# Dynamic block deletion

**URL:** <https://discuss.hashicorp.com/t/dynamic-block-deletion/75582>\
**Category:** Terraform\
**Created:** [June 26, 2025, 3:01pm UTC](https://discuss.hashicorp.com/t/dynamic-block-deletion/75582 "2025-06-26T15:01:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gcmlabs](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/gcmlabs/32/45968_2.png) [@gcmlabs](https://discuss.hashicorp.com/u/gcmlabs)\
**Post date:** [June 26, 2025, 3:01pm UTC](https://discuss.hashicorp.com/t/dynamic-block-deletion/75582/1 "2025-06-26T15:01:53Z")

</div>

Hello!

I’m trying to conditionally create/delete a configuration block (AWS Secrets replication)

My code is as follows:

```auto
resource "aws_secretsmanager_secret" "postgresql" {
  name = "${var.rds_name}-secrets"
  kms_key_id = var.kms_outputs.sm_key_arn
  dynamic "replica" {
    for_each = var.aws_disaster_region != "" ? ["enable"] : []
    
    content {
      region = var.aws_disaster_region
      kms_key_id = "arn:aws:kms:${var.aws_disaster_region}:${data.aws_caller_identity.current.account_id}:key/${var.kms_outputs.sm_key_id}"
    }
  }
  tags = {
    Name = "${var.rds_name}-secrets"
  }
}

```

The issue I’m encountering is: if I create the resource with `var.aws_disaster_region = ""`, the replica configuration isn’t created. If I then add a region code to the variable, the resource is updated with the replica configuration. However, when I change the variable back to an empty string, the replica configuration block isn’t removed, and terraform shows no changes.

Any suggestions on how to fix this?

Thanks

---

<div class="post-metadata">

**Author:** ![jbardin](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jbardin/32/3325_2.png) [@jbardin](https://discuss.hashicorp.com/u/jbardin)\
**Post date:** [June 27, 2025, 2:27pm UTC](https://discuss.hashicorp.com/t/dynamic-block-deletion/75582/2 "2025-06-27T14:27:08Z")

</div>

Hi @gcmlabs,

This looks like a provider issue, and indeed there is one already opened here: [secretsmanager\_secret - Cannot be able to delete a replica · Issue #23316 · hashicorp/terraform-provider-aws · GitHub](https://github.com/hashicorp/terraform-provider-aws/issues/23316)

The provider is using the legacy SDK still for that resource, which cannot detect when the values have been removed from the configuration entirely.

---

<div class="post-metadata">

**Author:** ![gcmlabs](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/gcmlabs/32/45968_2.png) [@gcmlabs](https://discuss.hashicorp.com/u/gcmlabs)\
**Post date:** [June 27, 2025, 2:41pm UTC](https://discuss.hashicorp.com/t/dynamic-block-deletion/75582/3 "2025-06-27T14:41:14Z")

</div>

Thanks @jbardin! I will wait for the PR to be merged

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/hashicorp/original/1X/79bf76adfd92a75631996933098f9ce29d37abf3.svg) [@system](https://discuss.hashicorp.com/u/system)\
**Post date:** [July 27, 2025, 2:41pm UTC](https://discuss.hashicorp.com/t/dynamic-block-deletion/75582/4 "2025-07-27T14:41:18Z")

</div>

Closed on July 27, 2025, 2:41pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.