Terraform planning failed error when creating multiple Device Admin Policy Sets

[grg1bbs]

When creating more than one Device Admin Policy Set, Terraform throws a Planning failed error for "Inconsistent conditional result types"

If I comment out the second Policy Set block, there are no issues with the create/update operations.

Example error

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: Inconsistent conditional result types
│ 
│   on .terraform/modules/ise/ise_device_admin.tf line 161, in locals:
│  161:   device_admin_policy_sets = var.manage_device_administration ? [
│  162:     for ps in try(local.ise.device_administration.policy_sets, []) : {
│  163:       condition_type             = try(ps.condition.type, local.defaults.ise.device_administration.policy_sets.condition.type, null)
│  164:       condition_is_negate        = try(ps.condition.is_negate, local.defaults.ise.device_administration.policy_sets.condition.is_negate, null)
│  165:       condition_attribute_name   = strcontains(try(ps.condition.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, ""), ":") ? split(":", try(ps.condition.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null))[1] : try(ps.condition.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null)
│  166:       condition_attribute_value  = strcontains(try(ps.condition.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, ""), ":") ? split(":", try(ps.condition.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null))[1] : try(ps.condition.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null)
│  167:       condition_dictionary_name  = strcontains(try(ps.condition.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, ""), ":") ? split(":", try(ps.condition.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null))[0] : null
│  168:       condition_dictionary_value = strcontains(try(ps.condition.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, ""), ":") ? split(":", try(ps.condition.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null))[0] : null
│  169:       condition_id               = contains(local.known_conditions_device_admin, try(ps.condition.name, "")) ? ise_device_admin_condition.device_admin_condition[ps.condition.name].id : try(data.ise_device_admin_condition.device_admin_condition[ps.condition.name].id, null)
│  170:       condition_operator         = try(ps.condition.operator, local.defaults.ise.device_administration.policy_sets.condition.operator, null)
│  171:       description                = try(ps.description, local.defaults.ise.device_administration.policy_sets.description, null)
│  172:       is_proxy                   = try(ps.is_proxy, local.defaults.ise.device_administration.policy_sets.is_proxy)
│  173:       name                       = ps.name
│  174:       service_name               = try(ps.service_name, local.defaults.ise.device_administration.policy_sets.service_name)
│  175:       state                      = try(ps.state, local.defaults.ise.device_administration.policy_sets.state)
│  176:       rank                       = try(ps.rank, local.defaults.ise.device_administration.policy_sets.rank, null)
│  177:       children = try([for i in ps.condition.children : {
│  178:         attribute_name   = strcontains(try(i.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, ""), ":") ? split(":", try(i.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null))[1] : try(i.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null)
│  179:         attribute_value  = strcontains(try(i.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, ""), ":") ? split(":", try(i.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null))[1] : try(i.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null)
│  180:         dictionary_name  = strcontains(try(i.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, ""), ":") ? split(":", try(i.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null))[0] : null
│  181:         dictionary_value = strcontains(try(i.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, ""), ":") ? split(":", try(i.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null))[0] : null
│  182:         condition_type   = try(i.type, local.defaults.ise.device_administration.policy_sets.condition.type, null)
│  183:         is_negate        = try(i.is_negate, local.defaults.ise.device_administration.policy_sets.condition.is_negate, null)
│  184:         operator         = try(i.operator, local.defaults.ise.device_administration.policy_sets.condition.operator, null)
│  185:         id               = contains(local.known_conditions_device_admin, try(i.name, "")) ? ise_device_admin_condition.device_admin_condition[i.name].id : try(data.ise_device_admin_condition.device_admin_condition[i.name].id, null)
│  186:         children = try([for j in i.children : {
│  187:           attribute_name   = strcontains(try(j.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, ""), ":") ? split(":", try(j.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null))[1] : try(j.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null)
│  188:           attribute_value  = strcontains(try(j.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, ""), ":") ? split(":", try(j.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null))[1] : try(j.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null)
│  189:           dictionary_name  = strcontains(try(j.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, ""), ":") ? split(":", try(j.attribute_name, local.defaults.ise.device_administration.policy_sets.condition.attribute_name, null))[0] : null
│  190:           dictionary_value = strcontains(try(j.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, ""), ":") ? split(":", try(j.attribute_value, local.defaults.ise.device_administration.policy_sets.condition.attribute_value, null))[0] : null
│  191:           condition_type   = try(j.type, local.defaults.ise.device_administration.policy_sets.condition.type, null)
│  192:           is_negate        = try(j.is_negate, local.defaults.ise.device_administration.policy_sets.condition.is_negate, null)
│  193:           operator         = try(j.operator, local.defaults.ise.device_administration.policy_sets.condition.operator, null)
│  194:           id               = contains(local.known_conditions_device_admin, try(j.name, "")) ? ise_device_admin_condition.device_admin_condition[j.name].id : try(data.ise_device_admin_condition.device_admin_condition[j.name].id, null)
│  195:         }], null)
│  196:       }], null)
│  197:     }
│  198:   ] : []
│     ├────────────────
│     │ data.ise_device_admin_condition.device_admin_condition is object with no attributes
│     │ ise_device_admin_condition.device_admin_condition is object with no attributes
│     │ local.defaults.ise.device_administration.policy_sets is object with 7 attributes
│     │ local.defaults.ise.device_administration.policy_sets.condition is object with 2 attributes
│     │ local.defaults.ise.device_administration.policy_sets.condition.is_negate is false
│     │ local.defaults.ise.device_administration.policy_sets.is_proxy is false
│     │ local.defaults.ise.device_administration.policy_sets.state is "enabled"
│     │ local.ise.device_administration.policy_sets is tuple with 2 elements
│     │ local.known_conditions_device_admin is empty tuple
│ 
│ The true result value has the wrong type: element types must all match for conversion to list.

Example code

ise:
  device_administration:
    policy_sets:
## Create Device Admin Policy Set - Routers and Switches
      - name: Routers and Switches
        description: Cisco Routers and Switches
        condition:
          type: ConditionOrBlock
          children:
            - type: ConditionAttributes
              attribute_name: DEVICE:Device Type
              operator: equals
              attribute_value: "All Device Types#Cisco Switch"
            - type: ConditionAttributes
              attribute_name: DEVICE:Device Type
              operator: equals
              attribute_value: "All Device Types#Cisco Router"
        service_name: PAP

### Create Device Admin Policy Set - Wireless Controllers
      - name: Wireless Controllers
        description: Cisco Wireless LAN Controllers
        condition:
          type: ConditionAttributes
          attribute_name: DEVICE:Device Type
          operator: equals
          attribute_value: "All Device Types#Cisco WLC"
        service_name: PAP

[grg1bbs]

Confirmed this issue is resolved in latest branch