{"record":{"id":"9ac692b1c70528f5","repo":"hashicorp/terraform","slug":"s-s-nestingset-attributes-may-not-contain-writeo","errorCode":null,"errorMessage":"%s%s: NestingSet attributes may not contain WriteOnly attributes","messagePattern":"(.+?)(.+?): NestingSet attributes may not contain WriteOnly attributes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configs/configschema/internal_validate.go","lineNumber":186,"sourceCode":"\n\tif a.NestedType != nil {\n\t\tswitch a.NestedType.Nesting {\n\t\tcase NestingSingle, NestingMap, NestingGroup:\n\t\t\t// no validations to perform\n\t\tcase NestingList, NestingSet:\n\t\t\tif a.NestedType.Nesting == NestingSet {\n\t\t\t\tety := a.ImpliedType()\n\t\t\t\tif ety.HasDynamicTypes() {\n\t\t\t\t\t// This is not permitted because the HCL (cty) set implementation\n\t\t\t\t\t// needs to know the exact type of set elements in order to\n\t\t\t\t\t// properly hash them, and so can't support mixed types.\n\t\t\t\t\terr = errors.Join(err, fmt.Errorf(\"%s%s: NestingSet attributes may not contain attributes of cty.DynamicPseudoType\", prefix, name))\n\t\t\t\t}\n\t\t\t\tif a.NestedType.ContainsWriteOnly() {\n\t\t\t\t\t// This is not permitted because any marks within sets will\n\t\t\t\t\t// be hoisted up the outer set value, so only the set itself\n\t\t\t\t\t// can be WriteOnly.\n\t\t\t\t\terr = errors.Join(err, fmt.Errorf(\"%s%s: NestingSet attributes may not contain WriteOnly attributes\", prefix, name))\n\t\t\t\t}\n\t\t\t}\n\t\tdefault:\n\t\t\terr = errors.Join(err, fmt.Errorf(\"%s%s: invalid nesting mode %s\", prefix, name, a.NestedType.Nesting))\n\t\t}\n\t\tfor name, attrS := range a.NestedType.Attributes {\n\t\t\tif attrS == nil {\n\t\t\t\terr = errors.Join(err, fmt.Errorf(\"%s%s: attribute schema is nil\", prefix, name))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\terr = errors.Join(err, attrS.internalValidate(name, prefix))\n\t\t}\n\t}\n\n\treturn err\n}\n\nfunc (o *Object) InternalValidate() error {","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/configs/configschema/internal_validate.go#L168-L204","documentation":"Raised when an Attribute whose NestedType uses NestingSet transitively contains a WriteOnly attribute. cty hoists WriteOnly marks up to the enclosing set value, so inner per-element WriteOnly flags would be silently lost; only the set-level attribute itself may be WriteOnly. The validator at internal_validate.go:182 calls a.NestedType.ContainsWriteOnly() and rejects the schema.","triggerScenarios":"An Attribute with NestedType.Nesting == NestingSet where any nested Attribute has WriteOnly: true. The NestingSet branch at line 174 reaches line 182 and ContainsWriteOnly() returns true.","commonSituations":"Modeling a set of ephemeral credential objects (e.g. a deduped set of API keys) where each element has a WriteOnly secret; converting a NestedType list to a set while keeping inner WriteOnly flags; schema generators marking all secret-looking fields WriteOnly.","solutions":["Switch NestedType.Nesting to NestingList, which permits inner WriteOnly attributes.","Move the WriteOnly flag from the inner attribute to the outer set attribute so the whole set is ephemeral.","Remove WriteOnly if the data is persisted in state."],"exampleFix":"// before\n\"peers\": {\n    Optional: true,\n    NestedType: &Object{\n        Nesting: NestingSet,\n        Attributes: map[string]*Attribute{\"token\": {Type: cty.String, Optional: true, WriteOnly: true}},\n    },\n}\n\n// after\n\"peers\": {\n    Optional: true,\n    NestedType: &Object{\n        Nesting: NestingList,\n        Attributes: map[string]*Attribute{\"token\": {Type: cty.String, Optional: true, WriteOnly: true}},\n    },\n}","handlingStrategy":"validation","validationCode":"func assertNestedSetNoWriteOnly(a *configschema.Attribute) error {\n    if a.NestedType == nil || a.NestedType.Nesting != configschema.NestingSet { return nil }\n    if a.NestedType.ContainsWriteOnly() {\n        return fmt.Errorf(\"NestingSet attribute may not contain WriteOnly attributes\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Place WriteOnly only on the outer set attribute, never on inner elements.","Use NestingList when individual elements must be ephemeral.","Audit secret fields whenever converting a NestedType list to a set."],"tags":["configschema","attribute","nestedtype","nesting-set","write-only","sensitive","validation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}