What causes "%s%s: cannot set both Computed and Required" in hashicorp/terraform?

If the provider supplies the value, drop Required and keep Computed (optionally add Optional for user override).

%s%s: cannot set both Computed and Required

Error message

%s%s: cannot set both Computed and Required

What it means

Raised when an Attribute has both Computed and Required set. Required forces the user to supply a value; Computed means the provider supplies it. The two are logically incompatible because the value cannot be both user-mandatory and provider-derived. The validator at internal_validate.go:152 rejects the combination.

Source

Thrown at internal/configs/configschema/internal_validate.go:153

	return a.internalValidate(name, "")
}

func (a *Attribute) internalValidate(name, prefix string) error {
	var err error

	/* FIXME: this validation breaks certain existing providers and cannot be enforced without coordination.
	if !validName.MatchString(name) {
		err = errors.Join(err, fmt.Errorf("%s%s: name may contain only lowercase letters, digits and underscores", prefix, name))
	}
	*/
	if !a.Optional && !a.Required && !a.Computed {
		err = errors.Join(err, fmt.Errorf("%s%s: must set Optional, Required or Computed", prefix, name))
	}
	if a.Optional && a.Required {
		err = errors.Join(err, fmt.Errorf("%s%s: cannot set both Optional and Required", prefix, name))
	}
	if a.Computed && a.Required {
		err = errors.Join(err, fmt.Errorf("%s%s: cannot set both Computed and Required", prefix, name))
	}
	if !a.Deprecated && a.DeprecationMessage != "" {
		err = errors.Join(err, fmt.Errorf("%s%s: DeprecationMessage must not be set when Deprecated is false", prefix, name))
	}

	if a.Type == cty.NilType && a.NestedType == nil {
		err = errors.Join(err, fmt.Errorf("%s%s: either Type or NestedType must be defined", prefix, name))
	}

	if a.Type != cty.NilType {
		if a.NestedType != nil {
			err = errors.Join(fmt.Errorf("%s: Type and NestedType cannot both be set", name))
		}
	}

	if a.NestedType != nil {
		switch a.NestedType.Nesting {
		case NestingSingle, NestingMap, NestingGroup:

View on GitHub (pinned to c9def3e214)

Solutions

If the provider supplies the value, drop Required and keep Computed (optionally add Optional for user override).
If the user must supply the value, drop Computed and keep Required.
For 'provider default the user may override', use Optional+Computed, never Required+Computed.

Example fix

// before
"id": {Type: cty.String, Required: true, Computed: true}

// after
"id": {Type: cty.String, Optional: true, Computed: true}

Defensive patterns

Strategy: validation

Validate before calling

func assertNotComputedAndRequired(a *configschema.Attribute) error {
    if a.Computed && a.Required {
        return fmt.Errorf("cannot set both Computed and Required")
    }
    return nil
}

Type guard

func isNotComputedRequired(a *configschema.Attribute) bool {
    return !(a.Computed && a.Required)
}

Prevention

Required means user-must-supply; Computed means provider-supplies — they cannot coexist.
For provider-overridable values use Optional+Computed.
Add a linter rule rejecting Computed && Required on attributes.

When it happens

Trigger: An Attribute struct literal with Computed: true and Required: true. internalValidate reaches line 152 and the condition holds.

Common situations: Marking a field Computed to surface provider defaults while leaving an old Required flag; merging schemas where one side set Required and the other set Computed; misunderstanding Computed as 'has a default'.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/26e49e9077e30a1c. Report an issue: GitHub.