Terraform が張る依存と張らない依存

# probe-ref/main.tf
variable "db_name" {
  type    = string
  default = "(default)"
}

resource "terraform_data" "database" {
  input = var.db_name
  # 逆向きの依存を足す。field => database の依存があれば cycle になる
  depends_on = [terraform_data.field]
}

resource "terraform_data" "field" {
  input = terraform_data.database.output # 属性を参照する
}

$ terraform init -backend=false -no-color > /dev/null && terraform validate -no-color

Error: Cycle: terraform_data.field, terraform_data.database

$ terraform init -backend=false -no-color > /dev/null && terraform validate -no-color
Success! The configuration is valid.

# probe-module-var/main.tf
resource "terraform_data" "database" {
  input = "(default)"
  # 逆向きの依存を足す。module の中の field => database の依存があれば cycle になる
  depends_on = [module.child.field_id]
}

# 属性を module の入力変数に渡す
module "child" {
  source  = "./child"
  db_name = terraform_data.database.output
}

# probe-module-var/child/main.tf
variable "db_name" {
  type = string
}

resource "terraform_data" "field" {
  input = var.db_name # module の中では変数として読む
}

output "field_id" {
  value = terraform_data.field.id
}

$ terraform init -backend=false -no-color > /dev/null && terraform validate -no-color

Error: Cycle: module.child.terraform_data.field, module.child.output.field_id (expand), terraform_data.database, module.child.var.db_name (expand)

terraform providers schema -json | jq '.provider_schemas[].resource_schemas["<type>"].block.attributes'

Error creating Field: googleapi: Error 404: Requested database was not found.

resource "google_firestore_field" "expire_at_ttl" {
  database   = google_firestore_database.database.name # 参照にすれば暗黙の依存になる
  collection = "webhooks"
  field      = "expireAt"
  ttl_config {}
  # もしくは depends_on = [google_firestore_database.database]
}

resource "google_project_service" "service" {
  for_each = toset(var.services)
  service  = each.value
}

module "artifact_registry" {
  # source などは省略
  depends_on = [google_project_service.service]
}

# modules/commons/main.tf
variable "psk_value" {
  type = string
}

# API の有効化の代わり
resource "terraform_data" "services" {
  input = "enabled"
}

# psk module の出力を使うリソース
resource "terraform_data" "vpn" {
  input = var.psk_value
}

output "enabled_services" {
  value = terraform_data.services.id
}

# modules/psk/main.tf
resource "terraform_data" "key" {
  input = "secret"
}

output "value" {
  value = terraform_data.key.id
}

# whole/main.tf
module "commons" {
  source    = "../modules/commons"
  psk_value = module.psk.value
}

module "psk" {
  source = "../modules/psk"
  # module 全体を待つ
  depends_on = [module.commons]
}

$ terraform init -backend=false -no-color > /dev/null && terraform validate -no-color

Error: Cycle: module.psk.terraform_data.key, module.commons.var.psk_value (expand), module.commons.terraform_data.vpn, module.commons (close), module.psk (expand), module.psk.output.value (expand)

# output/main.tf
module "commons" {
  source    = "../modules/commons"
  psk_value = module.psk.value
}

module "psk" {
  source = "../modules/psk"
  # API の有効化を返す output だけを待つ
  depends_on = [module.commons.enabled_services]
}

$ terraform init -backend=false -no-color > /dev/null && terraform validate -no-color
Success! The configuration is valid.

# main.tf
resource "terraform_data" "service" {
  input = "api enabled"
}

module "child" {
  source     = "./child"
  depends_on = [terraform_data.service]
}

# child/main.tf
terraform {
  required_providers {
    google-beta = {
      source = "hashicorp/google-beta"
    }
  }
}

# module の中に、設定を持つ provider ブロックを書く
provider "google-beta" {
  project = "example-project"
}

resource "terraform_data" "app" {
  input = "app"
}

$ terraform init -backend=false -no-color
Initializing modules...

Error: Module is incompatible with count, for_each, and depends_on

  on main.tf line 7, in module "child":
   7:   depends_on = [terraform_data.service]

The module at module.child is a legacy module which contains its own local
provider configurations, and so calls to it may not use the count, for_each,
or depends_on arguments.

If you also control the module "./child", consider updating this module to
instead expect provider configurations to be passed by its caller.

# fixed/main.tf
terraform {
  required_providers {
    google-beta = {
      source = "hashicorp/google-beta"
    }
  }
}

# provider の設定は root に置く
provider "google-beta" {
  project = "example-project"
}

resource "terraform_data" "service" {
  input = "api enabled"
}

module "child" {
  source     = "./child"
  depends_on = [terraform_data.service]
}

# fixed/child/main.tf
terraform {
  required_providers {
    google-beta = {
      source = "hashicorp/google-beta"
    }
  }
}

# provider ブロックは書かない。root の google-beta が暗黙に渡る

resource "terraform_data" "app" {
  input = "app"
}

$ terraform init -backend=false -no-color
Initializing modules...
- child in child

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to Terraform
- Finding latest version of hashicorp/google-beta...
...

# NG: data "google_firebase_web_app" から読んだ app_id を渡す
# OK: 変数から直接渡す
resource "google_firebase_app_check_recaptcha_enterprise_config" "default" {
  for_each = var.app_check_web_apps
  app_id   = each.value.app_id
  # ...
}