1# Terraform Validation Errors
2 
3| Error | Fix |
4|-------|-----|
5| `Backend init failed` | Check storage account access |
6| `Provider version conflict` | Update required_providers |
7| `State lock failed` | Wait or force unlock |
8| `Validation failed` | Check terraform validate output |
9| `Error: Cycle:` | See [Cycle Errors](#cycle-errors) below |
10 
11## Cycle Errors
12 
13`terraform validate` reports a cycle when two or more resources reference each other's attributes, creating a circular dependency.
14 
15### Common Pattern: CORS Cross-Reference
16 
17Multi-service App Service deployments often introduce a cycle when the API's CORS configuration references the frontend hostname and the frontend's app settings reference the API hostname:
18 
19```
20Error: Cycle: azurerm_linux_web_app.frontend, azurerm_linux_web_app.api
21```
22 
23**Cause — circular attribute references:**
24 
25```hcl
26# API references frontend.default_hostname in CORS
27resource "azurerm_linux_web_app" "api" {
28  site_config {
29    cors {
30      allowed_origins = ["https://${azurerm_linux_web_app.frontend.default_hostname}"]
31    }
32  }
33}
34 
35# Frontend references api.default_hostname in app_settings
36resource "azurerm_linux_web_app" "frontend" {
37  app_settings = {
38    API_URL = "https://${azurerm_linux_web_app.api.default_hostname}"
39  }
40}
41```
42 
43### Fix Strategies
44 
45**Option A (recommended):** Use a Terraform variable for the frontend origin so CORS is restrictive by default and the cycle is broken. Define the variable with a sensible default and pass the real frontend URL after the first deployment:
46 
47```hcl
48variable "frontend_origin" {
49  type        = string
50  description = "Frontend origin for API CORS. Set after first deployment."
51  default     = ""
52}
53 
54resource "azurerm_linux_web_app" "api" {
55  site_config {
56    cors {
57      allowed_origins     = var.frontend_origin != "" ? [var.frontend_origin] : ["*"]
58      support_credentials = var.frontend_origin != "" ? true : false
59    }
60  }
61}
62```
63 
64> ⚠️ **Warning:** If using `["*"]` as a temporary bootstrap value, you **must** set `frontend_origin` to the actual URL (e.g., `https://app-web-*.azurewebsites.net`) and re-run `terraform apply` in the same deployment session before reporting success. Do not leave wildcard CORS in a completed deployment.
65 
66**Option B:** Use `azurerm_app_service_custom_hostname_binding` or a `null_resource` with a `local-exec` provisioner to configure CORS after both resources are created, breaking the dependency chain.
67 
68**Option C:** Use `lifecycle { ignore_changes = [site_config[0].cors] }` on the API resource and configure CORS via a separate `azurerm_web_app_active_slot` or post-deployment script.
69 
70### After Fixing
71 
721. Run `terraform fmt -recursive` to fix formatting
732. Re-run `terraform validate` to confirm the cycle is resolved
743. Run `terraform plan` to verify the configuration is correct
75 
76## Debug
77 
78```bash
79TF_LOG=DEBUG terraform plan
80```
81