambda in seconds.
-  `config`: configuration for the lambda function. Token path will be read by default from the module.
-  EOF
-  type = object({
-    schedule_expression = optional(string, "rate(1 day)")
-    state               = optional(string, "ENABLED")
-    lambda_memory_size  = optional(number, 512)
-    lambda_timeout      = optional(number, 60)
-    config = object({
-      tokenPath      = optional(string)
-      minimumDaysOld = optional(number, 1)
-      dryRun         = optional(bool, false)
-    })
-  })
-  default = { config = {} }
-}
+# variable "ssm_housekeeper" {
+#   description = <<EOF
+#   Configuration for the SSM housekeeper lambda. This lambda deletes token / JIT config from SSM.
+
+#   `schedule_expression`: is used to configure the schedule for the lambda.
+#   `state`: state of the cloudwatch event rule. Valid values are `DISABLED`, `ENABLED`, and `ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS`.
+#   `lambda_memory_size`: lambda memery size limit.
+#   `lambda_timeout`: timeout for the lambda in seconds.
+#   `config`: configuration for the lambda function. Token path will be read by default from the module.
+#   EOF
+#   type = object({
+#     schedule_expression = optional(string, "rate(1 day)")
+#     state               = optional(string, "ENABLED")
+#     lambda_memory_size  = optional(number, 512)
+#     lambda_timeout      = optional(number, 60)
+#     config = object({
+#       tokenPath      = optional(string)
+#       minimumDaysOld = optional(number, 1)
+#       dryRun         = optional(bool, false)
+#     })
+#   })
+#   default = { config = {} }
+# }
 
 variable "enable_on_demand_failover_for_errors" {
   description = "Enable on-demand failover. For example to fall back to on demand when no spot capacity is available the variable can be set to `InsufficientInstanceCapacity`. When not defined the default behavior is to retry later."
diff --git a/variables.tf b/variables.tf
index 51bd7d8e..85dae79f 100644
--- a/variables.tf
+++ b/variables.tf
@@ -828,29 +828,29 @@ variable "associate_public_ipv4_address" {
   default     = false
 }
 
-variable "runners_ssm_housekeeper" {
-  description = <<EOF
-  Configuration for the SSM housekeeper lambda. This lambda deletes token / JIT config from SSM.
-
-  `schedule_expression`: is used to configure the schedule for the lambda.
-  `enabled`: enable or disable the lambda trigger via the EventBridge.
-  `lambda_memory_size`: lambda memery size limit.
-  `lambda_timeout`: timeout for the lambda in seconds.
-  `config`: configuration for the lambda function. Token path will be read by default from the module.
-  EOF
-  type = object({
-    schedule_expression = optional(string, "rate(1 day)")
-    enabled             = optional(bool, true)
-    lambda_memory_size  = optional(number, 512)
-    lambda_timeout      = optional(number, 60)
-    config = object({
-      tokenPath      = optional(string)
-      minimumDaysOld = optional(number, 1)
-      dryRun         = optional(bool, false)
-    })
-  })
-  default = { config = {} }
-}
+# variable "runners_ssm_housekeeper" {
+#   description = <<EOF
+#   Configuration for the SSM housekeeper lambda. This lambda deletes token / JIT config from SSM.
+
+#   `schedule_expression`: is used to configure the schedule for the lambda.
+#   `enabled`: enable or disable the lambda trigger via the EventBridge.
+#   `lambda_memory_size`: lambda memery size limit.
+#   `lambda_timeout`: timeout for the lambda in seconds.
+#   `config`: configuration for the lambda function. Token path will be read by default from the module.
+#   EOF
+#   type = object({
+#     schedule_expression = optional(string, "rate(1 day)")
+#     enabled             = optional(bool, true)
+#     lambda_memory_size  = optional(number, 512)
+#     lambda_timeout      = optional(number, 60)
+#     config = object({
+#       tokenPath      = optional(string)
+#       minimumDaysOld = optional(number, 1)
+#       dryRun         = optional(bool, false)
+#     })
+#   })
+#   default = { config = {} }
+# }
 
 variable "metrics_namespace" {
   description = "The namespace for the metrics created by the module. Merics will only be created if explicit enabled."

I'll keep this issue open to track addressing the underlying issue.