Loading...
Loading...
### Terraform Version ```shell v1.8.4 ``` ### Terraform Configuration Files ```terraform # data.tf data "null_resource_data" "this" {} # resources.tf resource "null_resource" "this" {} # versions.tf terraform { cloud {} } ``` ### Debug Output https://gist.github.com/theipster/c5640574bc5d6a5cdf605c741c139cbc ### Expected Behavior When only data sources exist (both in the state and the source configuration), removing those data sources from the configuration and running `terraform apply` should remove the data sources from the state. Furthermore, by removing those remaining data sources to result in an empty state, the Terraform Cloud workspace should then become deletable. ### Actual Behavior Removing those data sources from the configuration and running `terraform apply` does nothing to remove the data sources from the state. Furthermore, because the Terraform Cloud workspace is stuck with > 0 remaining "resources" in the state, it is therefore not deletable. ### Steps to Reproduce As per debug output above: 1. `echo -en "data \"null_data_source\" \"this\" {}\n" > data.tf` 2. `echo -en "resource \"null_resource\" \"this\" {}\n" > resources.tf` 3. `echo -en "terraform {\n cloud {}\n}\n" > versions.tf` 4. `terraform init` 5. `terraform apply -auto-approve` 6. `terraform show -json` (State should contain `data.null_data_source.this` and `null_resource.this`.) 7. `rm resources.tf` 8. `terraform apply -auto-approve` 9. `terraform show -json` (State should contain `data.null_data_source.this` only.) 10. `rm data.tf` 11. `terraform apply -auto-approve` 12. `terraform show -json` (State should contain nothing, but in practice...) ### Additional Context I understand that this Terraform Cloud behaviour is trying to be "clever" by saving CPU cycles, but it is arguably inconsistent with how the non-Cloud version of `terraform apply` behaves and violates the principle of least surprise. (To replicate the behaviour with non-Cloud / local execution mode, one can replace `terraform apply -auto-approve` with a combination of `terraform plan -out tfplan` plus `terraform apply tfplan` but obviously skipping the `terraform apply tfplan` when the `tfplan` file contains zero resource changes.) I also understand there are some workarounds available, but they all require additional commands / additional complexity: 1. Configure the Terraform Cloud workspace to `force_destroy = true`, so that the data sources simply get ignored when deleting the workspace. This is of course risky in case there happens to be actual resources remaining. 2. Run `terraform destroy` (or `terraform apply -destroy`). However, for CI/CD pipelines that most commonly need to run `apply` and rarely need to run `destroy`, this would require pipeline authors to write additional logic for switching between `apply` vs `destroy` in the right circumstances. And again, more logic means more risk of accidentally doing the wrong thing, i.e. destroying a workspace full of resources. 3. Run an extra `terraform apply` command that introduces a dummy resource in order to _force_ the state to be updated (and simultaneously removes the data sources from the state), and then run yet another `terraform apply` command to delete that dummy resource from the state, finally resulting in the desired empty state. ### References _No response_
Click on a version to see all relevant bugs
Terraform Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.