Panic in flatten() function

[gtmtech]

Terraform 1.2.3

Getting a panic in the flatten() function:

│ Error: Error in function call
│ 
│   on .terraform/modules/foo/policies.tf line 3, in data "aws_iam_policy_document" "assume_role_policy":
│    3:     for_each = toset(flatten( [for d in var.assume_role_policy_documents: d.statement ] ))
│     ├────────────────
│     │ var.assume_role_policy_documents is list of object with 3 elements
│ 
│ Call to function "flatten" failed: panic in function implementation: value
│ is null
│ goroutine 17772 [running]:
│ runtime/debug.Stack()
│ 	/usr/local/go/src/runtime/debug/stack.go:24 +0x68
│ github.com/zclconf/go-cty/cty/function.errorForPanic(...)
│ 	/Users/distiller/go/pkg/mod/github.com/zclconf/go-cty@v1.10.0/cty/function/error.go:44
│ github.com/zclconf/go-cty/cty/function.Function.ReturnTypeForValues.func1()
│ 	/Users/distiller/go/pkg/mod/github.com/zclconf/go-cty@v1.10.0/cty/function/function.go:217
│ +0x88
│ panic({0x104bb3880, 0x105054f78})
│ 	/usr/local/go/src/runtime/panic.go:838 +0x204
│ github.com/zclconf/go-cty/cty.Value.LengthInt({{{0x10507bf90?,
│ 0x140191f1a80?}}, {0x0?, 0x0?}})
│ 	/Users/distiller/go/pkg/mod/github.com/zclconf/go-cty@v1.10.0/cty/value_ops.go:1063
│ +0x24c
│ github.com/zclconf/go-cty/cty.Value.Length({{{0x10507bf90?,
│ 0x140191f1a80?}}, {0x0?, 0x0?}})
│ 	/Users/distiller/go/pkg/mod/github.com/zclconf/go-cty@v1.10.0/cty/value_ops.go:1034
│ +0x198

Basically my code is trying to "merge" 3 data.aws_iam_policy_documents for the purpose of crafting an assume_role_policy on an aws_iam_role out of component parts:

module "myrole" {
  source = "../../../components/role"
  assume_role_policy_documents = [
    module.policy_can_be_assumed_by_foo.policy,
    module.policy_can_be_assumed_by_bar.policy,
    module.policy_can_be_assumed_by_legacy_saml_federation.policy
  ]
  ...
}

and in the role module I am trying to stitch together like this:

data "aws_iam_policy_document" "assume_role_policy" {
  dynamic "statement" {
    for_each = toset(flatten([for d in var.assume_role_policy_documents : d.statement]))
    content {
      sid       = try(statement.value["sid"], null)
      actions   = try(statement.value["actions"], null)
      effect    = try(statement.value["effect"], null)
      resources = try(statement.value["resources"], null)
      dynamic "principals" {
        for_each = toset(try([statement.value["principals"]], []))
        content {
          type        = try(principals.value["type"], null)
          identifiers = try(principals.value["identifiers"], null)
        }
      }
    }
  }
}

[gtmtech]

If it helps track it down, one of the statement's was null, because the aws_iam_policy_document datasource had no statement blocks

[jbardin]

While the flatten function handles null values correctly, a typed null can slip through.

flatten([tolist(null)])

The panic is in this area:

│ 	/Users/jbardin/go/pkg/mod/github.com/zclconf/go-cty@v1.10.0/cty/function/stdlib/collection.go:528 +0x174
│ github.com/zclconf/go-cty/cty/function/stdlib.flattener({{{0x105544f70?, 0x140009126f0?}}, {0x105021ae0?, 0x14000912708?}})
│ 	/Users/jbardin/go/pkg/mod/github.com/zclconf/go-cty@v1.10.0/cty/function/stdlib/collection.go:553 +0x424
│ github.com/zclconf/go-cty/cty/function/stdlib.glob..func22({0x140001b8a60, 0x140009126f0?, 0x105544e58?})
│ 	/Users/jbardin/go/pkg/mod/github.com/zclconf/go-cty@v1.10.0/cty/function/stdlib/collection.go:492 +0x9c

[apparentlymart]

Hmm TIL that a third-party contribution to one repository can potentially close an issue in another repository if the person who merges the PR (or the person who submitted the PR? unclear) happens to also have access to close an issue in that second repository.

Anyway... it being fixed in my upstream repository doesn't fix it here until we merge a PR to adopt the newer version of that upstream library, so this is still open for now.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.