Version 3.0, aws_route53_record and aws_acm_certificate validation

With the release of version 3.0 aws_acm_certificate.domain_validation_options was changed from a list to a set, and the documentation was updated to show how to perform validations - having a for_each contain a for loop (https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate#referencing-domain_validation_options-with-for_each-based-resources)

Has this been tested from a clean state file? Because when I try to do what is recommended, I get the error:

The for_each value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the -target argument to first apply only the resources that the for_each depends on.

Is it intended that all uses of aws_acm_certificate.domain_validation_options need to be first run with -target first, is this something that is expected to be fixed in Terraform 0.13, or is this an oversight?

2 Likes

I just ran into the same issue. I found this bug-report reporting the same issue: