terraform_remote_state is not interpolated in aws_iam_instance_profile

[radeksimko]

This may be related to #2751 but I cannot confirm that yet.

shared/main.tf

output "env_name" {
  value = "test"
}

$ terraform remote config -backend=S3 -backend-config="bucket=terraform-test-bucket" -backend-config="key=terraform.tfstate" -backend-config="region=us-east-1"

$ terraform apply

sample.tf

resource "terraform_remote_state" "shared" {
  backend = "s3"

  config {
    bucket = "terraform-test-bucket"
    key = "terraform.tfstate"
    region = "us-east-1"
  }
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_iam_instance_profile" "example" {
    name = "${terraform_remote_state.shared.output.env_name}-example"
    roles = ["${aws_iam_role.my_role.name}"]
}

resource "aws_iam_role" "my_role" {
  name = "${terraform_remote_state.shared.output.env_name}-example"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

$ terraform apply

Error applying plan:

1 error(s) occurred:

* aws_iam_instance_profile.example: diffs didn't match during apply. This is a bug with Terraform and should be reported.

Here's the expanded and colored diff:

diff --git a/structure b/structure
index cf1cee5..b27fa78 100644
--- a/structure
+++ b/structure
@@ -18,9 +18,9 @@
             RequiresNew: false,
             Type: 0x0
         },
-        "roles.176985364": *terraform.ResourceAttrDiff{
+        "roles.1557715386": *terraform.ResourceAttrDiff{
             Old: "",
-            New: "${terraform_remote_state.shared.output.env_name}-example",
+            New: "test-example",
             NewComputed: false,
             NewRemoved: false,
             NewExtra: interface {}(nil),
@@ -56,7 +56,7 @@
         },
         "name": *terraform.ResourceAttrDiff{
             Old: "",
-            New: "${terraform_remote_state.shared.output.env_name}-example",
+            New: "test-example",
             NewComputed: false,
             NewRemoved: false,
             NewExtra: interface {}(nil),

[mitchellh]

Can you post the full debug log for this?

[radeksimko]

@mitchellh https://gist.github.com/radeksimko/14f61d6e1a59e6882e7e

[phinze]

Reproduced locally with your example. I think this might be a generalized problem with computed / interpolated mappings that expresses itself in a myriad of ways.

[roboll]

is there any update on this? i'm seeing diffs didn't match during apply on aws instance profiles.

[radeksimko]

I just tried to do the following using my original example:

terraform apply -target=terraform_remote_state.shared
terraform apply

and it worked aok (no errors).

I think this comes from the fact that we're comparing diff coming from walkPlan (which cannot do any interpolation on terraform_remote_state references at that point) with a diff from walkApply that has already interpolated references at that point, because the resource has been created and it has all the outputs.

It appears the diff is changing during the lifecycle of walkApply as resources are being created and make the interpolation possible.

[prozach]

I believe I'm running into something similar. Interpolation doesn't seem to work.

var = "${p(terraform_remote_state.prod.output.subnets, concat("myapp-", var.env, "-common"))}"

With an error like:

* lookup: lookup in '' failed to find 'app0-testing-common' in:

I have the core terraform_remote_state defined, and there is an output for subnet which contains a hash.

Is this the same issue with interpolation? Is there a workaround or an ETA on a fix?

[jonathanallen]

I think I am seeing a similar issue trying to use a terraform_remote_state resource in a lookup:

 ssl_certificate_id = "${lookup(var.ssl_certificates, terraform_remote_state.vpc.output.environment)}"

Plan results in the error:

Error configuring: 1 error(s) occurred:

* lookup: lookup in 'ssl_certificates' failed to find '' in:

${lookup(var.ssl_certificates, terraform_remote_state.vpc.output.environment)}

Any suggestions on a workaround would be appreciated.

[mitchellh]

Just tested with this exact config that @phinze could repro earlier and it now works! :) So this was fixed at some point.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.