data.tls_certificate.this.certificates is empty list of object

[henkka]

Terraform CLI and Provider Versions

terraform 1.2.5
hashicorp/tls 4.0.0
hashicorp/aws 4.23.0

Terraform Configuration

data "tls_certificate" "this" {
  url = aws_eks_cluster.this.identity[0].oidc[0].issuer
}

resource "aws_iam_openid_connect_provider" "this" {
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = [data.tls_certificate.this.certificates[0].sha1_fingerprint]
  url             = aws_eks_cluster.this.identity[0].oidc[0].issuer
}

Expected Behavior

terraform plan should work normally

Actual Behavior

terraform plan fails with the following error

╷
│ Error: Invalid index
│
│   on ../../../eksv2/cluster/oidcp.tf line 7, in resource "aws_iam_openid_connect_provider" "this":
│    7:   thumbprint_list = [data.tls_certificate.this.certificates[0].sha1_fingerprint]
│     ├────────────────
│     │ data.tls_certificate.this.certificates is empty list of object
│
│ The given key does not identify an element in this collection value: the collection has no elements.

Steps to Reproduce

Add

data "tls_certificate" "this" {
  url = aws_eks_cluster.this.identity[0].oidc[0].issuer
}

resource "aws_iam_openid_connect_provider" "this" {
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = [data.tls_certificate.this.certificates[0].sha1_fingerprint]
  url             = aws_eks_cluster.this.identity[0].oidc[0].issuer
}

to your state and run terraform plan

How much impact is this issue causing?

High

Logs

No response

Additional Information

Works with downgrading hashicorp/tls provider version to 3.4.0.

This use-case is also shown as an example in https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate

Code of Conduct

• I agree to follow this project's Code of Conduct

[absa-rsuarez]

This is affecting us as well...

[ghost]

I have faced this bug too. Pinning TLS provider version to 3.4 also helps me.

[kailashsridharan]

I am facing this issue too

hashicorp/terraform#31497

[fsalum]

Same here and pinning TLS provider to 3.4 works.

[tohid-acc]

can anyone explain or provide code for pinning tls provider to 3.4 ?

[wrsuarez]

can anyone explain or provide code for pinning tls provider to 3.4 ?

terraform {
required_providers {
tls = {
source = "hashicorp/tls"
version = "3.4.0"
}
}
}

[bflad]

Hi folks 👋 Thank you for the report and sorry you are running into this frustrating behavior right now.

My team has done some investigation on this and we have some leads on what the underlying issue might be, however it is going to take some additional time to sort out a potential solution. This issue appears to occur only when the data source has an "(known after apply)" (unknown) value for the url attribute. You may be able to workaround this issue by applying any configuration up to the unknown value for the url, e.g. the aws_eks_cluster.this resource in the original issue configuration, via the terraform plan or terraform apply command -target` flag, or switching it to a "hardcoded" string value temporarily.

As an easier fix in your environment, pinning to TLS provider version 3.4.0 using the Terraform configuration recommended in the above comments will ensure your Terraform runs continue as before without the special workaround, e.g.

terraform {
  required_providers {
    tls = {
      source = "hashicorp/tls"
      version = "3.4.0"
    }
  }
}

We will post an additional update when we have information to report. Thank you for your patience.

[detro]

Hi all, and apologies for the inconveniences caused by this issue.

Version v4.0.1 of the provider has been released, that addresses this issue with the tls_certificate data source.

Any feedback will be very appreciated.
Thank you

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.