Not nullable module input variable validates null before default value

[MusicDin]

Terraform Version

1.1.2

Terraform Configuration Files

Module:

# main.tf
module "demo" {
  source = "./modules/demo"
  action = null
}

# module/demo/variables.tf
variable "action" {
  type        = string
  description = "Action (create, upgrade)"
  default     = "create"
  nullable    = false

  validation {
    condition     = contains(["create", "upgrade"], var.action)
    error_message = "Variable 'action' is invalid. Possible values are: ['create', 'upgrade']."
  }
}

Debug Output

Expected Behavior

Before validating variable value, the default value should be set as it's value, because the variable is tagged as nullable = false.

In the docs it's written that:
Setting nullable to false ensures that the variable value will never be null within the module. If nullable is false and the variable has a default value, then Terraform uses the default when a module input argument is null.

Actual Behavior

In cases where input variable has nullable argument set to false and the value passed to the variable is null, the validated value is null instead of the default value.

Steps to Reproduce

1. terraform init
2. terraform plan/apply

Additional context

I know there are workarounds for this problem, but shouldn't the default value be inserted into validation condition, because the default value will be used further in the module and not the null?

[jbardin]

Hi @MusicDin,

Thanks for filing the issue. This does appear to be unintended behavior related to the new nullable option in combination with the validation rules.

What appears to be happening is that the validation rules (or really the language in general) never had the possibility of ensuring a non-nullable value before, so any condition must have been able to handle a null value. Now that a variable has a way to ensure the value is never null, we also need to pass that constraint into the validation logic.

Thanks!

[jbardin]

Closed via #30330 and #29959

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.