In the Terraform language there is a sense of a value being "unknown", which the plan renderer displays as (known after apply)
as we see here.
Unknown values originate in providers, which are expected to respond to a planning request by returning as much of the result as they are able to predict based on information already available, but marking anything they can't know without more information as "unknown".
Then in the Terraform language, any operation you perform in an expression where the result requires knowing a value that is marked as unknown will cause that result in turn to also be unknown.
In your case, it seems like you built this security_groups
value in a way where the list as a whole ended up being unknown. A whole list being unknown typically represents that we don't know the list's length, because if we know the list's length then it would instead be a known list with unknown values inside it, perhaps like this:
~ security_groups = [
+ (known after apply),
+ "sg-abc123",
+ (known after apply),
]
The very general answer to your question, then, is that if you need or want something to be known at planning time then you need to decide carefully how you'll compute that result so that the information you need to understand the plan can be visible where you need it. Sometimes it's possible to do that though some careful thought on how you determine certain values, such as deciding the length of a list based on something known in configuration even though some of the items inside the list might not be known.
For example, if you are creating a set of objects using a single resource with count
set then the length(...)
result of that resource, like length(aws_instance.example)
, will always be a known value because count
must always be known during planning. As a result, other derived operations like aws_instance.example[*].id
can produce a known list containing unknown values, so that even though the values themselves aren't known yet you can still verify that you have the number of elements you were expecting.
There are some situations where there is no answer as long as you want to apply all of the changes in one step: Terraform can't show you what it doesn't know. In that case, if knowing those results for a particular value is an important part of your process then you might decide to split the configuration into two separate configurations that you'll apply separately, in order. You can then use data sources to allow the second configuration to find any necessary objects created by the first configuration.
true
orfalse
at the output of your plan whether your interpolation states "(known after apply)" or not, then you could find this interesting.