Bug Report Terraform module validation error with null ephe osquery #fleet

Bug Report: Terraform module validation error with...

Ed Merrett

03/12/2026, 12:20 PM

Bug Report: Terraform module validation error with null ephemeral_storage Hi team, we're encountering an error when using

fleet-terraform

module version `tf-mod-root-v1.23.0`:

Copy code

Error: Attempt to get attribute from null value

    on .terraform/modules/fleet/byo-vpc/byo-db/byo-ecs/variables.tf line 260, in variable "fleet_config":
   260:     condition     = var.fleet_config.ephemeral_storage == null || (var.fleet_config.ephemeral_storage.size_in_gib >= 21 && var.fleet_config.ephemeral_storage.size_in_gib <= 200)
      │ var.fleet_config.ephemeral_storage is null

Cause: Terraform doesn't short-circuit

||

expressions, so when

ephemeral_storage

is null (the default), it still tries to access

.size_in_gib

on the null value. Suggested fix: Change line 260 from:

Copy code

condition = var.fleet_config.ephemeral_storage == null || (var.fleet_config.ephemeral_storage.size_in_gib >= 21 && var.fleet_config.ephemeral_storage.size_in_gib <= 200)

To:

Copy code

condition = var.fleet_config.ephemeral_storage == null ? true : (var.fleet_config.ephemeral_storage.size_in_gib >= 21 && var.fleet_config.ephemeral_storage.size_in_gib <= 200)

We're working around this by explicitly setting

ephemeral_storage

in our config, but this should be fixed in the module so the default null value works correctly.

👀 1

Gray Williams

03/12/2026, 12:25 PM

Hey @Ed Merrett, thanks for the detailed report. We'll look into this and I'll update you on any progress!

🙌 1

ty 1

Gray Williams

03/12/2026, 1:32 PM

Hey @Ed Merrett, out of interest, could you confirm the version of terraform you're using, please? Changes will be coming as part of https://github.com/fleetdm/fleet-terraform/pull/193

Ed Merrett

03/12/2026, 1:44 PM

Terraform v1.8.5

and we had pinned the provider:

Copy code

required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "6.19.0"
    }

Ed Merrett

03/12/2026, 1:48 PM

I had to update that to bring in your downstream providers to:

Copy code

required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">=6.19.0, <7.0.0"
    }

Gray Williams

03/12/2026, 2:00 PM

Amazing, thank you. It would appear that the changes made it in and the tests validated with 1.12.0. We'll also look into the pinned provider versions.

Ed Merrett

03/19/2026, 9:27 AM

Briefly following up to see if this was included in: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.82.1 I see the PR is still open, so assume not?

Gray Williams

03/19/2026, 9:41 AM

Hi @Ed Merrett, it looks like some issues were found during review, and they're fixing them. So, unfortunately, this would not have been included.

ty 1

osquery spin 1

Gray Williams

03/20/2026, 10:25 AM

Morning @Ed Merrett, just a quick update to let you know that the PR has been approved but not merged yet. So progress has been made!

Ed Merrett

03/20/2026, 10:30 AM

Huge news, thank you! @Gray Williams

Gray Williams

03/21/2026, 10:19 AM

Hey @Ed Merrett, it's now been merged into main: https://github.com/fleetdm/fleet-terraform/releases/tag/tf-mod-root-v1.24.0 Thank you again for reporting and your patience 🙂

Ed Merrett

03/21/2026, 8:43 PM

Half good news! Looks like some optional

rds_config

params are not accepting null, when the docs suggest they can:

Ed Merrett

03/21/2026, 8:43 PM

Copy code

│ Error: Operation failed
│ 
│   on .terraform/modules/fleet/variables.tf line 262, in variable "rds_config":
│  262:     condition     = var.rds_config.backtrack_window == null || (var.rds_config.backtrack_window >= 0 && var.rds_config.backtrack_window <= 259200)
│     ├────────────────
│     │ var.rds_config.backtrack_window is null
│ 
│ Error during operation: argument must not be null.
╵
╷
│ Error: Operation failed
│ 
│   on .terraform/modules/fleet/variables.tf line 262, in variable "rds_config":
│  262:     condition     = var.rds_config.backtrack_window == null || (var.rds_config.backtrack_window >= 0 && var.rds_config.backtrack_window <= 259200)
│     ├────────────────
│     │ var.rds_config.backtrack_window is null
│ 
│ Error during operation: argument must not be null.
╵
╷
│ Error: Invalid function argument
│ 
│   on .terraform/modules/fleet/variables.tf line 266, in variable "rds_config":
│  266:     condition     = var.rds_config.observability.database_insights_mode == null || contains(["standard", "advanced"], var.rds_config.observability.database_insights_mode)
│     ├────────────────
│     │ while calling contains(list, value)
│     │ var.rds_config.observability.database_insights_mode is null
│ 
│ Invalid value for "value" parameter: argument must not be null.
╵
╷
│ Error: Operation failed
│ 
│   on .terraform/modules/fleet/variables.tf line 278, in variable "rds_config":
│  278:     condition     = var.rds_config.observability.database_insights_mode != "advanced" || var.rds_config.observability.retention_period == null || var.rds_config.observability.retention_period >= 465
│     ├────────────────
│     │ var.rds_config.observability.retention_period is null
│ 
│ Error during operation: argument must not be null.

Unthread

03/23/2026, 10:46 AM

Thanks for this Ed. I'll get another bug opened for this one.

Gray Williams

05/01/2026, 2:02 PM

Hey @Ed Merrett, hope you're doing OK. Just wanted to follow up on this to make sure that the latest version of this was working as expected for you.

Ed Merrett

05/06/2026, 1:24 PM

Hey @Gray Williams - Unfortunately we use an outdated version of terraform in CI currently so I cant test any new modules as you guys require up-to-date terraform versions (makes sense) so I have no issues currently and when we bump TF in the coming weeks I can let you know if we still have an issue! ty

👍 1

3 Views

Open in Slack

Previous Next