8

Here is an excerpt of my successful terraform plan

 ~ primary_network_interface_id = "eni-XXXXXXXXXXXXX -> (known after apply)
   ~ private_dns                  = "shshshshshshshshhs" -> (known after apply)
   ~ private_ip                   = "XXXXXXXXXXXXXXXXXX" -> (known after apply)
   + public_dns                   = (known after apply)
   + public_ip                    = (known after apply)
   ~ secondary_private_ips        = [] -> (known after apply)
   ~ security_groups              = [] -> (known after apply)

The above is part of aws_instance resource imported as an internal module. I intend to pass a list of security group IDs through variable security_groups such that during resource creation, it will be mapped to vpc_security_group_ids. However, with the above plan, I don't see how it has mapped successfully.

My question is - How do I know that apply will work? Known after apply is kind of 50-50 in this case? Also, didn't manage to spot anything in TF docs, so if there is something, I would be grateful if anyone can point me on that direction.

Thanks,

3
  • You just apply and hope for the best. It is as it says "known after apply". If possible, you can run this operation on some dummy resources in sandbox account first to test, but ultimately, you have to apply and see how it goes. You can also apply to individual resources, one by one, instead to everything at once.
    – Marcin
    Apr 11, 2021 at 23:21
  • Small clarification: Do you create the security groups also from terraform? or else you use the existing resources that were created outside of terraform? Oct 29, 2021 at 5:59
  • If you need a boolean that states true or false at the output of your plan whether your interpolation states "(known after apply)" or not, then you could find this interesting.
    – Teneko
    Sep 17, 2022 at 6:31

1 Answer 1

9

In the Terraform language there is a sense of a value being "unknown", which the plan renderer displays as (known after apply) as we see here.

Unknown values originate in providers, which are expected to respond to a planning request by returning as much of the result as they are able to predict based on information already available, but marking anything they can't know without more information as "unknown".

Then in the Terraform language, any operation you perform in an expression where the result requires knowing a value that is marked as unknown will cause that result in turn to also be unknown.

In your case, it seems like you built this security_groups value in a way where the list as a whole ended up being unknown. A whole list being unknown typically represents that we don't know the list's length, because if we know the list's length then it would instead be a known list with unknown values inside it, perhaps like this:

 ~ security_groups = [
     + (known after apply),
     + "sg-abc123",
     + (known after apply),
   ]

The very general answer to your question, then, is that if you need or want something to be known at planning time then you need to decide carefully how you'll compute that result so that the information you need to understand the plan can be visible where you need it. Sometimes it's possible to do that though some careful thought on how you determine certain values, such as deciding the length of a list based on something known in configuration even though some of the items inside the list might not be known.

For example, if you are creating a set of objects using a single resource with count set then the length(...) result of that resource, like length(aws_instance.example), will always be a known value because count must always be known during planning. As a result, other derived operations like aws_instance.example[*].id can produce a known list containing unknown values, so that even though the values themselves aren't known yet you can still verify that you have the number of elements you were expecting.

There are some situations where there is no answer as long as you want to apply all of the changes in one step: Terraform can't show you what it doesn't know. In that case, if knowing those results for a particular value is an important part of your process then you might decide to split the configuration into two separate configurations that you'll apply separately, in order. You can then use data sources to allow the second configuration to find any necessary objects created by the first configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.