`terraform plan -generate-config-out` fails for schemas where computed attributes are nested in `SingleNestedAttribute` objects: Computed attributes are being flagged as required on plan

[patrickcping]

Terraform Version

Terraform v1.9.2
on darwin_amd64

Terraform Configuration Files

terraform {
  required_version = ">=1.1"
  required_providers {
    example = {
      version = "~> 0.0.1"
      source  = "example/example"
    }
  }
}

provider "example" {
}

import {
  to = example_example.generated
  id = "id"
}

Debug Output

https://gist.github.com/patrickcping/57c1a06a641afe133f7cbff1d2199c6c

Expected Behavior

terraform plan -out infra.tfout -generate-config-out=generated.tf should create the generated.tf file, and the plan should complete successfully.

Actual Behavior

terraform plan -out infra.tfout -generate-config-out=generated.tf create the generated.tf file with the expected HCL, but the following error is shown. Both string_val_dynamic and string_val_static are Computed: true, Optional: false in the schema, and so not expected to be marked as "required" as the error describes:

example_example.generated: Preparing import... [id=id]
example_example.generated: Refreshing state... [id=id]

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Warning: Config generation is experimental
│ 
│ Generating configuration during import is currently experimental, and
│ the generated configuration format may change in future versions.
╵
╷
│ Error: attribute "single_nested_val": attributes "string_val_dynamic" and "string_val_static" are required
│ 
│ 
╵

HCL generated:

# __generated__ by Terraform
# Please review these resources and move them into your main configuration files.

# __generated__ by Terraform
resource "example_example" "generated" {
  single_nested_val = {
    string_val = "required string"
  }
  string_val = null
}

A subsequent terraform plan -out infra.tfout, with no -generate-config-out CLI param but with the generated HCL (unmodified), works as expected:

example_example.generated: Preparing import... [id=id]
example_example.generated: Refreshing state... [id=id]

Terraform will perform the following actions:

  # example_example.generated will be imported
    resource "example_example" "generated" {
        id                = "id"
        single_nested_val = {
            string_val         = "required string"
            string_val_dynamic = "service dynamic string"
            string_val_static  = "service static string"
        }
    }

Plan: 1 to import, 0 to add, 0 to change, 0 to destroy.

───────────────────────────────────────────────────────────────────────

Saved the plan to: infra.tfout

To perform exactly these actions, run the following command to apply:
    terraform apply "infra.tfout"

Steps to Reproduce

The following resource code will reproduce the error: https://github.com/patrickcping/terraform-provider-example/blob/hcl-generate-error-202407/internal/resource/config/example_resource.go

Note the branch on the code project is hcl-generate-error-202407

The single_nested_val of type SingleNestedAttribute has one required field (no issues here) and two computed fields string_val_static and string_val_dynamic, which the error says are required.

The project builds locally with make install.

With the HCL as shown above:

1. terraform plan -out infra.tfout -generate-config-out=generated.tf
2. Observe generated.tf is created, CLI responds with an error
3. terraform plan -out infra.tfout
4. Observe successful plan

Additional Context

No response

References

No response

[liamcervante]

Hi @patrickcping, thanks for filing this. I'm able to replicate this so I've marked it as confirmed.

Just to highlight that the error is cosmetic, in that it still generates the configuration but generates an incorrect error message while validating the generated config. The produced configuration is correct so it is strange that we would see an error.

[liamcervante]

So, the underlying problem here is our filter function over the resource schema. We filter out certain attributes (like, computed attributes) from the schema when generating configuration. This is so we don't write out values that shouldn't be in the configuration into the configuration.

It seems like this filter function is actually editing the underlying schema instead of simply producing a new one: https://github.com/hashicorp/terraform/blob/main/internal/configs/configschema/filter.go#L59

This means that the error we see here is a result of the two values being dropped from the schema, and then the imported value and the value prepped for the configuration disagree and the schema is missing the information that would normally be used to reconcile the disagreement, and so we get the somewhat confusing error.

It's a fairly straight-forward fix to just stop editing the underlying schema when filtering.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.