fix(main.tf): change count check for privileged_principal_arns

[ghost]

what

• The length(var.privileged_principal_arns) is not determinable before apply if the input itself is dependent on other resources.

why

• Terraform cannot know the length of the variable before it is created e.g. by another module.

references

• length of privileged_principal_arns not determinable before apply #102

[nitrocode]

/test all

[nitrocode]

Hmmm

Error: Error putting S3 policy: MalformedPolicy: Could not parse the policy: Statement is not well formatted.

[nitrocode]

With this change, I run this locally

cd examples/complete
terraform init
terraform plan -var-file=object-lock.us-east-2.tfvars

And it tries to create this empty resource

  # module.s3_bucket.aws_s3_bucket_policy.default[0] will be created
  + resource "aws_s3_bucket_policy" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + policy = jsonencode(
            {
              + Statement = null
              + Version   = "2012-10-17"
            }
        )
    }

If we can change var.privileged_principal_arns to default to null instead of {}, it may be easier to verify if the map is empty. Unsure if the same issue you were getting will come up.

FYI the error you're probably getting (source)

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

terratest error

[ghost]

In order to test, I added some more scenarios like a plain one and one creating an S3 bucket with a policy attached.

The change to null as default is not solving the initial issue :(

[nitrocode]

Is there a way to see if the statement is null?

[ghost]

Dont think so. As soon as TF doesn't know what is stored inside the variable it won't work.
I explained it a bit more in detail in the issue-ticket.

I'd consider closing the ticket. If you'd like you can still take over the extended examples. What do you think?

[nitrocode]

Let's close for now and reopen if there's a better solution