How to fix Error: Invalid for_each argument in Terraform

TerraformINTERMEDIATEHIGH

The "Invalid for_each argument" error occurs when Terraform cannot determine the keys in a for_each loop before applying the plan. This typically happens when the for_each value depends on computed resources or unknown attributes that haven't been created yet.

What this error means

Terraform's for_each meta-argument requires all keys to be known at plan time (before apply), not at apply time. When you use for_each with a value that depends on a resource that hasn't been created yet—such as outputs from data sources, computed attributes, or other resources—Terraform cannot predict how many instances will be created. The error message indicates that the value passed to for_each contains key references that depend on resource attributes that cannot be determined until the apply phase. This creates a "chicken-and-egg" problem: Terraform needs to know the keys to create the resources, but the keys depend on resources that don't exist yet. This is a core limitation of Terraform's planning model, not a bug.

How to fix "Error: Invalid for_each argument"

1Use the -target flag to apply dependencies first

The most common workaround is to apply the dependency first using the -target argument, then apply the rest of your configuration.

First, apply only the resources that for_each depends on:

bash

terraform apply -target='aws_eks_cluster.main'

Then apply the full configuration:

bash

terraform apply

This two-step process ensures that the dependency is created before Terraform tries to evaluate the for_each expression.

2Define map keys statically and compute values at apply time

Instead of making both keys and values depend on computed attributes, keep the keys static and only compute the values:

hcl

# DON'T DO THIS - keys depend on computed data
for_each = data.aws_availability_zones.available.names

# DO THIS - keys are static, values are computed
for_each = {
  az1 = "us-east-1a"
  az2 = "us-east-1b"
  az3 = "us-east-1c"
}

# Or use a static list with toset()
for_each = toset([
  "us-east-1a",
  "us-east-1b",
  "us-east-1c"
])

This approach requires knowing the keys upfront, but keeps your configuration deterministic.

3Pass a map with known keys from one module to another

When passing for_each values between modules, ensure the map keys are not computed:

hcl

# In parent module
module "worker_nodes" {
  for_each = tomap({
    "group-1" : var.group_1_config,
    "group-2" : var.group_2_config,
    "group-3" : var.group_3_config,
  })

  source = "./modules/worker"
  # ... pass each.value to module
}

# The keys ("group-1", "group-2", etc.) are static strings
# Only the values come from dynamic config

By using static string keys with tomap(), you ensure Terraform knows the for_each structure at plan time.

4Use locals to pre-compute and cache values

If you need to derive keys from a data source, compute them in a local and reference that instead:

hcl

locals {
  # Query data source once, outside for_each
  available_azs = data.aws_availability_zones.available.names

  # Build a map with known keys
  az_map = {
    for idx, az in local.available_azs :
    "az-${idx + 1}" => az
  }
}

# Now use the pre-computed map
resource "aws_subnet" "main" {
  for_each = local.az_map

  availability_zone = each.value
  # ... rest of config
}

This approach pre-computes the for_each structure so Terraform knows it at plan time.

5Check for sensitive values in for_each

Terraform also rejects sensitive values (secrets, passwords) in for_each because the keys are exposed in the UI output.

If you're passing sensitive variables to for_each:

hcl

# This will fail if var.secret_config is marked sensitive
for_each = var.secret_config  # ❌ Error if sensitive

# Workaround: Extract only the non-sensitive parts
locals {
  # Use only the non-sensitive subset
  safe_config = {
    for k, v in var.config : k => v.username
  }
}

for_each = local.safe_config  # ✓ Works

Always keep for_each keys and values non-sensitive.

How to fix Error: Invalid for_each argument in Terraform

What this error means

Typical symptoms

Common causes

How to fix "Error: Invalid for_each argument"

Advanced notes

Related errors

Official resources & further reading