Limitations on accessing exposed included config

[vasishche]

Describe the bug

Limitations on accessing exposed included config described in the documentation are not respected.

Also, it actually says here that nested inclusions are allowed (include is exposed and available to the child include), but that's not true, is it?

Steps To Reproduce

Let's take a slightly complicated read_terragrunt_config example. Consider the following file tree:

.
├── module
│   ├── main.tf
│   ├── terraform.tfstate
│   ╰── terragrunt.hcl
├── common_deps.hcl
├── main.tf
╰── terragrunt.hcl

module/main.tf:

output "value" {
  value = "yes"
}

module/terraform.tfstate:

{"version":4,"terraform_version":"1.10.6","serial":1,"lineage":"d51b69a4-9c9b-fe0c-7342-f6fe127f218e","outputs":{"value":{"value":"yes","type":"string"}},"resources":[],"check_results":null}

common_deps.hcl:

dependency "module" {
  config_path = "${get_repo_root()}/module"
}

inputs = {
  value = dependency.module.outputs.value
}

terragrunt.hcl:

include "common_deps" {
  path   = "common_deps.hcl"
  expose = true
}

inputs = {
  # value = dependency.module.outputs.value
  # value = include.common_deps.inputs.value
  # value = include.common_deps.dependency.module.outputs.value
}

The rest files are empty. Also run git init to make get_repo_root() function work.

Then uncomment one of the lines in inputs of terragrunt.hcl file to reproduce 3 following cases:

value = dependency.module.outputs.value

This is the case when we need the raw outputs.

$ terragrunt run --all plan
07:13:51.091 INFO   Using runner pool for stack .
07:13:51.118 INFO   The runner-pool runner at . will be processed in the following order for command plan:
- Unit ./module
- Unit .

07:13:51.168 INFO   [module] tofu: Initializing the backend...
07:13:51.172 INFO   [module] tofu: Initializing provider plugins...
07:13:51.172 INFO   [module] tofu: OpenTofu has been successfully initialized!
07:13:51.172 INFO   [module] tofu: 
07:13:51.172 INFO   [module] tofu: You may now begin working with OpenTofu. Try running "tofu plan" to see
07:13:51.172 INFO   [module] tofu: any changes that are required for your infrastructure. All OpenTofu commands
07:13:51.172 INFO   [module] tofu: should now work.
07:13:51.172 INFO   [module] tofu: If you ever set or change modules or backend configuration for OpenTofu,
07:13:51.172 INFO   [module] tofu: rerun this command to reinitialize your working directory. If you forget, other
07:13:51.172 INFO   [module] tofu: commands will detect it and remind you to do so if necessary.
07:13:51.217 STDOUT [module] tofu: No changes. Your infrastructure matches the configuration.
07:13:51.217 STDOUT [module] tofu: OpenTofu has compared your real infrastructure against your configuration and
07:13:51.217 STDOUT [module] tofu: found no differences, so no changes are needed.
07:13:51.254 INFO   [module] tofu: Initializing the backend...
07:13:51.254 INFO   [module] tofu: Initializing provider plugins...
07:13:51.254 INFO   [module] tofu: OpenTofu has been successfully initialized!
07:13:51.254 INFO   [module] tofu: 
07:13:51.254 INFO   [module] tofu: You may now begin working with OpenTofu. Try running "tofu plan" to see
07:13:51.254 INFO   [module] tofu: any changes that are required for your infrastructure. All OpenTofu commands
07:13:51.254 INFO   [module] tofu: should now work.
07:13:51.254 INFO   [module] tofu: If you ever set or change modules or backend configuration for OpenTofu,
07:13:51.254 INFO   [module] tofu: rerun this command to reinitialize your working directory. If you forget, other
07:13:51.254 INFO   [module] tofu: commands will detect it and remind you to do so if necessary.
07:13:51.303 INFO   tofu: Initializing the backend...
07:13:51.303 INFO   tofu: Initializing provider plugins...
07:13:51.303 INFO   tofu: OpenTofu has been successfully initialized!
07:13:51.303 INFO   tofu: 
07:13:51.303 INFO   tofu: You may now begin working with OpenTofu. Try running "tofu plan" to see
07:13:51.303 INFO   tofu: any changes that are required for your infrastructure. All OpenTofu commands
07:13:51.303 INFO   tofu: should now work.
07:13:51.303 INFO   tofu: If you ever set or change modules or backend configuration for OpenTofu,
07:13:51.303 INFO   tofu: rerun this command to reinitialize your working directory. If you forget, other
07:13:51.303 INFO   tofu: commands will detect it and remind you to do so if necessary.
07:13:51.329 STDOUT tofu: No changes. Your infrastructure matches the configuration.
07:13:51.329 STDOUT tofu: OpenTofu has compared your real infrastructure against your configuration and
07:13:51.329 STDOUT tofu: found no differences, so no changes are needed.

❯❯ Run Summary  2 units  211ms
   ────────────────────────────
   Succeeded    2

Succeeded, no errors.

value = include.common_deps.inputs.value

Here we can do some preprocessing of common dependencies outputs in the inputs.

$ terragrunt run --all plan
07:14:34.477 INFO   Using runner pool for stack .
07:14:34.494 ERROR  Error: Attempt to get attribute from null value
07:14:34.494 ERROR    on ./terragrunt.hcl line 8:
07:14:34.494 ERROR     8:   value = include.common_deps.inputs.value
07:14:34.494 ERROR  This value is null, so it does not have any attributes.
07:14:34.506 INFO   The runner-pool runner at . will be processed in the following order for command plan:
- Unit ./module
- Unit .

07:14:34.560 INFO   [module] tofu: Initializing the backend...
07:14:34.564 INFO   [module] tofu: Initializing provider plugins...
07:14:34.564 INFO   [module] tofu: OpenTofu has been successfully initialized!
07:14:34.564 INFO   [module] tofu: 
07:14:34.564 INFO   [module] tofu: You may now begin working with OpenTofu. Try running "tofu plan" to see
07:14:34.564 INFO   [module] tofu: any changes that are required for your infrastructure. All OpenTofu commands
07:14:34.564 INFO   [module] tofu: should now work.
07:14:34.564 INFO   [module] tofu: If you ever set or change modules or backend configuration for OpenTofu,
07:14:34.564 INFO   [module] tofu: rerun this command to reinitialize your working directory. If you forget, other
07:14:34.564 INFO   [module] tofu: commands will detect it and remind you to do so if necessary.
07:14:34.605 STDOUT [module] tofu: No changes. Your infrastructure matches the configuration.
07:14:34.605 STDOUT [module] tofu: OpenTofu has compared your real infrastructure against your configuration and
07:14:34.605 STDOUT [module] tofu: found no differences, so no changes are needed.
07:14:34.641 INFO   [module] tofu: Initializing the backend...
07:14:34.641 INFO   [module] tofu: Initializing provider plugins...
07:14:34.641 INFO   [module] tofu: OpenTofu has been successfully initialized!
07:14:34.641 INFO   [module] tofu: 
07:14:34.641 INFO   [module] tofu: You may now begin working with OpenTofu. Try running "tofu plan" to see
07:14:34.641 INFO   [module] tofu: any changes that are required for your infrastructure. All OpenTofu commands
07:14:34.641 INFO   [module] tofu: should now work.
07:14:34.641 INFO   [module] tofu: If you ever set or change modules or backend configuration for OpenTofu,
07:14:34.641 INFO   [module] tofu: rerun this command to reinitialize your working directory. If you forget, other
07:14:34.642 INFO   [module] tofu: commands will detect it and remind you to do so if necessary.
07:14:34.689 INFO   tofu: Initializing the backend...
07:14:34.690 INFO   tofu: Initializing provider plugins...
07:14:34.690 INFO   tofu: OpenTofu has been successfully initialized!
07:14:34.690 INFO   tofu: 
07:14:34.690 INFO   tofu: You may now begin working with OpenTofu. Try running "tofu plan" to see
07:14:34.690 INFO   tofu: any changes that are required for your infrastructure. All OpenTofu commands
07:14:34.690 INFO   tofu: should now work.
07:14:34.690 INFO   tofu: If you ever set or change modules or backend configuration for OpenTofu,
07:14:34.690 INFO   tofu: rerun this command to reinitialize your working directory. If you forget, other
07:14:34.690 INFO   tofu: commands will detect it and remind you to do so if necessary.
07:14:34.715 STDOUT tofu: No changes. Your infrastructure matches the configuration.
07:14:34.715 STDOUT tofu: OpenTofu has compared your real infrastructure against your configuration and
07:14:34.715 STDOUT tofu: found no differences, so no changes are needed.

❯❯ Run Summary  2 units  209ms
   ────────────────────────────
   Succeeded    2

Succeeded, but an error occurred, possibly related to #4949.

value = include.common_deps.dependency.module.outputs.value

And this is a more obvious way to access the raw outputs of common dependencies without confusing invisible merged dependency blocks with actual child module dependency blocks.

$ terragrunt run --all plan
07:15:03.499 INFO   Using runner pool for stack .
07:15:03.516 ERROR  Error: Attempt to get attribute from null value
07:15:03.516 ERROR    on ./terragrunt.hcl line 9:
07:15:03.516 ERROR     9:   value = include.common_deps.dependency.module.outputs.value
07:15:03.516 ERROR  This value is null, so it does not have any attributes.
07:15:03.527 INFO   The runner-pool runner at . will be processed in the following order for command plan:
- Unit ./module
- Unit .

07:15:03.579 INFO   [module] tofu: Initializing the backend...
07:15:03.581 INFO   [module] tofu: Initializing provider plugins...
07:15:03.581 INFO   [module] tofu: OpenTofu has been successfully initialized!
07:15:03.581 INFO   [module] tofu: 
07:15:03.581 INFO   [module] tofu: You may now begin working with OpenTofu. Try running "tofu plan" to see
07:15:03.581 INFO   [module] tofu: any changes that are required for your infrastructure. All OpenTofu commands
07:15:03.581 INFO   [module] tofu: should now work.
07:15:03.581 INFO   [module] tofu: If you ever set or change modules or backend configuration for OpenTofu,
07:15:03.581 INFO   [module] tofu: rerun this command to reinitialize your working directory. If you forget, other
07:15:03.581 INFO   [module] tofu: commands will detect it and remind you to do so if necessary.
07:15:03.619 STDOUT [module] tofu: No changes. Your infrastructure matches the configuration.
07:15:03.619 STDOUT [module] tofu: OpenTofu has compared your real infrastructure against your configuration and
07:15:03.619 STDOUT [module] tofu: found no differences, so no changes are needed.
07:15:03.656 INFO   [module] tofu: Initializing the backend...
07:15:03.657 INFO   [module] tofu: Initializing provider plugins...
07:15:03.657 INFO   [module] tofu: OpenTofu has been successfully initialized!
07:15:03.657 INFO   [module] tofu: 
07:15:03.657 INFO   [module] tofu: You may now begin working with OpenTofu. Try running "tofu plan" to see
07:15:03.657 INFO   [module] tofu: any changes that are required for your infrastructure. All OpenTofu commands
07:15:03.657 INFO   [module] tofu: should now work.
07:15:03.657 INFO   [module] tofu: If you ever set or change modules or backend configuration for OpenTofu,
07:15:03.657 INFO   [module] tofu: rerun this command to reinitialize your working directory. If you forget, other
07:15:03.657 INFO   [module] tofu: commands will detect it and remind you to do so if necessary.
07:15:03.684 ERROR  Error: Attempt to get attribute from null value
07:15:03.684 ERROR    on ./terragrunt.hcl line 9:
07:15:03.684 ERROR     9:   value = include.common_deps.dependency.module.outputs.value
07:15:03.684 ERROR  This value is null, so it does not have any attributes.
07:15:03.684 ERROR  Run failed: error occurred:

* ./terragrunt.hcl:9,56-62: Attempt to get attribute from null value; This value is null, so it does not have any attributes.


❯❯ Run Summary  2 units  156ms
   ────────────────────────────
   Succeeded    1
   Failed       1

Failed and an error occurred. Thus, there are some more restrictions than described in the documentation.

Expected behavior

There should be no restrictions on access to exposed included dependency from child inputs.

Versions

• Terragrunt version: v0.90.0
• OpenTofu/Terraform version: v1.10.6

[yhakbar]

Hey @vasishche ,

Is the lower part of this issue actually copied over from this?
#4949

Note that the issue related to read_terragrunt_config() has had a bugfix in the most recent release (v0.91.1), and is worth trying out to see if it addresses the read_terragrunt_config() issue you're facing.

[vasishche]

Hey @yhakbar ,
No, it's different. I just used a similar file structure to reproduce a different problem.

[yhakbar]

OK, your examples didn't have read_terragrunt_config(), so I was a bit confused by this.

This seems to be a bit of a niche edge-case for usage of exposed includes, so it might take us a while to dig into this.

[yhakbar]

@vasishche

Can you please explain the use-case you're trying to accomplish with this?

Pull requests to improve the clarity of the docs is welcome.