fastly_tls_activation fails with 400 when using certificate_id from fastly_tls_subscription in same apply
# fastly_tls_activation fails with 400 when using certificate_id from fastly_tls_subscription in same apply
## Description
When using `fastly_tls_subscription` and then passing its `certificate_id` into `fastly_tls_activation` in the same Terraform apply, the activation is created with an empty `certificate_id`, and the Fastly API returns:
```
400 - Bad Request:
Title: Missing required attribute
Detail: param is missing or the value is empty: tls_certificate_id
```
## Minimal example (anonymous)
```hcl
# Certificates map: key = domain (common_name), value = subscription config
variable "certificates" {
type = map(object({
authority = optional(string, "lets-encrypt")
common_name = optional(string, "")
domains = set(string)
force_destroy = optional(bool, true)
}))
}
data "fastly_tls_configuration" "tls_1_3" {
name = "HTTP/3 & TLS v1.3"
}
resource "fastly_tls_subscription" "for" {
for_each = var.certificates
certificate_authority = each.value.authority
common_name = each.value.common_name
domains = each.value.domains
force_destroy = each.value.force_destroy
}
resource "fastly_tls_activation" "tls_1_3_activation" {
for_each = var.certificates
certificate_id = fastly_tls_subscription.for[each.key].certificate_id
domain = each.value.common_name
configuration_id = data.fastly_tls_configuration.tls_1_3.id
depends_on = [fastly_tls_subscription.for]
}
```
With input like:
```hcl
certificates = {
"alias.example.com" = {
common_name = "alias.example.com"
domains = ["alias.example.com"]
}
}
```
On first apply (new subscription), the activation fails with 400 because `certificate_id` is empty until Fastly issues the cert after DNS validation.
## Steps to reproduce
1. Create a `fastly_tls_subscription` (e.g. with `for_each` over a set of domains).
2. Create `fastly_tls_activation` with:
- `certificate_id = fastly_tls_subscription.for[each.key].certificate_id`
- `depends_on = [fastly_tls_subscription.for]`
3. Run `terraform apply`.
## Expected behavior
- Activation is created only when `certificate_id` is available (e.g. after subscription validation), **or**
- The provider/docs clearly require using `fastly_tls_subscription_validation` (or a second apply) before using `certificate_id` in `fastly_tls_activation`.
## Actual behavior
- The activation is created in the same apply as the subscription.
- At that time `certificate_id` is still empty (certificate is issued asynchronously by Fastly after DNS validation).
- The API is called with an empty `tls_certificate_id` and returns 400.
## Root cause
- `fastly_tls_subscription.certificate_id` is read-only and only populated by Fastly **after** the certificate is issued (asynchronously, after DNS/ACME validation).
- Terraform does not re-read resource attributes mid-apply, so the activation is planned and applied with the initial (empty) `certificate_id`.
## Environment
- Terraform: ~1.14
- Provider: fastly/fastly ~7.1
0 条评论