Terraform aws_ssm_parameter null/empty with ignore_changes

Question

I have a Terraform config that looks like this:

resource "random_string" "foo" {
  length = 31
  special = false
}

resource "aws_ssm_parameter" "bar" {
  name = "baz"
  type = "SecureString"
  value = random_string.foo.result
  lifecycle {
    ignore_changes = [value]
  }
}

The idea is that on the first terraform apply the bar resource will be stored in baz in SSM based on the value of foo, and then on subsequent calls to apply I'll be able to reference aws_ssm_parameter.bar.value, however what I see is that it works on the first run, stores the newly created random value, and then on subsequent runs aws_ssm_parameter.bar.value is empty.

If I create a aws_ssm_parameter data source that can pull the value correctly, but it doesn't work on the first apply when it doesn't exist yet. How can I modify this config so I can get the value stored in baz in SSM and work for creating the value in the same config?

Answer 1

Oh, I forgot about this question, but turns out I did figure out the problem.

The issue was that I was creating the ssm parameter inside a module that was being used in another module. The problem was because I didn't output anything related to this parameter, so it seemed to get dropped from state by Terraform on subsequent replans after it was created. Exposing it as output on the module fixed the issue.