{"record":{"id":"8999da81782ae895","repo":"hashicorp/terraform","slug":"action-s-has-ephemeral-config-values-which-are-n","errorCode":null,"errorMessage":"action %s has ephemeral config values, which are not supported in action invocations","messagePattern":"action (.+?) has ephemeral config values, which are not supported in action invocations","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/jsonplan/action_invocations.go","lineNumber":162,"sourceCode":"\tcase *plans.InvokeActionTrigger:\n\t\tai.InvokeActionTrigger = &InvokeActionTrigger{}\n\t\tif at.CallingResourceAddr != nil {\n\t\t\tai.InvokeActionTrigger.CallingResourceAddress = at.CallingResourceAddr.String()\n\t\t}\n\tdefault:\n\t\treturn ai, fmt.Errorf(\"unsupported action trigger type: %T\", at)\n\t}\n\n\tvar config []byte\n\tvar sensitive []byte\n\tvar unknown []byte\n\n\tif actionDec.ConfigValue != cty.NilVal {\n\t\tunmarkedValue, pvms := actionDec.ConfigValue.UnmarkDeepWithPaths()\n\t\tsensitivePaths, otherMarks := marks.PathsWithMark(pvms, marks.Sensitive)\n\t\tephemeralPaths, otherMarks := marks.PathsWithMark(otherMarks, marks.Ephemeral)\n\t\tif len(ephemeralPaths) > 0 {\n\t\t\treturn ai, fmt.Errorf(\"action %s has ephemeral config values, which are not supported in action invocations\", action.Addr)\n\t\t}\n\t\tif len(otherMarks) > 0 {\n\t\t\treturn ai, fmt.Errorf(\"action %s has config values with unsupported marks: %v\", action.Addr, otherMarks)\n\t\t}\n\n\t\tunknownValue := unknownAsBool(unmarkedValue)\n\t\tunknown, err = ctyjson.Marshal(unknownValue, unknownValue.Type())\n\t\tif err != nil {\n\t\t\treturn ai, err\n\t\t}\n\n\t\tconfigValue := omitUnknowns(unmarkedValue)\n\t\tconfig, err = ctyjson.Marshal(configValue, configValue.Type())\n\t\tif err != nil {\n\t\t\treturn ai, err\n\t\t}\n\n\t\tsensitivePaths = append(sensitivePaths, schema.ConfigSchema.SensitivePaths(unmarkedValue, nil)...)","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/jsonplan/action_invocations.go#L144-L180","documentation":"After unmarking the action's config value, the renderer separates sensitive, then ephemeral marks. If any ephemeral paths remain, it refuses to serialize: ephemeral (write-only, never-persisted) values cannot be represented in the JSON action invocation output, so emitting them would lose their protection guarantee.","triggerScenarios":"actionDec.ConfigValue is non-nil and contains at least one value carrying the marks.Ephemeral mark (len(ephemeralPaths) > 0 after marks.PathsWithMark). Occurs when an action config block references an ephemeral variable/resource or a write-only provider attribute.","commonSituations":"Referencing an ephemeral variable (e.g. ephemeral = true input variable) or an ephemeral resource inside a provider action block; using write-only attributes in a lifecycle action before the JSON renderer supported them.","solutions":["Remove the ephemeral reference from the action's config_values block so the value is wholly known and non-ephemeral.","Pass the sensitive-but-not-ephemeral form of the value if only secrecy is required.","Upgrade Terraform to a version whose jsonplan supports ephemeral action config if one exists for your case."],"exampleFix":"# before\naction \"restart\" {\n  config = {\n    token = ephemeral_resource.secret.token  # ephemeral -> error\n  }\n}\n\n# after: use a non-ephemeral value\nvariable \"token\" { type = string sensitive = true }\naction \"restart\" {\n  config = { token = var.token }","handlingStrategy":"validation","validationCode":"// Detect ephemeral marks in an action config before marshaling so you can\n// give a targeted message instead of failing inside MarshalActionInvocation.\nfor _, a := range plan.Changes.ActionInvocations {\n    sch := schemas.ActionTypeConfig(a.ProviderAddr.Provider, a.Addr.Action.Action.Type)\n    dec, err := a.Decode(&sch)\n    if err != nil || dec.ConfigValue == cty.NilVal {\n        continue\n    }\n    _, pvms := dec.ConfigValue.UnmarkDeepWithPaths()\n    eph, _ := marks.PathsWithMark(pvms, marks.Ephemeral)\n    if len(eph) > 0 {\n        return fmt.Errorf(\"action %s uses ephemeral config, unsupported in JSON plan\", a.Addr)\n    }\n}","typeGuard":null,"tryCatchPattern":"ai, err := jsonplan.MarshalActionInvocation(action, schemas)\nif err != nil && strings.Contains(err.Error(), \"ephemeral config values\") {\n    // guide the user to remove the ephemeral reference from the action block\n}\nreturn err","preventionTips":["Do not reference ephemeral resources/variables inside provider action config blocks.","Use sensitive (not ephemeral) variables when you only need secrecy that can be serialized.","Document which action attributes are write-only so authors avoid passing them into actions."],"tags":["actions","ephemeral","marks","sensitive"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}