Passing dynamic token to local-exec provisioner at destroy time

Hello everyone,

I’m trying to circumvent the limitation of my cloud provider not being able to give the necessary features.
Therefore I would need to fallback to API call.
For such, I need dynamicly generated tokens from another module (because these tokens can be reused).

I tried to give them directly to the provisioner:

resource "null_resource" "this" {
  triggers = {
    [...]
  }
  provisioner "local-exec" {
    environment = {
      ACCESS_TOKEN = var.access_token
    }
    command     = "./execute_command.sh [...]"
    working_dir = "${path.module}/assets"
    interpreter = ["bash", "-c"]
  }
  provisioner "local-exec" {
    when        = destroy
    environment = {
      ACCESS_TOKEN = var.access_token
    }
    command     = "./execute_command.sh [...]"
    working_dir = "${path.module}/assets"
    interpreter = ["bash", "-c"]
  }
}

But I’m receiving the well known error:

│ Destroy-time provisioners and their connection configurations may only
│ reference attributes of the related resource, via 'self', 'count.index', or
│ 'each.key'.
│
│ References to other resources during the destroy phase can cause dependency
│ cycles and interact poorly with create_before_destroy.

And if I put the token in the triggers block, the token generated a long time ago and saved in the state seems to be used instead of a new one and for sure this one is obsolete.

resource "null_resource" "this" {
  triggers = {
    access_token = var.access_token
  }

I searched several solutions on the web but wasn’t able to find a proper one.
Can you help me in providing a transient/dynamic value to a provisioner?
Or should I re-design my code?

Thanks in advance!

6 posts - 2 participants

Read full topic