Explicit Providers in Modules

Terraform
1

What is the recommended method to delete the resources created by a module with external providers? Is “terraform destroy -target=xxx” the only option?

module windows_vm_xxx {
source = ../virtual_machines/windows
...
...
  providers = {
    azurerm.terraform_keyvault = azurerm.terraform_keyvault
  }
}

Removing the above module code block from the .tf file and running terraform apply throws the below error:

Error: Provider configuration not present

To work with
module.windows_vm_xxx.data.azurerm_key_vault_secret.domain_username
its original provider configuration at
module.windows_vm_xxx.provider.azurerm.terraform_keyvault is required, but it has been removed. This occurs when a provider configuration is removed while objects created by that provider still exist in the state.
Re-add the provider configuration to destroy
module.windows_vm_xxx.data.azurerm_key_vault_secret.domain_username,
after which you can remove the provider configuration again.

2

@apparentlymart - can you take a look at this issue and advice?

3

Hi @dj-singh,

Mentioning me here doesn’t really achieve anything since I don’t have any mention notifications turned on for this forum. With that said, I did happen to see this topic as part of normal browsing, so let’s see…

Something odd seems to have happened in this case, because the error message you shared mentions module.windows_vm_xxx.provider.azurerm.terraform_keyvault, but your configuration suggests it should instead be associated with provider.azurerm.terraform_keyvault (the provider configuration in the root module).

Did you originally create this object with a provider configuration in the nested module, and only recently switch to explicit configuration passing?

Also, do you have a proxy configuration block for your aliased provider configuration in your child module? It would be a provider "azurerm" block with only an alias argument, like this:

provider "azurerm" {
  alias = "terraform_keyvault"
}

A block like this serves as a declaration to Terraform that your module expects to receive a provider configuration from the parent, rather than declaring one of its own.

1 Like
4

Hi @apparentlymart - Thanks for your quick response.

You are 100% correct in that the ‘alias’ provider configuration was in the child module originally and it’s only yesterday that I updated it to a proxy config block and added the explicit provider in the root module.

The issue got resolved after I made the above change. I am able to comment/remove the module block and successfully run terraform apply to destroy the resources.

Cheers! :+1: