%s%s: NestingSet blocks may not contain attributes of cty.Dy

Error message

%s%s: NestingSet blocks may not contain attributes of cty.DynamicPseudoType

What it means

Raised when a NestingSet block's implied type contains cty.DynamicPseudoType anywhere in its structure. cty sets require a concrete, hashable element type to compute set membership; DynamicPseudoType defers typing until value time, so set elements could not be reliably hashed. The validator calls blockS.Block.ImpliedType().HasDynamicTypes() at internal_validate.go:94 and rejects the schema outright.

Source

Thrown at internal/configs/configschema/internal_validate.go:98

			}
		case NestingGroup:
			if blockS.MinItems != 0 || blockS.MaxItems != 0 {
				multiErr = errors.Join(multiErr, fmt.Errorf("%s%s: MinItems and MaxItems cannot be used in NestingGroup mode", prefix, name))
			}
			if blockS.Computed {
				multiErr = errors.Join(multiErr, fmt.Errorf("%s%s: NestingGroup blocks cannot be computed", prefix, name))
			}
		case NestingList, NestingSet:
			if blockS.MinItems > blockS.MaxItems && blockS.MaxItems != 0 {
				multiErr = errors.Join(multiErr, fmt.Errorf("%s%s: MinItems must be less than or equal to MaxItems in %s mode", prefix, name, blockS.Nesting))
			}
			if blockS.Nesting == NestingSet {
				ety := blockS.Block.ImpliedType()
				if ety.HasDynamicTypes() {
					// This is not permitted because the HCL (cty) set implementation
					// needs to know the exact type of set elements in order to
					// properly hash them, and so can't support mixed types.
					multiErr = errors.Join(multiErr, fmt.Errorf("%s%s: NestingSet blocks may not contain attributes of cty.DynamicPseudoType", prefix, name))
				}
				if blockS.Block.ContainsWriteOnly() {
					// This is not permitted because any marks within sets will
					// be hoisted up the outer set value, so only the set itself
					// can be WriteOnly.
					multiErr = errors.Join(multiErr, fmt.Errorf("%s%s: NestingSet blocks may not contain WriteOnly attributes", prefix, name))
				}
			}
			if blockS.MinItems > 0 && blockS.Computed {
				multiErr = errors.Join(multiErr, fmt.Errorf("%s%s: Computed cannot be used when MinItems > 0", prefix, name))
			}
		case NestingMap:
			if blockS.MinItems != 0 || blockS.MaxItems != 0 {
				multiErr = errors.Join(multiErr, fmt.Errorf("%s%s: MinItems and MaxItems must both be 0 in NestingMap mode", prefix, name))
			}
			if blockS.MinItems > 0 && blockS.Computed {
				multiErr = errors.Join(multiErr, fmt.Errorf("%s%s: Computed cannot be used when MinItems > 0", prefix, name))
			}

View on GitHub (pinned to c9def3e214)

Solutions

Switch the block back to NestingList if dynamic-typed elements are genuinely required.
Constrain the dynamic attribute to a concrete type (e.g. cty.String, cty.Map(cty.String)) so set elements are hashable.
If arbitrary key/value data is needed, model it as a map attribute (cty.Map) rather than a set of dynamic objects.

Example fix

// before
BlockTypes: map[string]*NestedBlock{
    "item": {Nesting: NestingSet, Block: Block{Attributes: map[string]*Attribute{
        "data": {Type: cty.DynamicPseudoType, Optional: true},
    }}},
}

// after
BlockTypes: map[string]*NestedBlock{
    "item": {Nesting: NestingSet, Block: Block{Attributes: map[string]*Attribute{
        "data": {Type: cty.Map(cty.String), Optional: true},
    }}},
}

Defensive patterns

Strategy: validation

Validate before calling

func assertSetBlockNotDynamic(nb *configschema.NestedBlock) error {
    if nb.Nesting != configschema.NestingSet { return nil }
    if nb.Block.ImpliedType().HasDynamicTypes() {
        return fmt.Errorf("NestingSet block may not contain cty.DynamicPseudoType")
    }
    return nil
}

Prevention

Never use cty.DynamicPseudoType inside a set; sets need concrete hashable element types.
Prefer cty.Map(cty.String) or a concrete object type for arbitrary key/value data in a set.
Switch to NestingList if dynamic typing is genuinely required.

When it happens

Trigger: A NestedBlock with Nesting=NestingSet whose Block (or any descendant attribute) has Type=cty.DynamicPseudoType, or a nested attribute whose NestedType ultimately resolves to a dynamic type. The NestingSet branch at line 92 computes ety and HasDynamicTypes() returns true at line 94.

Common situations: Porting a NestingList block to NestingSet to dedupe entries while the element schema still allows arbitrary JSON (dynamic); using a generic 'tags' or 'metadata' attribute of type cty.DynamicPseudoType inside a set; framework-generated schemas that default unknown fields to dynamic.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/f292515c2ea29041. Report an issue: GitHub.