use dataprovider aws_availability_zones for azs (as default)

[tbugfinder]

I'm trying to use data "aws_availability_zones" "available" {} as an input to azs. Unfortunately if I don't need e.g. public_subnet an error is raised:

Looks like a count on a given resource cannot be evaluated properly.

data "aws_availability_zones" "available" {}

azs                                =  ["${split(",", "${data.aws_availability_zones.available.names}")}"]
...
  private_subnets = ["192.168.1.0/25"]
  public_subnets  = []

...............

       Initializing provider plugins...

       Terraform has been successfully initialized!

       Error: module.myvpc.module.vpc.aws_subnet.public: 1 error(s) occurred:

       * module.myvpc.module.vpc.aws_subnet.public: At column 21, line 1: list "var.public_subnets" does not have any elements so cannot determine type. in:

       ${var.public_subnets[count.index]}

[tbugfinder]

Derived from the example, the code is:

$ cat main.tf
data "aws_availability_zones" "available" {}

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

#  azs             = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
  azs             = "${data.aws_availability_zones.available.names}"
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
#  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
#  public_subnets  = ['']

#  enable_nat_gateway = true
#  enable_vpn_gateway = true

  tags = {
    Terraform = "true"
    Environment = "dev"
  }
}

terraform init && terraform plan ends up in:

Initializing modules...
- module.vpc
  Found version 1.45.0 of terraform-aws-modules/vpc/aws on registry.terraform.io
  Getting source "terraform-aws-modules/vpc/aws"

Initializing provider plugins...
- Checking for available provider plugins on https://releases.hashicorp.com...
- Downloading plugin for provider "aws" (1.39.0)...

The following providers do not have any version constraints in configuration,
so the latest version was installed.

To prevent automatic upgrades to new major versions that may contain breaking
changes, it is recommended to add version = "..." constraints to the
corresponding provider blocks in configuration, with the constraint strings
suggested below.

* provider.aws: version = "~> 1.39"

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Error: module.vpc.aws_subnet.public: 1 error(s) occurred:

* module.vpc.aws_subnet.public: At column 21, line 1: list "var.public_subnets" does not have any elements so cannot determine type. in:

${var.public_subnets[count.index]}

This output lacks the update of the data provider. Actually I'm wondering if this a logic error in count as the data provider wasn't evaluated yet or a general terraform limit.

[antonbabenko]

Hi, Writing this without checking first, on vacation. If you need to have NAT gateway you also need to specify public_subnets (list of CIDR where NAT gateways will be created). Best regards, Anton. 5 жовт. 2018 р. о 14:01 tbugfinder <notifications@github.com> пише:

…

Derived from the example, the code is: $ cat main.tf data "aws_availability_zones" "available" {} module "vpc" { source = "terraform-aws-modules/vpc/aws" name = "my-vpc" cidr = "10.0.0.0/16" # azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] azs = "${data.aws_availability_zones.available.names}" private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] # public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] # public_subnets = [''] enable_nat_gateway = true enable_vpn_gateway = true tags = { Terraform = "true" Environment = "dev" } } terraform init && terraform plan ends up in: Initializing modules... - module.vpc Found version 1.45.0 of terraform-aws-modules/vpc/aws on registry.terraform.io Getting source "terraform-aws-modules/vpc/aws" Initializing provider plugins... - Checking for available provider plugins on https://releases.hashicorp.com... - Downloading plugin for provider "aws" (1.39.0)... The following providers do not have any version constraints in configuration, so the latest version was installed. To prevent automatic upgrades to new major versions that may contain breaking changes, it is recommended to add version = "..." constraints to the corresponding provider blocks in configuration, with the constraint strings suggested below. * provider.aws: version = "~> 1.39" Terraform has been successfully initialized! You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure. All Terraform commands should now work. If you ever set or change modules or backend configuration for Terraform, rerun this command to reinitialize your working directory. If you forget, other commands will detect it and remind you to do so if necessary. Error: module.vpc.aws_subnet.public: 1 error(s) occurred: * module.vpc.aws_subnet.public: At column 21, line 1: list "var.public_subnets" does not have any elements so cannot determine type. in: ${var.public_subnets[count.index]} This output lacks the update of the data provider. Actually I'm wondering if this a logic error in count as the data provider wasn't evaluated yet. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[tbugfinder]

Probably "relatd" to hashicorp/terraform-provider-aws#631

[tbugfinder]

Hi, Writing this without checking first, on vacation. If you need to have NAT gateway you also need to specify public_subnets (list of CIDR where NAT gateways will be created). Best regards, Anton. 5 жовт. 2018 р. о 14:01 tbugfinder notifications@github.com пише:
…

Correct (updated the code snippet).
Although it doesn't matter.

[antonbabenko]

You are absolutely right! Good finding!

public_subnets were always required to contain a valid value, which is not needed in cases like you described.

I have just fixed it in v1.46.0.

[tbugfinder]

Thank you very much. I've verified successfully.
Does this mean that TF evaluates resource-code even if count=0 before execution ?

[antonbabenko]

I don't know the exact answer, really. :)

The only difference between public and other subnets is that public has a complicated expression in count. When I simplified count to be just 1 or 0 the previous code worked well, so it does not seem to evaluate anything inside resources.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.