Unsuitable value for child module variable "backends"

[nguyen-doan]

When creating new http-lb, I went to a syntax/type error which is shown as below:

Error: Invalid value for module argument

  on https-lb.tf line 29, in module "gce-lb-https":
  29:   backends = {
  30:     default = {
  31:       description                     = null
  32:       protocol                        = "HTTP/2"
  33:       port                            = 443
  34:       port_name                       = "http2"
  35:       timeout_sec                     = 30
  36:       connection_draining_timeout_sec = 300
  37:       enable_cdn                      = "false"
  38:       session_affinity                = null
  39:       affinity_cookie_ttl_sec         = null
  40:       security_policy                 = google_compute_security_policy.default_rules
  41:       health_check                    = google_compute_https_health_check.https_health_check.id
  43:       log_config = {
  44:         enable = true
  45:         sample_rate = 0.2
  46:       }
  48:       groups = [
  49:         {
  50:           group                        = google_compute_instance_group.my_instance_group.self_link
  51:           balancing_mode               = "UTILIZATION"
  52:           capacity_scaler              = 100
  53:           description                  = null
  54:           max_connections              = null
  55:           max_connections_per_instance = null
  56:           max_connections_per_endpoint = null
  57:           max_rate                     = null
  58:           max_rate_per_instance        = null
  59:           max_rate_per_endpoint        = null
  60:           max_utilization              = 80
  61:         },
  62:       ]
  63:     }
  64:   }

The given value is not suitable for child module variable "backends" defined
at
.terraform/modules/gce-lb-https/terraform-google-lb-http-4.0.0/variables.tf:69,1-20:
element "default": attribute "timeout_sec": number required.

The value timeout_sec in backends.default block is already number.
I tried to plan several times with module version 3.2.0 and 4.0.0, but still got the same error with different values:

element "default": attribute "port_name": string required.
element "default": attribute "port": number required.
element "default": attribute "protocol": string required.
element "default": attribute "health_check": object required.

My terraform version: 0.12.20

[rossrochford]

Can confirm I have the same issue.

[jerckov]

@nguyen-doan I had same problem when only google provider was used. After added google-beta provider, error was gone.

[aaronstutzer]

I have the same issue even with the google-beta provider 🤷

[rantoniuk]

Currently the module expects full backend declarations without using the defaults for the "backends" definition. I think it used to be better in the past, where only some of the params were required.

[morgante]

Unfortunately Terraform Core doesn't support optional object values - hashicorp/terraform#19898

[rantoniuk]

That's indeed sad, having hashicorp/terraform#22449 would be a step forward.
Just out of curiosity, why was it possible in the past? I can see the configuration data format was different back then, but I'm just wondering if some mix of past approach with current configuration scheme would be possible to achieve..

[ocervell]

Please check here, apparently we can set type=any but we lose variable validation until version 0.13 using validate blocks.

[acdha]

If anyone else hits this, I side-stepped the issue on an old project by editing .terraform/modules/gce-lb-http/variables.tf to change the backend to type=any long enough to upgrade to Terraform 0.13, running an apply (which produced no changes) to bump the saved state version, and then upgrading to Terraform 0.14, which has better validation which reports the specific failing element.

In my project these backend additions were required to match the existing config:

custom_request_headers = null
security_policy        = null
iap_config = {
  enable = false
  enable               = false
  oauth2_client_id     = null
  oauth2_client_secret = null
}

… and the health-check required adding logging = null