Terraform Dynamic Block with list intro them

Question

I'm creating a AWS Cloudfront module and some troubles are happening because have some Cloudfront parameters that are "dynamics/optional" too.

When I'm trying run the $ terraform validate show me the error:

on ../../../../../terraform-aws-modules/cloudfront_distribution/main.tf line 24, in resource "aws_cloudfront_distribution" "cdn":
  24:   dynamic "custom_origin_config" {

Blocks of type "custom_origin_config" are not expected here.

Following my module main.tf:

resource "aws_cloudfront_distribution" "cdn" {

  enabled               = var.enabled
  comment               = var.comment
  default_root_object   = var.default_root_object
  aliases               = var.aliases
  is_ipv6_enabled       = var.is_ipv6_enabled
  http_version          = var.http_version
  price_class           = var.price_class
  web_acl_id            = var.web_acl_id
  retain_on_delete      = var.retain_on_delete
  wait_for_deployment   = var.wait_for_deployment

  dynamic "origin" {
    for_each  = var.origin
    content {

      domain_name   = origin.value.domain_name
      origin_id     = origin.value.origin_id
      origin_path   = origin.value.origin_path
    }
  }

  dynamic "custom_origin_config" {
    for_each  = var.custom_origin_config
    content {
      
      http_port                 = custom_origin_config.value.http_port
      https_port                = custom_origin_config.value.https_port
      origin_protocol_policy    = custom_origin_config.value.origin_protocol_policy
      origin_ssl_protocols      = custom_origin_config.value.origin_ssl_protocols
      origin_keepalive_timeout  = custom_origin_config.value.origin_keepalive_timeout
      origin_read_timeout       = custom_origin_config.value.origin_read_timeout

    }
  }

My vars.tf :

variable "origin"   {
    type        = any
    default     = []
    description = "One or more origins for this distribution (multiples allowed)."
}

variable "custom_origin_config" {
    type        = any
    default     = []
    description = "The CloudFront custom origin configuration information. If an S3 origin is required, use s3_origin_config instead."
}

EDIT 1

A made a little changes main.tf

 dynamic "origin" {
    for_each  = var.origin
    content {

      domain_name   = origin.value.domain_name
      origin_id     = origin.value.origin_id
      origin_path   = origin.value.origin_path

      dynamic "custom_origin_config" {
        for_each  = var.custom_origin_config
        content {
      
        http_port                 = custom_origin_config.value.http_port
        https_port                = custom_origin_config.value.https_port
        origin_protocol_policy    = custom_origin_config.value.origin_protocol_policy
        origin_ssl_protocols      = custom_origin_config.value.origin_ssl_protocols
        origin_keepalive_timeout  = custom_origin_config.value.origin_keepalive_timeout
        origin_read_timeout       = custom_origin_config.value.origin_read_timeout

        }
      }
    }
  }

and onto vars.tf:

variable "origin"   {
    type        = any
#    default     = []
    description = "One or more origins for this distribution (multiples allowed)."
}

variable "custom_origin_config" {
    type        = list
#    default     = []
    description = "The CloudFront custom origin configuration information. If an S3 origin is required, use s3_origin_config instead."
}

And now the output error change:

Error: Incorrect attribute value type

  on ../../../../../terraform-aws-modules/cloudfront_distribution/main.tf line 29, in resource "aws_cloudfront_distribution" "cdn":
  29:         origin_ssl_protocols      = custom_origin_config.value.origin_ssl_protocols

Inappropriate value for attribute "origin_ssl_protocols": set of string
required.


Error: Incorrect attribute value type

  on ../../../../../terraform-aws-modules/cloudfront_distribution/main.tf line 43, in resource "aws_cloudfront_distribution" "cdn":
  43:         locations          = geo_restriction.value.location

Inappropriate value for attribute "locations": set of string required.


Error: Incorrect attribute value type

  on ../../../../../terraform-aws-modules/cloudfront_distribution/main.tf line 55, in resource "aws_cloudfront_distribution" "cdn":
  55:       cloudfront_default_certificate  = viewer_certificate.value.cloudfront_default_certificate

Inappropriate value for attribute "cloudfront_default_certificate": a bool is
required.

Someone has been through this problem, managed to solve it?

Answer 1

I'm resolved my question like bellow:

• I discovered that some arguments that I used before not was used when you use the s3_origin and them are used with custom_orogin

Was necessary used too variables type=list(object({foo=bar}) for my dynamic blocks lists.

Part of my module bellow:

main.tf

 dynamic "origin" {
    for_each = var.origin
    content {

      domain_name = origin.value.domain_name
      origin_id   = origin.value.origin_id

      s3_origin_config {
        origin_access_identity = origin.value.origin_access_identity
      }
    }
  }

vars.tf

variable "origin" {
  type        = list(object({ domain_name = any, origin_id = string, origin_access_identity = string }))
  description = "One or more origins for this distribution (multiples allowed)."
}

Another thing that I learned it's when you set a default=value onto variable type same this var is (optional) you turn them (required).