aws provider info isn't available to grandchild module in 0.6.9

[WillAbides]

I have a module (network_module) that uses another module (key_pair_module) that creates an aws resource. As of 0.6.8, I could use network_module from a config that has an aws provider defined and the auth and region from that provider was used when key_pair_module created an aws_key_pair. Now, with 0.6.9, that no longer works.

Here are some simplified configs that show the problem:

./key_pair_module/main.tf

variable "public_key" {}
variable "key_name" {}

resource "aws_key_pair" "key" {
  public_key = "${var.public_key}"
  key_name = "${var.key_name}"
}

./network_module/main.tf

variable "aws_public_key_path" {}
variable "key_name" {}

module "key_pair" {
  source = "../key_pair_module"
  public_key = "${file(var.aws_public_key_path)}"
  key_name = "${var.key_name}"
}

./example_config/main.tf

variable "aws_region" {
  default = "us-east-1"
}
variable "aws_access_key" {}
variable "aws_secret_key" {}

provider "aws" {
  region = "${var.aws_region}"
  access_key = "${var.aws_access_key}"
  secret_key = "${var.aws_secret_key}"
}

module "network_module" {
  source = "../network_module"
  aws_public_key_path = "./id_rsa.pub"
  key_name = "test-key-please-ignore"
}

./example_config/terraform.tfvars

aws_access_key = "SSSHHHHH"
aws_secret_key = "ITSASECRET"

This is the output when I run terraform apply with 0.6.9:

 ~/hack/terraform-grandchild-repro/example_config  $  terraform apply
provider.aws.region
  The region where AWS operations will take place. Examples
  are us-east-1, us-west-2, etc.

  Default: us-east-1
  Enter a value:

Error refreshing state: 1 error(s) occurred:

* 1 error(s) occurred:

* Error loading credentials for AWS Provider: NoCredentialProviders: no valid providers in chain

It shouldn't have prompted for provider.aws.region since that was already defined in the aws provider.

[WillAbides]

I may have been wrong about this working as I expected in 0.6.8. I switched back to 0.6.8 and got similar behavior.

[WillAbides]

I found a workaround. If I add an aws.key_pair resource to network_module, then the key_pair created in key_pair_module works also. This even works if I have count=0 on the fake key_pair so that nothing gets created.

I think the graphs of before and after doing that are instructive.

With the fake key_pair resource:

Without the fake key_pair resource:

With the fake resource and count=0:

[WillAbides]

reopened after accidentally hitting "Close and comment"

[wholroyd]

Also related to issues #4443, #2832, and #3931.

[WillAbides]

@wholroyd Thanks. This may be a dupe of #4443, but I'm going to leave it open and let a contributor decide for sure.

[catsby]

Hey friends – thanks for opening this. We've chatted internally and agree it's a dupe of #4443, so we're going to close. Once again though, thank you for opening the issue 😄

#4443 is on our short list, thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.