terraform 0.13 module (containing data source) reports error

[njuCZ]

Terraform Version

0.13

Terraform Configuration Files

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "test" {
  name     = "my-resources"
  location = "West Europe"
}

module "network" {
  source              = "Azure/network/azurerm"
  resource_group_name = azurerm_resource_group.test.name
  address_space       = "10.0.0.0/16"
  subnet_prefixes     = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  subnet_names        = ["subnet1", "subnet2", "subnet3"]

  tags = {
    environment = "dev"
    costcenter  = "it"
  }
}

Debug Output

Crash Output

---

Error: Error: Resource Group "my-resources" was not found

  on .terraform/modules/network/terraform-azurerm-network-3.1.1/main.tf line 2, in data "azurerm_resource_group" "network":
   2: data "azurerm_resource_group" "network" {

Expected Behavior

terraform should know "module.network" replys on resource "azurerm_resource_group". data source "azurerm_resource_group" should not report error

Actual Behavior

terraform read data source in module and found it does not exist, then throw error

Steps to Reproduce

terraform plan

Additional Context

there is a workaround to add "depends_on" for module, but I think terraform should knows the dependency automatically.

there is no such problem in terraform 0.12

References

Azure/terraform-azurerm-network#44

[apparentlymart]

Hi @njuCZ! Thanks for reporting this.

Unfortunately the behavior you've observed here is consistent with how Terraform's data resource feature is designed in current versions of Terraform: it will defer reading a data resource to apply time only if its configuration contains a value that can't be determined until the apply step.

Unfortunately, because Azure uses user-provided names rather than opaque, auto-generated identifiers, azurerm_resource_group.test.name has a known value during the plan step and so Terraform believes it should be able to read that data resource. That then fails because the object hasn't been created yet.

In current versions of Terraform we generally recommend that a specific configuration should either be managing an object or reading the object using a data resource, but not both at the same time. You could achieve that in this situation by declaring that your module depends on a resource group object rather than just a resource group name, and then passing the whole object in to the module so that it has access to all of the values it needs without redundantly re-reading the values from the remote system:

variable "resource_group" {
  type = object({
    # Include here whatever subset of attributes of azurerm_resource_group
    # the module needs to do its work.
    name     = string
    location = string
  })
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "test" {
  name     = "my-resources"
  location = "West Europe"
}

module "network" {
  source = "Azure/network/azurerm"

  resource_group  = azurerm_resource_group.test
  address_space   = "10.0.0.0/16"
  subnet_prefixes = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  subnet_names    = ["subnet1", "subnet2", "subnet3"]

  tags = {
    environment = "dev"
    costcenter  = "it"
  }
}

Although this behavior is intentional, we are expecting to continue to improve it in forthcoming releases, starting with some refactoring that is currently underway for Terraform 0.14. Therefore I'm going to label this as an enhancement, rather than closing it, so that we can represent the use-case this represents and share updates about it in future as we progress through refinements to the design of data resources in future Terraform versions.

[njuCZ]

@apparentlymart thanks for your kindly explanation. I am looking forward this feature in terraform 0.14.
There is one issue that I want to ask more: if all values of a data source are known during plan step, it will directly read it. So I assume this issue hashicorp/terraform-provider-azurerm#8515 is also caused by the same reason? Only azurerm_function_app is created successfully, the data source could read the key. But now using terraform 0.13, it tells this resource does not exist and could not read it

[solarmosaic-kflorence]

A very easy trap to fall into, but such a nice elegant solution that actually improved the design of my module. Would be great to have better error messaging around this at the very least.