mediumIntermediateSymptom-first#shell#quoting#expansion#variable

Shell expansion broken by quoting — comma/asterisk in values

Terraform variable value contains unexpected commas or spaces

Likely source:configuration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Terraform variable value contains unexpected commas or spaces
  • Shell globbing expands asterisks in -var values
  • terraform apply passes corrupted values due to shell quoting

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Variable value in plan

    terraform plan 2>&1 | grep -i 'comma\|asterisk\|shell' | head -5

  • Shell quoting in CI script

    grep -n 'terraform.*-var' .github/workflows/*.yml 2>/dev/null

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • terraform apply -var "list=a,b,c" — shell does not expand commas, but asterisks do
  • terraform apply -var "pattern=*.txt" — shell expands the glob

Confirm before fixing

terraform console -e 'var.list'
READ

Check the received value

Fix

terraform apply -var 'list=a,b,c'
CHANGE

Use single quotes to prevent shell expansion

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
terraform console -e 'var.<NAME>'
READ

Check the received variable value

2
echo 'value with, commas and * asterisks'
READ

Test single-quote protection

3
terraform apply -var '<NAME>=<VALUE>'
CHANGE

Apply with properly quoted values

4
terraform plan
READ

Verify the plan reflects the correct values

Prevention

  • Use single quotes for -var values containing special characters.
  • Use -var-file for complex values to avoid shell quoting entirely.
  • Use heredocs in CI scripts to pass multi-line variable values.
  • Test variable values in terraform console before applying.

Related runbooks

Same stack, same failure family — worth a skim.

Unsupported argument — typo or misplaced attributemedium

An argument named "instance_typo" is not expected here

TerraformFoundation2 causes
Open runbook
Invalid for_each — must be a map, set, or objectmedium

The given "for_each" argument value is unsuitable: must be a map, or set of strings

TerraformIntermediate2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.