Show referenced resource addresses for unknown values in plan output

Author: ritz-pCreated Sep 27, 2026Updated Sep 28, 2026

Labelsenhancementnew

Terraform Version

bash

### Terraform Version

Terraform v1.16.4

Use Cases

When reviewing a terraform plan, I want to know which Terraform resource an unknown argument refers to before approving the apply.

For example, a security group can be configured with vpc_id = aws_vpc.example.id. When the VPC is being created in the same plan, the security group's vpc_id is displayed as (known after apply). The AWS VPC ID cannot be known yet, but the Terraform reference aws_vpc.example.id is already known from the configuration.

Example configuration

main.tf

hcl

provider "aws" {
  region                      = "ap-northeast-1"
  access_key                  = "test"
  secret_key                  = "test"
  skip_credentials_validation = true
  skip_metadata_api_check     = true
  skip_requesting_account_id  = true
  endpoints {
    ec2 = "http://kumo:4566"
  }
}
resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
  tags = {
    Name = "plan-reference-example"
  }
}
resource "aws_security_group" "example" {
  name        = "plan-reference-example"
  description = "Demonstrates an unknown value from a resource reference"
  vpc_id      = aws_vpc.example.id

  tags = {
    Name = "plan-reference-example"
  }
}

versions.tf

hcl

terraform {
  required_version = "= 1.16.4"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "= 6.66.0"
    }
  }
}

terraform plan output

bash

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_security_group.example will be created
  + resource "aws_security_group" "example" {
      + arn                    = (known after apply)
      + description            = "Demonstrates an unknown value from a resource reference"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "plan-reference-example"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + region                 = "ap-northeast-1"
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "plan-reference-example"
        }
      + tags_all               = {
          + "Name" = "plan-reference-example"
        }
      + vpc_id                 = (known after apply)
    }

  # aws_vpc.example will be created
  + resource "aws_vpc" "example" {
      + arn                                  = (known after apply)
      + cidr_block                           = "10.0.0.0/16"
      + default_network_acl_id               = (known after apply)
      + default_route_table_id               = (known after apply)
      + default_security_group_id            = (known after apply)
      + dhcp_options_id                      = (known after apply)
      + enable_dns_hostnames                 = (known after apply)
      + enable_dns_support                   = true
      + enable_network_address_usage_metrics = (known after apply)
      + id                                   = (known after apply)
      + instance_tenancy                     = "default"
      + ipv6_association_id                  = (known after apply)
      + ipv6_cidr_block                      = (known after apply)
      + ipv6_cidr_block_network_border_group = (known after apply)
      + main_route_table_id                  = (known after apply)
      + owner_id                             = (known after apply)
      + region                               = "ap-northeast-1"
      + tags                                 = {
          + "Name" = "plan-reference-example"
        }
      + tags_all                             = {
          + "Name" = "plan-reference-example"
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

This VPC example is intentionally simple. In a large plan with many resources, however, seeing only (known after apply) makes it difficult to tell which resource an argument refers to. I would like the plan itself to show that reference so it can be reviewed without tracing it through the configuration.

Attempted Solutions

I ran terraform plan with the configuration shown above. The security group's vpc_id appeared as (known after apply), without indicating that its value comes from aws_vpc.example.id.

I can find the reference by inspecting the Terraform configuration, but I could not find an existing option to display it in the human-readable plan output. I have not tried another workaround.

Proposal

For arguments whose value is unknown because they reference another Terraform resource, show the source reference in plan output.

Current output:

bash

+ vpc_id = (known after apply)

Proposed output (example):

bash

+ vpc_id = (known after apply; from aws_vpc.example.id)

References

#30826

Source: hashicorp/terraform

View original on GitHub View discussion on GitHub