From 4ad32729286d883581d1a0c59362f525586ba23b Mon Sep 17 00:00:00 2001
From: "blink-so[bot]" <211532188+blink-so[bot]@users.noreply.github.com>
Date: Mon, 9 Mar 2026 14:06:41 +0000
Subject: [PATCH] fix(terraform): defer dynamic block expansion when for_each
 contains unknown values

Change the guard check in expandDynamic() from IsKnown() to
IsWhollyKnown() so that dynamic blocks with partially-resolved
for_each values (containing cty.DynamicVal in nested elements)
are deferred instead of expanded with stale data.

Previously, a for_each value like:
  [{name: DynamicVal, value: "vscode"}]
would pass the IsKnown() check (the top-level tuple is known)
and expand the dynamic block with unresolved values. The block
would then be marked as expanded and never re-expanded, even
after subsequent evaluation passes resolve the nested locals.

IsWhollyKnown() recursively checks all nested elements, catching
the DynamicVal inside the tuple. Returning nil instead of an error
defers expansion without marking it as expanded, allowing the next
evaluation iteration to expand correctly once all locals resolve.

Fixes coder/coder#20930
---
 pkg/iac/terraform/block.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/iac/terraform/block.go b/pkg/iac/terraform/block.go
index a1bc3e7fd3eb..fbdcb6ce33d9 100644
--- a/pkg/iac/terraform/block.go
+++ b/pkg/iac/terraform/block.go
@@ -612,8 +612,8 @@ func (b *Block) expandDynamic() ([]*Block, error) {
 		return nil, fmt.Errorf("invalid for-each in %s block: %w", b.FullLocalName(), err)
 	}
 
-	if !forEachVal.IsKnown() {
-		return nil, errors.New("for-each must be known")
+	if !forEachVal.IsWhollyKnown() {
+		return nil, nil
 	}
 
 	var (