fix: use can(index()) to handle null proxy_client_password_auth_type by wavemoran · Pull Request #85 · cloudposse-terraform-components/aws-aurora-postgres

wavemoran · 2026-03-25T16:06:07Z

Summary

contains() throws Invalid function argument when passed a null value, even when short-circuit evaluation with == null || is expected — Terraform evaluates both sides of || before applying the condition
Replace contains(list, var) with can(index(list, var)) so null (or unset) values return false cleanly without erroring
Fixes the regression introduced in feat: add optional RDS DB Proxy support #72 for users who do not set proxy_client_password_auth_type

Problem

When proxy_client_password_auth_type is not set (default null), Terraform raises:

Error: Invalid function argument
  on variables.tf line 541, in variable "proxy_client_password_auth_type":
  condition = var.proxy_client_password_auth_type == null || contains([...], var.proxy_client_password_auth_type)
Invalid value for "value" parameter: argument must not be null.

Fix

# Before
condition = var.proxy_client_password_auth_type == null || contains([...], var.proxy_client_password_auth_type)

# After
condition = var.proxy_client_password_auth_type == null || can(index([...], var.proxy_client_password_auth_type))

Per the Terraform can function docs: can evaluates the given expression and returns true if it succeeds, or false if it returns any error — including the error index raises when the value is not found or is null. This is the recommended pattern for validation conditions.

References

Introduced by: feat: add optional RDS DB Proxy support #72
Terraform can function: https://developer.hashicorp.com/terraform/language/functions/can
Terraform custom conditions: https://developer.hashicorp.com/terraform/language/expressions/custom-conditions

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes
- Improved validation for the proxy client password authentication setting so valid values are handled more reliably, including null values.
Chores
- Updated an infrastructure module reference to use a pinned remote source.

Terraform's contains() throws "Invalid function argument" when the value is null, even when guarded by an == null check, because both sides of || are evaluated. Replace with can(index()) which returns false for null or non-matching values without erroring. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

coderabbitai · 2026-03-25T16:11:05Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f0f810d9-244e-45e4-bebd-731fa6773730

📥 Commits

Reviewing files that changed from the base of the PR and between dfceebc and 66958f0.

📒 Files selected for processing (1)

src/variables.tf

🚧 Files skipped from review as they are similar to previous changes (1)

src/variables.tf

📝 Walkthrough

Walkthrough

Modified the validation logic for the proxy_client_password_auth_type variable in src/variables.tf, replacing contains(...) with can(index(...)) for membership checking while preserving the allowed value set and null handling.

Changes

Variable Validation Update

Layer / File(s)	Summary
Null-safe validation logic `src/variables.tf`	Validation condition for `proxy_client_password_auth_type` now uses `var == null \|\| can(index(allowed_list, var))` instead of `contains(allowed_list, var)`, keeping the same allowed strings and null acceptance.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related issues

bug: variables.tf:567 validation fails in OpenTofu — contains() rejects null even with short-circuit #99: Directly addresses the null-safe validation bug described in this issue for the same variable.

Possibly related PRs

cloudposse-terraform-components/aws-aurora-postgres#72: Also modifies validation logic for variable "proxy_client_password_auth_type" in src/variables.tf.

Suggested labels: minor

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main Terraform validation fix for handling null proxy_client_password_auth_type values.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

RoseSecurity · 2026-03-25T16:19:48Z

We may also need to adjust the version constraints on this

wavemoran · 2026-03-25T17:15:14Z

We may also need to adjust the version constraints on this

Are you referencing this?

There's a few hops, but looks like the issue is conflicting versions being pulled in from account-map and cloudposse/satack-config.

We can test updating the latter to 2.0.0

…er conflict stack-config v1.8.0 requires cloudposse/utils >= 1.7.1, < 2.0.0 while account-map pulls in stack-config v2.0.0 which requires >= 2.0.0, < 3.0.0. These constraints are mutually exclusive, causing terraform init to fail. Upgrading all four remote-state module references to v2.0.0 aligns the utils constraint to >= 2.0.0, < 3.0.0 across the full dependency tree. The remote-state module interface is identical between v1.8.0 and v2.0.0. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

RoseSecurity · 2026-03-25T18:07:14Z

/terratest

RoseSecurity · 2026-03-27T13:06:29Z

/terratest

goruha · 2026-04-14T19:59:03Z

@wavemoran could you pls replace https://github.com/wavemoran/aws-aurora-postgres/blob/fix/proxy-auth-type-validation-null/src/providers.tf#L17 with github.com/cloudposse-terraform-components/aws-account-map//src/modules/iam-roles?ref=v1.537.2

goruha

check comments

Replace relative path reference to account-map with a pinned GitHub source so terraform init succeeds without the CI-only account-map copy workaround. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

mergify · 2026-04-22T12:02:44Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-04-29T12:03:56Z

Heads up! This pull request looks stale. It will be closed soon, if there are no new commits. ⏳

mergify · 2026-04-29T12:11:00Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-05-06T12:05:21Z

Heads up! This pull request looks stale. It will be closed soon, if there are no new commits. ⏳

mergify · 2026-05-06T12:11:44Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-05-13T12:07:50Z

Heads up! This pull request looks stale. It will be closed soon, if there are no new commits. ⏳

mergify · 2026-05-27T12:19:46Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-06-03T12:15:41Z

Heads up! This pull request looks stale. It will be closed soon, if there are no new commits. ⏳

mergify · 2026-06-03T12:23:45Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-06-10T12:17:51Z

Heads up! This pull request looks stale. It will be closed soon, if there are no new commits. ⏳

mergify · 2026-06-10T12:24:52Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-06-17T12:19:56Z

Heads up! This pull request looks stale. It will be closed soon, if there are no new commits. ⏳

mergify · 2026-06-17T12:26:57Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-06-24T12:28:43Z

Heads up! This pull request looks stale. It will be closed soon, if there are no new commits. ⏳

mergify · 2026-06-24T12:35:38Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-07-01T12:36:18Z

Heads up! This pull request looks stale. It will be closed soon, if there are no new commits. ⏳

mergify · 2026-07-01T12:42:46Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

mergify · 2026-07-01T15:18:36Z

Thanks @wavemoran for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.

github-actions · 2026-07-01T16:07:25Z

These changes were released in v2.2.0.

mergify Bot requested review from a team March 25, 2026 16:06

mergify Bot added the triage Needs triage label Mar 25, 2026

mergify Bot added the needs-test Needs testing label Mar 25, 2026

goruha requested changes Apr 14, 2026

View reviewed changes

fix: use GitHub source for iam_roles module to resolve CI init failures

dfceebc

Replace relative path reference to account-map with a pinned GitHub source so terraform init succeeds without the CI-only account-map copy workaround. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

goruha approved these changes Apr 22, 2026

View reviewed changes

goruha added this pull request to the merge queue Apr 22, 2026

mergify Bot removed the triage Needs triage label Apr 22, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Apr 22, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels Apr 29, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels May 6, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels May 13, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels May 27, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels Jun 3, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels Jun 10, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels Jun 17, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels Jun 24, 2026

mergify Bot added stale This PR has gone stale and removed stale This PR has gone stale labels Jul 1, 2026

Merge branch 'main' into fix/proxy-auth-type-validation-null

66958f0

RoseSecurity added the minor New features that do not break anything label Jul 1, 2026

RoseSecurity added this pull request to the merge queue Jul 1, 2026

Merged via the queue into cloudposse-terraform-components:main with commit 3b048ce Jul 1, 2026
14 checks passed

Uh oh!

Uh oh!

Conversation

wavemoran commented Mar 25, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Fix

References

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

RoseSecurity commented Mar 25, 2026

Uh oh!

wavemoran commented Mar 25, 2026

Uh oh!

RoseSecurity commented Mar 25, 2026

Uh oh!

RoseSecurity commented Mar 27, 2026

Uh oh!

goruha commented Apr 14, 2026

Uh oh!

goruha left a comment

Choose a reason for hiding this comment

Uh oh!

mergify Bot commented Apr 22, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

Uh oh!

mergify Bot commented Apr 29, 2026

Uh oh!

mergify Bot commented Apr 29, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

mergify Bot commented May 6, 2026

Uh oh!

mergify Bot commented May 6, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

mergify Bot commented May 13, 2026

Uh oh!

mergify Bot commented May 27, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

mergify Bot commented Jun 3, 2026

Uh oh!

mergify Bot commented Jun 3, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

mergify Bot commented Jun 10, 2026

Uh oh!

mergify Bot commented Jun 10, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

mergify Bot commented Jun 17, 2026

Uh oh!

mergify Bot commented Jun 17, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

mergify Bot commented Jun 24, 2026

Uh oh!

mergify Bot commented Jun 24, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

mergify Bot commented Jul 1, 2026

Uh oh!

mergify Bot commented Jul 1, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

mergify Bot commented Jul 1, 2026

Need help or want to ask for a PR review to be expedited?

Uh oh!

Uh oh!

github-actions Bot commented Jul 1, 2026

Uh oh!

Reviewers

wavemoran commented Mar 25, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 25, 2026 •

edited

Loading