Iterative plan and apply

[JonathonAnderson]

Terraform Version

Terraform v1.9.5
on windows_amd64

Use Cases

Iterating over a resource using a for_each loop, but the set to be iterated over is not known until after apply.

In the case below, the identity attribute of azurerm_windows_function_app is an array of identity objects and the number of items in the array is not known until after apply.

resource azurerm_windows_function_app app {
  name                = var.function-app.name
  location            = var.app-service-plan.location
  service_plan_id     = var.app-service-plan.id
  resource_group_name = var.resource-group.name

  storage_account_name = azurerm_storage_account.storage.name
  storage_uses_managed_identity = true

  app_settings = merge(local.app-settings)


  site_config {
    always_on = contains(["Free", "F1", "D1"], var.app-service-plan.sku_name) ? false : null
  }
}

resource azurerm_key_vault_access_policy app {
  for_each = { for index, identity in azurerm_windows_function_app.app.identity :
                format("%s::%d", var.function-app.name, index) => identity }

  key_vault_id = azurerm_key_vault.vault.id
  tenant_id    = data.azuread_client_config.current.tenant_id
  object_id    = each.value.principal_id

  certificate_permissions = [ "Get" ]
  key_permissions         = [ "Get" ]
  secret_permissions      = [ "Get" ]
  storage_permissions     = [ "Get" ]
}

Attempted Solutions

The proposed solution from the command line output is to use --target to apply the function app resource first and then apply the remaining resources. This works but is not scalable.

Every other solution I've tried resolves back to the same error

Proposal

Implement a method to allow resources to be planned and applied after the initial apply, potentially iterating multiple times if needed. This could be done at the level of Terraform itself, the provider, or most likely the resource as a lifecycle argument.

lifecycle {
  plan_after_apply = true
}

References

No response

[jbardin]

Duplicate of #30937

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.