Terraform v1.10.0 breaks `apply --auto-approve` when using list/dict variables

[pvieito]

Terraform Version

$ terraform apply -auto-approve
aws_s3_bucket.sf_admin_swamp[0]: Refreshing state... [id=swamp-sf-admin-test]
aws_s3_bucket.model: Refreshing state... [id=shopfully-data-model-lab]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.
╷
│ Error: Can't change variable when applying a saved plan
│ 
│ The variable provider_aws_default_tags__default cannot be set using the
│ -var and -var-file options when applying a saved plan file, because a saved
│ plan includes the variable values that were set when it was created. The
│ saved plan specifies "{\"Environment\": \"LAB\", \"ProjectName\":
│ \"DataModel\", \"DeploymentName\": \"DataModel-Infrastructure-Model\",
│ \"CostCenter\": \"Engineering\", \"BusinessLine\": \"DataModel\", \"Role\":
│ \"DataModel\", \"ProductLine\": \"DataModel-Infrastructure-Model\",
│ \"Product\": \"DataModel-Infrastructure-Model\", \"Module\":
│ \"DataModel-Infrastructure-Model\", \"Stack\":
│ \"DataModel-Infrastructure-Model\", \"InfrastructureToolName\":
│ \"infrastructure\", \"InfrastructureGroup\": \"Model\",
│ \"InfrastructureDeploymentService\": \"terraform\"}" as the value whereas
│ during apply the value object with 13 attributes was set by an environment
│ variable. To declare an ephemeral variable which is not saved in the plan
│ file, use ephemeral = true.
╵

Terraform Configuration Files

Debug Output

Expected Behavior

This should not fail.

Actual Behavior

Fails even though we are not using a saved plan!

Steps to Reproduce

1. Use terraform list/dict variables
2. Set them with env-vars
3. terraform apply --auto-approve
4. Fails

Additional Context

No response

References

No response

[branchgrove]

Encountered this as well today making a lot of our pipelines bleed, had to resolve it by pinning the version to 1.9.8. It seems that the related pull request is this one: #35903.

[jonathandbyrd]

Also encountered. When i pinned the required_version to 1.9.8 it told me i couldn't do that as it did not conform to 1.10.0.

Edit: the inline suggestion is to use ephemeral = true for the variable in the variables.tf you're setting in main.tf, but that breaks, expectedly, because the for_each doesn't like using ephemerals

[dosaki]

We're also experiencing this.

[DT-BMA]

Happening to me too. Very weird behavior as I was migrating variables from "Per-Step" defines to "Per-Job" defines.
This change/version only breaks using List variables, and even Terraform Plan doesn't notice (or lie about there being) issues.

The variable (AZURE RBAC ADMIN LIST VAR) cannot be set using the -var and -var-file

Terraform will perform the following actions:
options when applying a saved plan file, because a saved plan includes the
variable values that were set when it was created. The saved plan specifies
azurerm_kubernetes_cluster.- will be created
resource "azurerm_kubernetes_cluster" "-"
"["",""]"

with Apply:
run: terraform apply -auto-approve -input=false

Worked fine last week, and if you do what it suggests, you get...

Error: Invalid use of ephemeral value
with azurerm_kubernetes_cluster.-,
on aks-cluster.tf, in resource "azurerm_kubernetes_cluster" "-":
admin_group_object_ids = (ADMIN GROUPS LIST VAR)

Ephemeral values are not valid in resource arguments, because resource
instances must persist between Terraform phases.

[ibshafique]

We are also facing the similar thing.

[leetcarey]

Same here

[alxwest]

Also encountered. When i pinned the required_version to 1.9.8 it told me i couldn't do that as it did not conform to 1.10.0.

Edit: the inline suggestion is to use ephemeral = true for the variable in the variables.tf you're setting in main.tf, but that breaks, expectedly, because the for_each doesn't like using ephemerals

I found this, if you're using a Github action calling hashicorp/setup-terraform@v3. To pin the version, configure it in the action's yaml.

steps:
- uses: hashicorp/setup-terraform@v3
  with:
    terraform_version: "1.9.8"