Invalid for_each argument (keys cannot be determined until apply) Terraform Origin: Platform & cloud OSI layer 7 · Application Last updated 5 Nov 2026

Terraform: Error: Invalid for_each argument — The "for_each" map includes keys derived from resource attributes that cannot be determined until apply

for_each keys depend on values only known after apply, so Terraform can't plan which instances exist.

Exact message you may see Error: Invalid for_each argumentThe "for_each" map includes keys derived from resource attributes that cannot be determined until applyThe "for_each" set includes values derived from resource attributes that cannot be determined until applyError: Invalid for_each argument ... will be known only after applyfor_each cannot be determined until apply
Explore the map of this error Full error map →
Seen on: Terraform

Meaning

Use keys known at plan time (static names, variables, toset(var.names)), not attributes of resources being created (IDs, ARNs). Split into two applies with -target (temporary), or restructure: build the map from inputs and look up IDs inside the resource. Values may be unknown; keys may not.

Common causes

  • Keys derived from aws_instance.x.id/ARNs
  • for_each over a resource created in the same run
  • Data source with unknown inputs
  • toset() of computed values
  • Module outputs unknown at plan

⚡ Quick fix

  1. Use static/variable keys: for_each = toset(var.subnet_names)
  2. Put unknown values in the value, not the key
  3. Split resources across applies when unavoidable

Detailed fix by platform

Terraform

  1. for_each = { for s in var.subnets : s.name => s } # keys are inputs, not resource attributes

How to diagnose

  1. Keys — Known at plan?
  2. Source — Resource attributes?
  3. Restructure — Possible?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

Error: Cycle (dependency cycle) — Terraform: Error: Cycle: aws_security_group.a, aws_security_group.b (Terraform)Error: Cycle (depende…Invalid AWS Region — Terraform: Error: Invalid AWS Region: us-east-3 / Error: configuring Terraform AWS Provider: validating provider credentials: operation error STS: GetCallerIdentity (Terraform)Invalid AWS RegionInvalid count argument (value unknown until apply) — Terraform: Error: Invalid count argument — The "count" value depends on resource attributes that cannot be determined until apply (Terraform)Invalid count argumen…Output refers to sensitive values — Terraform: Error: Output refers to sensitive values — a root module output containing sensitive data must be explicitly marked as sensitive (Terraform)Output refers to sens…Provider produced invalid plan / inconsistent final plan — Terraform: Error: Provider produced invalid plan — provider produced an invalid plan for aws_x.y, but we are tolerating it because it is using the legacy plugin SDK (Terraform)Provider produced inv…Reference to undeclared resource — Terraform: Error: Reference to undeclared resource / Reference to undeclared input variable (Terraform)Reference to undeclar…Saved plan is stale — Terraform: Error: Saved plan is stale — The given plan file can no longer be applied because the state was changed by another operation after the plan was created (Terraform)Saved plan is staleYour query returned no results (data source) — Terraform: Error: Your query returned no results. Please change your search criteria and try again. (Terraform)Your query returned n…Invalid f…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.