Terraform v1.10.0 breaks apply --auto-approve when using list/dict variables

[pvieito]

Terraform Version

$ terraform apply -auto-approve
aws_s3_bucket.sf_admin_swamp[0]: Refreshing state... [id=swamp-sf-admin-test]
aws_s3_bucket.model: Refreshing state... [id=shopfully-data-model-lab]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.
╷
│ Error: Can't change variable when applying a saved plan
│ 
│ The variable provider_aws_default_tags__default cannot be set using the
│ -var and -var-file options when applying a saved plan file, because a saved
│ plan includes the variable values that were set when it was created. The
│ saved plan specifies "{\"Environment\": \"LAB\", \"ProjectName\":
│ \"DataModel\", \"DeploymentName\": \"DataModel-Infrastructure-Model\",
│ \"CostCenter\": \"Engineering\", \"BusinessLine\": \"DataModel\", \"Role\":
│ \"DataModel\", \"ProductLine\": \"DataModel-Infrastructure-Model\",
│ \"Product\": \"DataModel-Infrastructure-Model\", \"Module\":
│ \"DataModel-Infrastructure-Model\", \"Stack\":
│ \"DataModel-Infrastructure-Model\", \"InfrastructureToolName\":
│ \"infrastructure\", \"InfrastructureGroup\": \"Model\",
│ \"InfrastructureDeploymentService\": \"terraform\"}" as the value whereas
│ during apply the value object with 13 attributes was set by an environment
│ variable. To declare an ephemeral variable which is not saved in the plan
│ file, use ephemeral = true.
╵

Terraform Configuration Files

Debug Output

Expected Behavior

This should not fail.

Actual Behavior

Fails even though we are not using a saved plan!

Steps to Reproduce

1. Use terraform list/dict variables
2. Set them with env-vars
3. terraform apply --auto-approve
4. Fails

Additional Context

No response

References

No response

[branchgrove]

Encountered this as well today making a lot of our pipelines bleed, had to resolve it by pinning the version to 1.9.8. It seems that the related pull request is this one: #35903.

[jonathandbyrd]

Also encountered. When i pinned the required_version to 1.9.8 it told me i couldn't do that as it did not conform to 1.10.0.

Edit: the inline suggestion is to use ephemeral = true for the variable in the variables.tf you're setting in main.tf, but that breaks, expectedly, because the for_each doesn't like using ephemerals

[DT-BMA]

Happening to me too. Very weird behavior as I was migrating variables from "Per-Step" defines to "Per-Job" defines.
This change/version only breaks using List variables, and even Terraform Plan doesn't notice (or lie about there being) issues.

The variable (AZURE RBAC ADMIN LIST VAR) cannot be set using the -var and -var-file

Terraform will perform the following actions:
options when applying a saved plan file, because a saved plan includes the
variable values that were set when it was created. The saved plan specifies
azurerm_kubernetes_cluster.- will be created
resource "azurerm_kubernetes_cluster" "-"
"["",""]"

with Apply:
run: terraform apply -auto-approve -input=false

Worked fine last week, and if you do what it suggests, you get...

Error: Invalid use of ephemeral value
with azurerm_kubernetes_cluster.-,
on aks-cluster.tf, in resource "azurerm_kubernetes_cluster" "-":
admin_group_object_ids = (ADMIN GROUPS LIST VAR)

Ephemeral values are not valid in resource arguments, because resource
instances must persist between Terraform phases.

[alxwest]

Also encountered. When i pinned the required_version to 1.9.8 it told me i couldn't do that as it did not conform to 1.10.0.

Edit: the inline suggestion is to use ephemeral = true for the variable in the variables.tf you're setting in main.tf, but that breaks, expectedly, because the for_each doesn't like using ephemerals

I found this, if you're using a Github action calling hashicorp/setup-terraform@v3. To pin the version, configure it in the action's yaml.

steps:
- uses: hashicorp/setup-terraform@v3
  with:
    terraform_version: "1.9.8"

[lotusnoir]

hello, happening to me too, looks like a bug as with a variable set

 variable "toto" {
   type        = list(string)                                                                                                                                                                                               
 }

with no use in the code the error is also marked on the apply...
Dont focus on the ephemeral = true, its not related with the main issue i think

[nahimakh]

I am hitting the same issue...error I am getting is

Error: Can't change variable when applying a saved plan
│
│ The variable sftp_container_retention_policies cannot be set using the -var
│ and -var-file options when applying a saved plan file, because a saved plan
│ includes the variable values that were set when it was created. The saved
│ plan specifies "[ { rule_name = "ArchiveFolder", path = "archive",
│ retention_days = 30 } ]" as the value whereas during apply the value tuple
│ with 1 element was set by an environment variable. To declare an ephemeral
│ variable which is not saved in the plan file, use ephemeral = true.

I ran the same pipeline few days ago and was perfectly fine and there have been no changes since.

I tried pinning required_version to 1.9.8 and get the error

Error: Unsupported Terraform Core version

This configuration does not support Terraform version 1.10.0. To proceed,
│ either choose another supported Terraform version or update this version
│ constraint. Version constraints are normally set for good reason, so
│ updating the constraint may lead to other errors or unexpected behavior.

Is there any other workaround for this?

[tkaya-ipsi]

I am hitting the same issue...error I am getting is

Error: Can't change variable when applying a saved plan │ │ The variable sftp_container_retention_policies cannot be set using the -var │ and -var-file options when applying a saved plan file, because a saved plan │ includes the variable values that were set when it was created. The saved │ plan specifies "[ { rule_name = "ArchiveFolder", path = "archive", │ retention_days = 30 } ]" as the value whereas during apply the value tuple │ with 1 element was set by an environment variable. To declare an ephemeral │ variable which is not saved in the plan file, use ephemeral = true.

I ran the same pipeline few days ago and was perfectly fine and there have been no changes since.

I tried pinning required_version to 1.9.8 and get the error

Error: Unsupported Terraform Core version

This configuration does not support Terraform version 1.10.0. To proceed, │ either choose another supported Terraform version or update this version │ constraint. Version constraints are normally set for good reason, so │ updating the constraint may lead to other errors or unexpected behavior.

Is there any other workaround for this?

Are you sure you pinned the version to 1.9.8 correctly? This error seems a bit off

This configuration does not support Terraform version 1.10.0.
Maybe check again or show us how you pinned the version?

[p24-max]

Same here, 1.10.0 fails with same mentioned error during auto-approved apply:

terragrunt run-all apply -auto-approve --terragrunt-non-interactive --terragrunt-working-dir env/staging_test

Pinning terraform version to 1.9.8 works well.

[nahimakh]

I am hitting the same issue...error I am getting is

Error: Can't change variable when applying a saved plan │ │ The variable sftp_container_retention_policies cannot be set using the -var │ and -var-file options when applying a saved plan file, because a saved plan │ includes the variable values that were set when it was created. The saved │ plan specifies "[ { rule_name = "ArchiveFolder", path = "archive", │ retention_days = 30 } ]" as the value whereas during apply the value tuple │ with 1 element was set by an environment variable. To declare an ephemeral │ variable which is not saved in the plan file, use ephemeral = true.

I ran the same pipeline few days ago and was perfectly fine and there have been no changes since.

I tried pinning required_version to 1.9.8 and get the error

Error: Unsupported Terraform Core version

This configuration does not support Terraform version 1.10.0. To proceed, │ either choose another supported Terraform version or update this version │ constraint. Version constraints are normally set for good reason, so │ updating the constraint may lead to other errors or unexpected behavior.

Is there any other workaround for this?

Thanks for the reply...

This is how I am pinning it

terraform {
required_version = "= 1.9.8"
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "> 3.19"
}
random = {
source = "hashicorp/random"
version = "> 3.3"
}
time = {
source = "hashicorp/time"
version = ">= 0.8"
}
}
backend "azurerm" {}
}

[saez0pub]

I you encounter this, like me, this issue has been closed without a proper solution. It is a regression, downgrading the version is not a fix 🤷.
Waiting for terraform to release the fix of this regression, I've aligned the apply vars and the plan vars to make terraform apply successfully.
It was not necessary until v1.10.0.
Is #36121 fixing it ?

[crw]

Yes, that is what it means when an issue is closed by a PR. The next version (v1.10.1) should have the fix from #36121. Thanks!

[aamitparmar]

I've identified a fix for the issue. To resolve the issue, add the sensitive = true attribute to the affected variable.
This ensures the variable is treated correctly during plan and apply phases without requiring version pinning.

 variable "foo" {
   type        = string
   sensitive = true                                                                                                                                                                                               
 }

[crw]

Hi @aamitparmar, thanks. Although this may be an acceptable work-around (we have not tested it), the better option would be to upgrade to Terraform 1.10.1. Thanks!

[FeiWangTyro]

hi @crw we are using the terraform-latest, still got the issue, Error: Can't change variable when applying a saved plan, the latest terraform is version v1.10.1

[crw]

Hi @FeiWangTyro, can you please open a new issue, following the new issue template, so we have the information necessary to triage and debug your report? Thanks very much!

[FeiWangTyro]

hi @crw #36183

[kcadorin]

Same here, 1.10.0 fails with same mentioned error during auto-approved apply:

terragrunt run-all apply -auto-approve --terragrunt-non-interactive --terragrunt-working-dir env/staging_test

Pinning terraform version to 1.9.8 works well.

How did you pin terraform version using terragrunt @p24-max ? Having the same issue running terragrunt run-all apply --terragrunt-non-interactive -auto-approve

I was using teragrunt version 0.48.4 when that started to happen. Using this action:

- name: Setup Terragrunt
        uses: autero1/[email protected]
        with:
          terragrunt-version: 0.48.4

Error: Can't change variable when applying a saved plan
18:26:13.581 STDERR terraform: │ 
18:26:13.581 STDERR terraform: │ The variable single_records cannot be set using the -var and -var-file
18:26:13.581 STDERR terraform: │ options when applying a saved plan file, because a saved plan includes the
18:26:13.581 STDERR terraform: │ variable values that were set when it was created. The saved plan specifies