Invalid count argument

[alemairebe]

Hi all,

I'm using Terraform v0.12.1 and I get this error when trying to plan my manifest. I do no see where "count" uses resources which needs to be deployed first.

Error: Invalid count argument

  on .terraform/modules/bootstrap.acm/terraform-aws-modules-terraform-aws-acm-566067c/main.tf line 30, in resource "aws_route53_record" "validation":
  30:   count = var.create_certificate && var.validation_method == "DNS" && var.validate_certificate ? length(local.distinct_domain_names) : 0

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

Here is how I invoke the module

module "acm" {
  source  = "terraform-aws-modules/acm/aws"
  version = "v2.0.0"

  create_certificate = var.certificate_arn == "" ? true : false

  domain_name = var.acm_certificate_domain_name == "" ? join(".", list(var.name, var.route53_zone_name)) : var.acm_certificate_domain_name

  zone_id = var.certificate_arn == "" ? element(concat(data.aws_route53_zone.this.*.id, list("")), 0) : ""

  tags = "${local.tags}"
}

Thanks !

[antonbabenko]

This code does not contain references to resources, but only to data-sources and static vars, so it is strange that you get this error.

From this, it looks that domain_name argument is empty. Please verify values of var.acm_certificate_domain_name, var.name and var.route53_zone_name.

[alemairebe]

When I ran this code, the values were :

var.acm_certificate_domain_name=""
var.name="atlantis"
var.route53_zone_name="test.mydomain.info"

which should result in atlantis.test.mydomain.info for debug purpose , I changed my code to

module "acm" {
  source  = "terraform-aws-modules/acm/aws"
  version = "v2.0.0"

  create_certificate = var.certificate_arn == "" ? true : false

  domain_name = "atlantis.test.mydomain.info"

  zone_id = var.certificate_arn == "" ? element(concat(data.aws_route53_zone.this.*.id, list("")), 0) : ""

  tags = "${local.tags}"
}

and I still get the same message

Then I clear my .terraform folder and did a terraform init && terraform plan
seems to work now !
Maybe an update in a provider...

Thanks for looking at it 👍

[nunofernandes]

I also got the same issue. I'm in the process of upgrading to terraform 0.12 and hit this.

Terraform v0.12.2
+ provider.aws v2.16.0
+ provider.template v2.1.2

Code:

module "site-co-uk" {
  source  = "terraform-aws-modules/acm/aws"
  version = "~> 2.1"

  domain_name = "*.site.co.uk"
  zone_id     = aws_route53_zone.site-co-uk-public.zone_id

  tags = {
    Name       = "wildcard-site.co.uk"
    Terraform  = "true"
    CostCenter = "site"
  }
}

and get the same error:

terraform.0.12 plan  --target=module.site-co-uk
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

aws_route53_zone.site-co-uk-public: Refreshing state... [id=XXXXXXX]
module.site-co-uk.aws_acm_certificate.this[0]: Refreshing state... [id=arn:aws:acm:eu-west-1:12345678:certificate/XXXXXXX]

Error: Invalid count argument

  on .terraform/modules/site-co-uk/terraform-aws-modules-terraform-aws-acm-5b77784/main.tf line 30, in resource "aws_route53_record" "validation":
  30:   count = var.create_certificate && var.validation_method == "DNS" && var.validate_certificate ? length(local.distinct_domain_names) : 0

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

Releasing state lock. This may take a few moments...

Cleaning up the .terraform directory and doing a terraform init didn't help.

[antonbabenko]

Try this code:

module "site-co-uk" {
  source  = "terraform-aws-modules/acm/aws"
  version = "~> 2.1"

  domain_name = "site.co.uk"
  zone_id     = aws_route53_zone.site-co-uk-public.zone_id

  subject_alternative_names = ["*.site.co.uk"]

  tags = {
    Name       = "wildcard-site.co.uk"
    Terraform  = "true"
    CostCenter = "site"
  }
}

[nunofernandes]

@antonbabenko thanks. I tried that before but it would force the recreation of the cert:

-/+ destroy and then create replacement
+/- create replacement and then destroy

Terraform will perform the following actions:

  # module.site-co-uk.aws_acm_certificate.this[0] must be replaced
+/- resource "aws_acm_certificate" "this" {
      ~ arn                       = "arn:aws:acm:eu-west-1:12345:certificate/XXXX" -> (known after apply)
      ~ domain_name               = "*.site.co.uk" -> "site.co.uk" # forces replacement
      ~ domain_validation_options = [
          - {
              - domain_name           = "*.site.co.uk"
              - resource_record_name  = "_4dcf16a519cd998d6ce83de46d6288fd.site.co.uk."
              - resource_record_type  = "CNAME"
              - resource_record_value = "_7eaf393c237a0f6745b8946051447306.ltfvzjuylp.acm-validations.aws."
            },
        ] -> (known after apply)
      ~ id                        = "arn:aws:acm:eu-west-1:12345:certificate/XXXXXX" -> (known after apply)
      ~ subject_alternative_names = [ # forces replacement
          + "*.site.co.uk",
        ]
        tags                      = {
            "CostCenter" = "site"
            "Name"       = "wildcard-site.co.uk"
            "Terraform"  = "true"
        }
      ~ validation_emails         = [] -> (known after apply)
        validation_method         = "DNS"
    }

  # module.site-co-uk.aws_acm_certificate_validation.this[0] must be replaced
-/+ resource "aws_acm_certificate_validation" "this" {
      ~ certificate_arn         = "arn:aws:acm:eu-west-1:538364834955:certificate/63ed942d-6bcd-46b4-a114-81f72025c301" -> (known after apply) # forces replacement
      ~ id                      = "2019-05-30 11:02:32 +0000 UTC" -> (known after apply)
      ~ validation_record_fqdns = [
          - "_4dcf16a519cd998d6ce83de46d6288fd.site.co.uk",
        ] -> (known after apply) # forces replacement

      - timeouts {}
    }

  # module.site-co-uk.aws_route53_record.validation[0] must be replaced
-/+ resource "aws_route53_record" "validation" {
        allow_overwrite = true
      ~ fqdn            = "_4dcf16a519cd998d6ce83de46d6288fd.site.co.uk" -> (known after apply)
      ~ id              = "Z1Y0Y8ITAJ6H01__4dcf16a519cd998d6ce83de46d6288fd.site.co.uk_CNAME" -> (known after apply)
      ~ name            = "_4dcf16a519cd998d6ce83de46d6288fd.site.co.uk" -> (known after apply) # forces replacement
      ~ records         = [
          - "_7eaf393c237a0f6745b8946051447306.ltfvzjuylp.acm-validations.aws.",
        ] -> (known after apply)
        ttl             = 60
      ~ type            = "CNAME" -> (known after apply)
        zone_id         = "Z123456"
    }

Plan: 3 to add, 0 to change, 3 to destroy.

Is that the only way? To recreate it?

[antonbabenko]

Yes, this is the easiest way. You can optionally try to taint aws_acm_certificate, but I have not tried it.

[waeltken]

Could we reopen this? I'm running into the same issue.

It happens when subject_alternative_names contains the empty array, which is also the default.

[mbravorus]

Same issue here, occurring while invoking the module from Atlantis ecs module (same author), with no existing ACM cert specified so one is expected to be created

[antonbabenko]

@waeltken @mbravorus Please provide an exact snippet of the code you are using. It is pretty much impossible for me to guess where the problem is without trying to run it myself and see the problem.

I run examples (see https://github.com/terraform-aws-modules/terraform-aws-acm/blob/master/examples/complete-dns-validation/main.tf) as they are now and with an empty subject_alternative_names and it always works.

The problems can be when a wildcard is specified in domain_name instead of subject_alternative_names.

[antonbabenko]

I've made a small improvement when trying to access non-existing element, which may be related to the initial issue.

Released v2.2.0.