bug(terraform): false positive of "CloudWatch Without Retention Period Specified"

[stevebosman]

When retention-in-days is set using a variable (in my case a map) I get the warning "CloudWatch Without Retention Period Specified"

Expected Behavior

No warning as retention period is set to a valid value

Actual Behavior

Warning "CloudWatch Without Retention Period Specified"

Steps to Reproduce the Problem

variable "cloudwatch_log_retention_period" {
  description = "Cloudwatch log retention period in days"
  type        = map(string)
  default    = {
    feature    = 1
    dev        = 5
    test       = 5
    stage      = 30
    production = 90
  }
}

locals {
  environment = "dev"
}

resource "aws_cloudwatch_log_group" "negative2" {
  name = "Yada"

  tags = {
    Environment = "production"
    Application = "serviceA"
  }

  retention_in_days = var.cloudwatch_log_retention_period[local.environment]
}

Specifications

N/A

[stevebosman]

I don't know if this will help, but from my terraform logs the plan is:

Terraform will perform the following actions:
  # aws_cloudwatch_log_group.negative2 will be created
  + resource "aws_cloudwatch_log_group" "negative2" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "Yada"
      + name_prefix       = (known after apply)
      + retention_in_days = 5
      + skip_destroy      = false
      + tags              = {
          + "Application" = "serviceA"
          + "Environment" = "production"
        }
      + tags_all          = {
          + "Application" = "serviceA"
          + "Environment" = "production"
        }
    }
Plan: 1 to add, 0 to change, 0 to destroy.

The generated plan

{
  "format_version": "1.2",
  "terraform_version": "1.9.5",
  "variables": {
    "cloudwatch_log_retention_period": {
      "value": {
        "dev": "5",
        "feature": "1",
        "production": "90",
        "stage": "30",
        "test": "5"
      }
    }
  },
  "planned_values": {
    "root_module": {
      "resources": [
        {
          "address": "aws_cloudwatch_log_group.negative2",
          "mode": "managed",
          "type": "aws_cloudwatch_log_group",
          "name": "negative2",
          "provider_name": "registry.terraform.io/hashicorp/aws",
          "schema_version": 0,
          "values": {
            "kms_key_id": null,
            "name": "Yada",
            "retention_in_days": 5,
            "skip_destroy": false,
            "tags": {
              "Application": "serviceA",
              "Environment": "production"
            },
            "tags_all": {
              "Application": "serviceA",
              "Environment": "production"
            }
          },
          "sensitive_values": {
            "tags": {},
            "tags_all": {}
          }
        }
      ]
    }
  },
  "resource_changes": [
    {
      "address": "aws_cloudwatch_log_group.negative2",
      "mode": "managed",
      "type": "aws_cloudwatch_log_group",
      "name": "negative2",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": [
          "create"
        ],
        "before": null,
        "after": {
          "kms_key_id": null,
          "name": "Yada",
          "retention_in_days": 5,
          "skip_destroy": false,
          "tags": {
            "Application": "serviceA",
            "Environment": "production"
          },
          "tags_all": {
            "Application": "serviceA",
            "Environment": "production"
          }
        },
        "after_unknown": {
          "arn": true,
          "id": true,
          "log_group_class": true,
          "name_prefix": true,
          "tags": {},
          "tags_all": {}
        },
        "before_sensitive": false,
        "after_sensitive": {
          "tags": {},
          "tags_all": {}
        }
      }
    }
  ],
  "configuration": {
    "provider_config": {
      "aws": {
        "name": "aws",
        "full_name": "registry.terraform.io/hashicorp/aws",
        "version_constraint": "5.66.0",
        "expressions": {
          "region": {
            "constant_value": "eu-west-2"
          }
        }
      }
    },
    "root_module": {
      "resources": [
        {
          "address": "aws_cloudwatch_log_group.negative2",
          "mode": "managed",
          "type": "aws_cloudwatch_log_group",
          "name": "negative2",
          "provider_config_key": "aws",
          "expressions": {
            "name": {
              "constant_value": "Yada"
            },
            "retention_in_days": {
              "references": [
                "var.cloudwatch_log_retention_period",
                "local.environment"
              ]
            },
            "tags": {
              "constant_value": {
                "Application": "serviceA",
                "Environment": "production"
              }
            }
          },
          "schema_version": 0
        }
      ],
      "variables": {
        "cloudwatch_log_retention_period": {
          "default": {
            "dev": "5",
            "feature": "1",
            "production": "90",
            "stage": "30",
            "test": "5"
          },
          "description": "Cloudwatch log retention period in days"
        }
      }
    }
  },
  "timestamp": "2024-09-13T07:47:38Z",
  "applyable": true,
  "complete": true,
  "errored": false
}