Provider with dependencies does not wait for dependencies

[apparentlymart]

Consider the following configuration:

provider "aws" {
    region = "${terraform_remote_state.baz.output.region}"
}

resource "terraform_remote_state" "baz" {
    backend = "s3"
    config {
        region = "us-west-1"
        bucket = "apparentlymart-example"
        key = "example"
    }
}

resource "aws_instance" "foo" {
    // this doesn't need to be valid for the sake of this example
}

Here we have a provider config that contains an interpolation from a resource. The dependency graph suggests that this will work as expected, with the provider depending on the remote state.

However, it appears that Terraform doesn't wait until the dependency is satisfied before interpolating the value and instantiating the provider. Starting from a fresh, empty state:

$ terraform apply
There are warnings and/or errors related to your configuration. Please
fix these before continuing.

Errors:

  * 1 error(s) occurred:

* 1 error(s) occurred:

* Not a valid region: 

Looks like the interpolation resulted in the empty string, which causes the instantiation to fail as expected.

However if we comment out the aws_instance resource temporarily and run again:

$ terraform apply
terraform_remote_state.baz: Creating...
  backend:       "" => "s3"
  config.#:      "" => "3"
  config.bucket: "" => "apparentlymart-example"
  config.key:    "" => "example"
  config.region: "" => "us-west-1"
  output.#:      "" => "<computed>"
terraform_remote_state.baz: Creation complete

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

The state of your infrastructure has been saved to the path
below. This state is required to modify and destroy your
infrastructure, so keep it safe. To inspect the complete state
use the `terraform show` command.

State path: terraform.tfstate

No reason to instantiate the AWS provider here, so no problem. However, now we can uncomment the instance resource and run again:

$ terraform apply
There are warnings and/or errors related to your configuration. Please
fix these before continuing.

Errors:

  * aws_instance.foo: "instance_type": required field is not set
  * aws_instance.foo: "ami": required field is not set

Still not successful, but notice it's now the instance that's failing validation rather than the provider, because this time the region interpolation got the value that was saved in the state from the last run.

So with all of this said, it looks like the provider instantiation is happening after the dependent resource has been allocated and seeded from the state (if any), but before the dependent resource has had a chance to execute its read/create/update steps.

Either resource interpolations into providers should fail with an explicit error saying it's not allowed, or the provider should not be instantiated until all of its dependencies have been created/updated. I'd prefer the latter, since I want to use a remote state to tell my application which AWS region to deploy into.

In case it's helpful, I've also uploaded the debug log.

[jasonkeene]

I also ran into this today where I wanted the docker provider to be dependent on a compute instance. The graph shows the provider dependent on the resource but the plan fails because the value isn't interpolated. I'm guessing providers are eagerly instantiated before anything else.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.