avoid unknowns in OpenEphemeralResource

Ephemeral resources can't be opened if the configuration contains
unknown values.

internal/resources/ephemeral/ephemeral_resources.go

@@ -212,6 +212,11 @@ type resourceInstanceInternal struct {
 func (r *resourceInstanceInternal) close(ctx context.Context) tfdiags.Diagnostics {
 	var diags tfdiags.Diagnostics
 
+	// if the resource could not be opened, there will not be anything to close either
+	if r.impl == nil {
+		return diags
+	}
+
 	// Stop renewing, if indeed we are. If we previously saw any errors during
 	// renewing then they finally get returned here, to be reported along with
 	// any errors during close.

internal/terraform/node_resource_ephemeral.go

@@ -73,6 +73,27 @@ func ephemeralResourceOpen(ctx EvalContext, inp ephemeralResourceInput) (*provid
 	}
 	unmarkedConfigVal, configMarks := configVal.UnmarkDeepWithPaths()
 
+	if !unmarkedConfigVal.IsWhollyKnown() {
+		log.Printf("[DEBUG] ehpemeralResourceOpen: configuration for %s contains unknown values, cannot open resource", inp.addr)
+
+		// We don't know what the result will be, but we need to keep the
+		// configured attributes for consistent evaluation. We can use the same
+		// technique we used for data sources to create the plan-time value.
+		unknownResult := objchange.PlannedDataResourceObject(schema, unmarkedConfigVal)
+		// add back any configured marks
+		unknownResult = unknownResult.MarkWithPaths(configMarks)
+		// and mark the entire value as ephemeral, since it's coming from an ephemeral context.
+		unknownResult = unknownResult.Mark(marks.Ephemeral)
+
+		// The state of ephemerals all comes from the registered instances, so
+		// we still need to register something so evaluation doesn't fail.
+		ephemerals.RegisterInstance(ctx.StopCtx(), inp.addr, ephemeral.ResourceInstanceRegistration{
+			Value:      unknownResult,
+			ConfigBody: config.Config,
+		})
+		return nil, diags
+	}
+
 	validateResp := provider.ValidateEphemeralResourceConfig(providers.ValidateEphemeralResourceConfigRequest{
 		TypeName: inp.addr.Resource.Resource.Type,
 		Config:   unmarkedConfigVal,