External fails when -refresh=false

[kitsunde]

Shouldn't external always run even with -refresh=false? Since it's calling something that has side effects? Or at least run the first time?

Terraform Version

Terraform v0.11.7

• provider.aws v1.27.0
• provider.external v1.0.0

Affected Resource(s)

• external

Terraform Configuration Files

data "external" "external" {
  program = ["${path.module}/generate.sh"]
}

resource "aws_key_pair" "key" {
  public_key = "${data.external.external.result.public_key}"
}

generate.sh:

#!/bin/bash
echo {\"public_key\": \"test\"}

Expected Behavior

It should work.

Actual Behavior

Error: Error running plan: 1 error(s) occurred:

* module.key.aws_key_pair.key: 1 error(s) occurred:

* module.key.aws_key_pair.key: Resource 'data.external.external' does not have attribute 'result.public_key' for variable 'data.external.external.result.public_key'

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform plan -refresh=false

[apparentlymart]

Hi @kitsunde,

Since it is a data source, it is by design that it doesn't run when refresh is disabled.

Although you certainly could use it to run something with side-effects, that is a misuse of the feature. Data sources are for reading data only.

[gnom7]

Hey @apparentlymart, could you please advice some alternative to using external for cases when someone needs to run some bash/etc. with side effects and record it's output?
My use case is - I'd like to auto-init (similarly to auto-unseal) Vault and store keys in encrypted Terraform backend (haven't luck to find any existing viable automation solution for this).

[bflad]

Hi @kitsunde 👋 Thank you for raising this. It appears Martin answered this awhile ago so I'm going to close this.

@gnom7 while I cannot provide direct recommendations for your situation, hashicorp/terraform-provider-vault#122 appears to be the most analogous for the use case you mention. Typically it is expected that explicit resources and data sources should be available from a provider built to manage that infrastructure. Other providers will have domain expertise that is appropriate to the issue. This external provider could theoretically support the functionality of a run-once type of resource (see #5), however it may not be an appropriate solution with Terraform's design principles.

If you have further configuration or troubleshooting questions, please also check out HashiCorp Discuss where there are far more folks watching these types of topics and able to answer. The issues in this repository are only monitored by a small subset of provider maintainers for bug reports and feature requests.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.