## Terraform Version ```text Terraform v1.15.8 on linux_amd64 ``` The same behavior was also reproduced with Terraform v1.13.0. ## Terraform Configuration A complete reproducer is available at: https://github.com/public-cloud-wl/terraform-provider-troubleshooting/tree/main/examples/optional-ephemeral-terraform-test The `public-cloud-wl/troubleshooting` provider is a real published provider, but it is entirely local: it requires no credentials and does not call a remote API. Its `troubleshooting_value` resource deliberately exposes both a normal persisted argument (`value`) and real write-only arguments (`value_wo`, `value_wo_version`). ```hcl terraform { required_version = ">= 1.11" required_providers { troubleshooting = { source = "public-cloud-wl/troubleshooting" version = "0.1.2" } } } variable "legacy_value" { type = string sensitive = true default = "legacy-value" } variable "write_only_value" { type = string sensitive = true default = null nullable = true ephemeral = true } variable "write_only_version" { type = number default = null nullable = true } resource "troubleshooting_value" "this" { value = var.legacy_value value_wo = var.write_only_value value_wo_version = var.write_only_version } ``` ```hcl # main.tftest.hcl run "legacy_apply_without_write_only_input" { command = apply } ``` ## Steps to Reproduce ```shell terraform init -backend=false terraform test ``` ## Actual Result ```text Error: No value for required variable The ephemeral input variable "write_only_value" was not set during the plan phase, and so must remain unset during the apply phase. ``` ## Expected Result The test should succeed. `write_only_value` is optional, has `default = null`, and is unset in both phases. The configuration uses only the legacy `value` argument. ## Scope This is specific to the `terraform test` apply workflow: ```shell terraform apply -auto-approve terraform destroy -auto-approve ``` succeeds with the same configuration. Applying a saved plan also succeeds: ```shell terraform plan -out=legacy.tfplan terraform apply legacy.tfplan ``` Therefore, the issue does not appear in normal apply workflows, but it prevents modules exposing optional ephemeral write-only inputs from retaining `terraform test` coverage for their legacy apply path. ## OpenTofu Comparison OpenTofu v1.11.8 succeeds with the same configuration and the provider downloaded from `registry.terraform.io`: ```text Success! 1 passed, 0 failed. ``` OpenTofu changed the handling of optional ephemeral variables in https://github.com/opentofu/opentofu/pull/3192. In particular, its apply-time validation requires a value only for an ephemeral variable which is actually required (has no default). The corresponding regression test is named `ephemeral with default can have no value in applyOpts`. Terraform currently appears to treat the null default of an optional ephemeral variable as an unexpected apply-time input when `terraform test` applies its internally saved plan.