[Bug]: aws_ecs_task_definition does evaluates container_definitions as empty string when containing values known after apply

[aldenbe]

Terraform Core Version

1.9.2, 1.7.5

AWS Provider Version

5.59.0

Affected Resource(s)

aws_ecs_task_definition

Expected Behavior

container_definitions should defer to apply step if using values not known during planning

E.g.

terraform {
  required_version = ">= 1.0.0, < 2.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.58.0"
    }
  }
}
resource "aws_ecs_task_definition" "example" {
  family                   = "test"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"

  container_definitions = jsonencode([
    {
      "name": "example",
      "image": "ubuntu:latest",
      "cpu": 10,
      "memory": 512,
      "networkMode": "awsvpc",
      "portMappings": [
        {
          "containerPort": 443,
          "hostPort": 443
        }
      ],
      "essential": true,
      "environment": [
        {
          "name": "example",
          "value": aws_vpc.example.arn
        }
      ]
    }
  ])
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

Provides the expected output

Terraform will perform the following actions:

  # aws_ecs_task_definition.example will be created
  + resource "aws_ecs_task_definition" "example" {
      + arn                      = (known after apply)
      + arn_without_revision     = (known after apply)
      + container_definitions    = (known after apply)
      + family                   = "test"
      + id                       = (known after apply)
      + network_mode             = "awsvpc"
      + requires_compatibilities = [
          + "FARGATE",
        ]
      + revision                 = (known after apply)
      + skip_destroy             = false
      + tags_all                 = (known after apply)
      + track_latest             = false
    }

  # aws_vpc.example will be created
  + resource "aws_vpc" "example" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = (known after apply)
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags_all                             = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Actual Behavior

Version 5.59.0 no longer defers container_definitions to apply and instead assumes empty string

Terraform will perform the following actions:

  # aws_ecs_task_definition.example will be created
  + resource "aws_ecs_task_definition" "example" {
      + arn                      = (known after apply)
      + arn_without_revision     = (known after apply)
      + family                   = "test"
      + id                       = (known after apply)
      + network_mode             = "awsvpc"
      + requires_compatibilities = [
          + "FARGATE",
        ]
      + revision                 = (known after apply)
      + skip_destroy             = false
      + tags_all                 = (known after apply)
      + track_latest             = false
    }

  # aws_vpc.example will be created
  + resource "aws_vpc" "example" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = (known after apply)
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + tags_all                             = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Leading to an inconsistent final plan error

Relevant Error/Panic Output Snippet

│ Error: Provider produced inconsistent final plan
│
│ When expanding the plan for aws_ecs_task_definition.example to include new values learned so far during apply, provider "registry.terraform.io/hashicorp/aws" produced an invalid new value for
│ .container_definitions: was cty.StringVal(""), but now
│ cty.StringVal("[{\"Command\":null,\"Cpu\":10,\"CredentialSpecs\":null,\"DependsOn\":null,\"DisableNetworking\":null,\"DnsSearchDomains\":null,\"DnsServers\":null,\"DockerLabels\":null,\"DockerSecurity
Options\":null,\"EntryPoint\":null,\"Environment\":[{\"Name\":\"example\",\"Value\":\"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-f148355b\"}],\"EnvironmentFiles\":null,\"Essential\":true,\"ExtraHosts\":
null,\"FirelensConfiguration\":null,\"HealthCheck\":null,\"Hostname\":null,\"Image\":\"ubuntu:latest\",\"Interactive\":null,\"Links\":null,\"LinuxParameters\":null,\"LogConfiguration\":null,\"Memory\":5
12,\"MemoryReservation\":null,\"MountPoints\":null,\"Name\":\"example\",\"PortMappings\":[{\"AppProtocol\":\"\",\"ContainerPort\":443,\"ContainerPortRange\":null,\"HostPort\":443,\"Name\":null,\"Protoco
l\":\"\"}],\"Privileged\":null,\"PseudoTerminal\":null,\"ReadonlyRootFilesystem\":null,\"RepositoryCredentials\":null,\"ResourceRequirements\":null,\"Secrets\":null,\"StartTimeout\":null,\"StopTimeout\":null,\"SystemControls\":null,\"Ulimits\":null,\"User\":null,\"VolumesFrom\":null,\"WorkingDirectory\":null}]").
│
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.

### Terraform Configuration Files

terraform {
  required_version = ">= 1.0.0, < 2.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.59.0"
    }
  }
}
resource "aws_ecs_task_definition" "example" {
  family                   = "test"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"

  container_definitions = jsonencode([
    {
      "name": "example",
      "image": "ubuntu:latest",
      "cpu": 10,
      "memory": 512,
      "networkMode": "awsvpc",
      "portMappings": [
        {
          "containerPort": 443,
          "hostPort": 443
        }
      ],
      "essential": true,
      "environment": [
        {
          "name": "example",
          "value": aws_vpc.example.arn
        }
      ]
    }
  ])
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

### Steps to Reproduce

Attempt to apply provided terraform configuration

### Debug Output

_No response_

### Panic Output

_No response_

### Important Factoids

_No response_

### References

_No response_

### Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[aldenbe]

duplicate of #38461

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[chrisolido]

Its during terraform apply