Combining locals and variables

I try to use a local inside the definition of a variable but it does not seems to work, do you know why or how to do it ?

The goal behind that is it keep the possibilty for user to override default value with it's own without editing the tf file

locals {
  project_id = {
    dev   = "dev01-a7"
    prod  = "prd01-b2"
  }
}

variable "project_id" {
    default = local.project_id[terraform.workspace]
}

provider "google" {
  project = var.project_id
  region  = var.region
  credentials = "xx.json"
}

Error :

│ Error: Variables not allowed
│
│   on main.tf line 13, in variable "project_id":
│   13:     default = local.project_id[terraform.workspace]
│
│ Variables may not be used here.
╵
╷
│ Error: Variables not allowed
│
│   on main.tf line 13, in variable "project_id":
│   13:     default = local.project_id[terraform.workspace]
│
│ Variables may not be used here.

That cannot be done the way you are trying, but you can use a similar way of referencing the correct profile:

locals {
  project_id = {
    dev   = "dev01-a7"
    prod  = "prd01-b2"
  }
}

provider "google" {
  project     = local.project_id[terraform.workspace]
  region      = var.region
  credentials = "xx.json"
}

The default value for an input variable must always be something that the caller of the module could have written in their own module block; it cannot be built from information inside the child module that the caller of the module would not be able to refer to.

However, default values aren't the only way to provide a fallback when something isn't set. You can use expressions within your module to describe to Terraform what behavior you intend when the variable is set vs. not set. For example:

variable "project_id" {
  type = string

  # This makes the variable optional without
  # specifying an explicit default.
  default = null
}

locals {
  default_project_ids = tomap({
    dev  = "dev01-a7"
    prod = "prd01-b2"
  })

  project_id = coalesce(
    var.project_id,
    local.default_project_ids[terraform.workspace],
  )
}

provider "google" {
  project     = local.project_id
  region      = var.region
  credentials = "xx.json"
}

The important parts of the above:

• The variable's default value is null, which means that it's optional but it doesn't have an explicit default that's visible to the user of the module, and var.project_id will be null when the variable isn't set.
• The local value project_id uses coalesce to choose the first of its arguments that isn't null. This means that if var.project_id is set then local.project_id will be exactly that value, while if it isn't set then Terraform will use the appropriate entry from local.default_project_ids as a fallback.
• The provider "google" block's project argument now refers to local.project_id instead of var.project_id, so it can benefit from the fallback to the default.

Note that using terraform.workspace in a child module rather than a root module is a bit of a maintainability hazard, because workspaces conceptually belong to each root module separately and so relying directly on workspace names in a shared module will make it impossible to reuse that module from a different root module that has a different naming scheme for its workspaces.

If that isn't a concern for your situation then what you did with terraform.workspace is valid and will work, but if you want to employ a stronger separation of concerns then I'd suggest a variant where the caller passes in an environment name and it's up to the caller to decide how it will determine that:

variable "environment" {
  type = string

  validation {
    condition     = contains(["dev", "prod"], var.environment)
    error_message = "Must be \"dev\" or \"prod\"."
  }
}

# ...

locals {
  default_project_ids = tomap({
    dev  = "dev01-a7"
    prod = "prd01-b2"
  })

  project_id = coalesce(
    var.project_id,
    local.default_project_ids[var.environment],
  )
}

# ...

Then the caller of the module can be the one to decide that it will use its workspaces as the determinant for the environment name:

module "example" {
  # ...

  environment = terraform.workspace
}