Conditional dynamic block

Question

Trying to set an optional block called "sensitive_labels" and i'm trying to set it as an optional one, however, doesn't work.

My code:

variables.tf:

variable "notification_channels" {
type = any
}

variable "project_id" {
type = string
}

main.tf:

project      = var.project_id
for_each     = { for k, v in var.notification_channels : k => v }
type         = each.value.type
display_name = each.value.display_name
description  = each.value.description
labels       = each.value.labels
enabled      = each.value.enabled

dynamic "sensitive_labels" {
for_each = each.value.sensitive_labels != {} ?[each.value.sensitive_labels] : []
content {
auth_token = lookup(sensitive_labels.value, "auth_token", null)
}
}
}

dev.tfvars:

notification_channels = [
{
type         = "email"
display_name = "a channel to send emails"
description  = "a nice channel"
labels = {
email_address = "HeyThere@something.com"
}
enabled          = true
sensitive_labels = {} // this one doesn't give any errors.
},
{
type         = "email"
display_name = "HeyThere Email"
description  = "a channel to send emails"
labels = {
email_address = "HeyThere2@something.com"
}
enabled          = true
}
]

Getting:

Error: Unsupported attribute

on notification_channels.tf line 11, in resource "google_monitoring_notification_channel" "channels": 11: for_each = each.value.sensitive_labels != {} ? [each.value.sensitive_labels] : [] │ ├──────────────── each.value is object with 5 attributes

This object does not have an attribute named "sensitive_labels".

How can I make setting sensitive_labels an optional attribute here?

EDIT: This seems to work but feels a bit off:

  project      = var.project_id
  for_each     = { for k, v in var.notification_channels : k => v }
  type         = each.value.type
  display_name = each.value.display_name
  description  = each.value.description
  labels       = each.value.labels
  enabled      = each.value.enabled

  dynamic "sensitive_labels" {
    for_each = lookup(each.value, "sensitive_labels", {})
    content {
      auth_token = lookup(sensitive_labels.value, "auth_token", null)
    }
  }
}

Is there a better way that doesn't feel hacky?

Answer 1

A good place to start is to properly define a type constraint for your input variable, so that Terraform can understand better what data structure is expected and help ensure that the given value matches that data structure.

type = any is not there so you can skip defining a type constraint, but instead for the very rare situation where a module is just passing a data structure verbatim to a provider without interpreting it at all. Since your module clearly expects that input variable to be a map of objects (based on how you've used it), you should tell Terraform what object type you are expecting to recieve:

variable "notification_channels" {
  type = map(object({
    type             = string
    display_name     = string
    labels           = map(string)
    enabled          = bool
    sensitive_labels = object({
      auth_token  = string
      password    = string
      service_key = string
    })
  }))
}

From your example it seems like you want sensitive_labels to be optional, so that the caller of the module can omit it. In that case you can use the optional modifier when you declare that particular attribute, and also the three attributes inside it:

    sensitive_labels = optional(object({
      auth_token  = optional(string)
      password    = optional(string)
      service_key = optional(string)
    }))

An attribute that's marked as optional can be omitted by the caller, and in that case Terraform will automatically set it to null inside your module to represent that it wasn't set.

Now you can use this variable elsewhere in your module and safely assume that it will always have exactly the type defined in the variable block:

resource "google_monitoring_notification_channel" "channels" {
  for_each     = var.notification_channels

  project      = var.project_id
  type         = each.value.type
  display_name = each.value.display_name
  description  = each.value.description
  labels       = each.value.labels
  enabled      = each.value.enabled

  dynamic "sensitive_labels" {
    for_each = each.value.sensitive_labels[*]
    content {
      auth_token  = sensitive_labels.value.auth_token
      password    = sensitive_labels.value.password
      service_key = sensitive_labels.value.service_key
    }
  }
}

The each.value.sensitive_labels[*] expression is a splat expression using the single values as lists feature, which concisely transforms the given value into either a one-element list or a zero-element list depending on whether the value is null. That effectively means that there will be one sensitive_labels block if each.value.sensitive_labels is set, and zero blocks of that type if that attribute is unset (null).

The attributes inside those blocks can also just be assigned directly without any special logic, because Terraform will have automatically set them to null if not specified by the caller and setting a resource argument to null is always the same as not setting it at all.

If you take the time to actually describe the types of variables you expect then it tends to make logic elsewhere in the module much simpler, because you no longer need to deal with all of the ways in which the caller might pass you an incorrect value: Terraform will either convert the value automatically to the expected type if possible, or will report an error to the caller explaining why the value they provided isn't acceptable.