Warning on providers that make unsafe references to resource attributes

[wrschneider]

Terraform Version

1.3.5

Use Cases

Terraform provider with dependency on another TF resource (Kubernetes cluster, Databricks workspace, AWS IAM role, etc.)

Attempted Solutions

n/a

Proposal

In response to issues:

#31520
#30910

It would be helpful for Terraform to generate a warning on parse or validation to indicate that a provider has a dependency on attributes exported from a resource.

While the docs say this is unsupported, what happens in practice is something like:

• initial apply works great
• you make some change that requires replacement of an underlying resource (e.g., Databricks workspace, Kubernetes cluster)
• subsequent apply generates weird errors, often related to authentication, because the provider depends on affected resources and Terraform is unable to refresh existing resources in state

Many, many hours of troubleshooting could have been saved with a warning up front like "this is unsupported and may cause problems in , here's a link to relevant docs"

References

#31520
#30910

[apparentlymart]

Thanks for sharing this feedback, @wrschneider.

I just wanted to cross-link to #30937 because that issue is describing the underlying problem that you want Terraform to warn about, and so a solution to what you've requested here should presumably take into account what might happen if it does become safe to refer to unknown values in a provider configuration later on, or if Terraform deals with it in some way other than an error.

We've not yet got a concrete design for that so it's hard to say immediately what that means, but hopefully we can find a way to address what you've shared here without also closing the door to providers handling unknown values better in the future.

[wrschneider]

@apparentlymart Thanks, it seems like the providers issue is just one aspect of a much thornier problem.