Provider for module with resource from same module

[jplitza]

Imagine I have a root module that creates stuff like virtual datacenters and k8s clusters, and inside that I have a module called "environment" that I include using for_each for each environment. Now each environment has its own set of credentials, which I generate inside the environment module. But because providers can only be declared at the global level, I have to use the resources from inside the module - which causes a cyclic dependency.

This hopefully captures everything relevant:

# ./main.tf

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

variable "environments" {
  type = map(any)
}

provider "aws" {
  alias = "environment"
  for_each = var.environments
  access_key = module.environment[each.key].aws_iam_access_key.user.id
  secret_key = module.environment[each.key].aws_iam_access_key.user.secret
}

module "environment" {
  source = "./environment"
  for_each = var.environments
  providers = {
    aws.environment = aws.environment[each.key]
  }
}

# ./environment/main.tf

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
      configuration_aliases = [ aws.environment ]
    }
  }
}

variable "env_name" {
  type = string
}

resource "aws_iam_user" "user" {
  name = "${env_name}"
}

resource "aws_iam_access_key" "user" {
  user = aws_iam_user.user.name
}

resource "aws_s3_bucket" "example" {
  provider = aws.environment
}

However, tofu plan yields:

Error: Cycle: module.environment.aws_s3_bucket.example, module.environment (close), provider["registry.opentofu.org/hashicorp/aws"].environment

What am I missing? It feels like the resources belong inside the module, because otherwise I would have a bunch of resources in the root module that all share the same for_each expression. Is there any way to break the implicit dependency of the aws_iam_user resource on the module it's contained in?

(Note this is a toy example and I'm not even using AWS. So while I'm not against learning cool tricks of the AWS provider and could try requesting them for the providers I use, I'd be more interested solving this on the opentofu side)

[ollevche]

Hello @jplitza! I have a few follow-up questions to understand what you want to achieve better.

The configuration implicitly uses non-aliased default aws provider to fetch aws_iam_user and aws_iam_access_key. Those values should then be used to configure environment-scoped provider, which provides aws_s3_bucket. Is that correct?

[jplitza]

That is correct.

[ollevche]

Current tofu logic implies that a module must be executed (planned/applied) to get its values. However, we need a provider for module execution, which depends on the module's execution results, so it fails. The cycle looks pretty valid to me, especially taking into account the encapsulation logic - module callers must be only allowed to use module outputs and not their resources directly.

I am a bit confused that tofu allows to break that rule when describing provider block. It looks to me as a bug to be honest. If you change the example to use module outputs, the cycle error makes a lot more sense. Imagine, calling a function with input parameters based on its return values.

In my opinion, "default" provider (which is not environment-scoped) shouldn't be a part of the environment module. So I suggest to restructure the configuration to fix the cycle.

[ollevche]

Update: actually, it would still fail due to the module encapsulation error I mentioned previously. This check happens after cycle validation so that's why it came first. We uncovered another small bug with provider validation - it is skipped if the provider is unused: #2537