Incorrect "Provider produced inconsistent final plan" error when changing count or for_each of resources with create_before_destroy

[jbardin]

When referencing multiple instances of a resource with create_before_destroy, reducing the number of instances will not be correctly updated on the first apply.

For example:

locals {
  things = {
    first = "one"
    second = "two"
  }
}

resource "null_resource" "a" {
  for_each = local.things
  lifecycle {
    create_before_destroy = true
  }
}

resource "null_resource" "b" {
  triggers = {for i, a in null_resource.a: i => a.id}
}

This will create 2 null_resource.a instances, and record their keys and ids in the single null_resource.b instance.

Now if the "second" map value is removed, the resulting plan will look like

  # null_resource.a["second"] will be destroyed
  - resource "null_resource" "a" {
      - id = "5837642811259646161" -> null
    }

  # null_resource.b must be replaced
-/+ resource "null_resource" "b" {
      ~ id       = "13446854340418721" -> (known after apply)
      ~ triggers = { # forces replacement
            "first"  = "2410135502881497988"
          - "second" = "5837642811259646161" -> null
        }
    }

This however will fail during apply with:

Error: Provider produced inconsistent final plan

When expanding the plan for null_resource.b to include new values learned so
far during apply, provider "registry.terraform.io/hashicorp/null" produced an
invalid new value for .triggers: new element "second" has appeared.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

This is because the evaluation for the resource.a during apply will also contain nodes that are scheduled for destruction, which does not happen during the plan phase. This was fixed for 0.13, but needed to be reverted when it was discovered that provider and destroy provisioner evaluation was not equipped to handle this, and we must continue to include the deposed instances in the resource evaluation.

[Nuru]

Is there a workaround for this?

[jbardin]

For now you should be able to target the resource that needs to be removed first, then complete the rest of the apply afterwards. In this case it would be terraform apply -target 'null_resource.a["second"]' to remove that instance, then the other resources can be updated correctly.