Incorrect evaluation of boolean conditions

[mkielar]

Terraform Version

Terraform v0.13.3

Terraform Configuration Files

variable "tls" {
  type = object({
    server_certificate_key = string
    server_certificate     = string
    client_certificate     = string
  })
  default = null
}
locals {
  ingress_gateway_tls_client_certificate_validation_secrets = var.tls == null || var.tls.client_certificate == null ? [] : [
    {
      name      = "NGINX_CLIENT_CERTIFICATE",
      valueFrom = var.tls.client_certificate
    },
  ]
}

Debug Output

Error: Attempt to get attribute from null value
  on .terraform/modules/st_service_template.ingress/terraform/modules/ecs/service_ingress_gateway/locals_containers.tf line 204, in locals:
 204:   ingress_gateway_tls_client_certificate_validation_secrets = var.tls == null || var.tls.client_certificate == null ? [] : [
    |----------------
    | var.tls is null
This value is null, so it does not have any attributes.

Crash Output

N/A

Expected Behavior

Typically in programming languages, when the first condition of an or statement is true, the rest of the statement is not evaluated at all. What should happen in above case, is that the var.tls == null part should be evaluated as true and the var.tls.client_certificate == null should then not be evaluated at all. The above condition should then work correctly for null value and produce empty list.

Actual Behavior

Terraform fails as shown on the debug output.
I've also tried following:

• (var.tls == null || var.tls.client_certificate == null) - i.e. wrapping the condition with braces. Still fails
• var.tls == null || var.tls["client_certificate"] == null - i.e. using map notation. Still fails, just with a different error message ("This value is null, so it does not have any indices.")

What worked was: (var.tls == null || try(var.tls.client_certificate, null) == null) but that's just ugly.

Steps to Reproduce

terraform plan

Additional Context

References

[apparentlymart]

Hi @mkielar! Thanks for reporting this.

I've relabeled this as an enhancement because Terraform is currently behaving as designed and this issue is a (very reasonable) request to change the design to meet a new use-case.

However, after doing that I noticed that there's already #24128 which seems to be covering the same use-case, so I'm going to close this one just to consolidate the discussion over there. I'm also going to add a comment on that other issue imminently, since it seems like it didn't previously see a response from the maintainer team.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.