Dependencies for cloudinit_post_nodeadm content result in `Invalid count argument` error

[daniel-palmer-gu]

Description

It would seem that cloudinit_post_nodeadm content can not depend on resources that terraform needs to create. Doing so results in a Invalid count argument error.

Below is an example that adds dummy data to the content. It doesn't make sense but proves the point. If there were a real template that used that data, the result should be the same.

• [x] ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]: 20.35.0

• Terraform version: Terraform v1.5.7

• Provider version(s):

Terraform v1.5.7
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v5.94.0
+ provider registry.terraform.io/hashicorp/cloudinit v2.3.6
+ provider registry.terraform.io/hashicorp/null v3.2.3
+ provider registry.terraform.io/hashicorp/random v3.7.1
+ provider registry.terraform.io/hashicorp/time v0.13.0
+ provider registry.terraform.io/hashicorp/tls v4.0.6

Reproduction Code [Required]

module "eks_al2023" {
  source  = "terraform-aws-modules/eks/aws"
  version = "= 20.35.0"

  cluster_name    = "testing-al2023"
  cluster_version = "1.31"

  # EKS Addons
  cluster_addons = {
    coredns                = {}
    eks-pod-identity-agent = {}
    kube-proxy             = {}
    vpc-cni                = {}
  }

  # vpc_id     = module.vpc.vpc_id
  # subnet_ids = module.vpc.private_subnets
  vpc_id = "vpc-myvpc"
  subnet_ids = [
    "subnet-mysubnet1",
    "subnet-mysubnet2",
    "subnet-mysubnet3"
  ]

  eks_managed_node_groups = {
    example = {
      # Starting on 1.30, AL2023 is the default AMI type for EKS managed node groups
      instance_types = ["m6i.large"]

      min_size = 1
      max_size = 1
      # This value is ignored after the initial creation
      # https://github.com/bryantbiggs/eks-desired-size-hack
      desired_size = 1

      # This is not required - demonstrates how to pass additional configuration to nodeadm
      # Ref https://awslabs.github.io/amazon-eks-ami/nodeadm/doc/api/
      cloudinit_pre_nodeadm = [
        {
          content_type = "application/node.eks.aws"
          content      = <<-EOT
            ---
            apiVersion: node.eks.aws/v1alpha1
            kind: NodeConfig
            spec:
              kubelet:
                config:
                  shutdownGracePeriod: 30s
                  featureGates:
                    DisableKubeletCloudCredentialProviders: true
          EOT
        }
      ]
    }
  }

  eks_managed_node_group_defaults = {
    enable_bootstrap_user_data = true
    ami_type               = "AL2023_x86_64_STANDARD"
    cloudinit_post_nodeadm = [{
      content_type = "text/x-shellscript; charset=\"us-ascii\""
      content = random_password.my_password.result
    }]
  }
}

resource "random_password" "my_password" {
  length = 32
}

Steps to reproduce the behavior:

1. Create a fresh main.tf file with the contents above
2. Update vpc_id and subnet_ids with ones you have access to
3. terraform init
4. terraform apply (or plan)

Expected behavior

Plan succeeds and can apply the code

Actual behavior

Plan fails with the error below

Terminal Output Screenshot(s)

Text version of error:

│ Error: Invalid count argument
│ 
│   on .terraform/modules/eks_al2023/modules/_user_data/main.tf line 131, in data "cloudinit_config" "al2023_eks_managed_node_group":
│  131:   count = var.create && local.user_data_type == "al2023" && length(local.nodeadm_cloudinit) > 0 ? 1 : 0
│ 
│ The "count" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the -target
│ argument to first apply only the resources that the count depends on.

Additional context

Removing the dependency on the random_password and replacing it's contents with "mypassword" allows the plan to succeed.