terraform config_error ai_generated true

Error: Invalid for_each argument: Sensitive values not allowed in for_each

ID: terraform/for-each-sensitive

Also available as: JSON · Markdown
90%Fix Rate
90%Confidence
50Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1 active — — —

Root Cause

for_each can't iterate over sensitive values. Terraform can't plan resources with hidden keys.

generic

Workarounds

  1. 92% success Use nonsensitive() to unwrap the value for for_each keys only 
    for_each = nonsensitive(var.my_sensitive_map)

    Sources: https://developer.hashicorp.com/terraform/language/functions/nonsensitive

  2. 85% success Restructure to use non-sensitive keys with sensitive values as attributes 
    # Use toset() with non-sensitive values as keys:
locals {
  config = {
    "web"   = { secret = sensitive(var.web_key) }
    "api"   = { secret = sensitive(var.api_key) }
  }
}

resource "aws_instance" "servers" {
  for_each = toset(keys(local.config))  # keys are not sensitive
  tags     = { Name = each.key }
}

    Sources: https://developer.hashicorp.com/terraform/language/expressions/function-calls

Dead Ends

Common approaches that don't work:

  1. Mark everything as non-sensitive 80% fail

    Exposes secrets in plan output and state

  2. Use count instead of for_each 60% fail

    Loses the benefit of stable resource keys — risky for updates

Error Chain

Frequently confused with: