From c6202df069c24bcf66e9a25e0ea9eaef1e1deb0b Mon Sep 17 00:00:00 2001
From: James Bardin <j.bardin@gmail.com>
Date: Mon, 19 Aug 2024 11:43:19 -0400
Subject: [PATCH] removed from targets can be within a nested module

Update AttachResourceConfigTransformer to account for resource targets
within nested modules.
---
 internal/terraform/context_apply_test.go      |  4 +-
 .../apply-provisioner-destroy-removed/main.tf |  2 +-
 .../transform_attach_config_resource.go       | 43 ++++++++++---------
 3 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/internal/terraform/context_apply_test.go b/internal/terraform/context_apply_test.go
index a8b2cc15e3..db62dcda3b 100644
--- a/internal/terraform/context_apply_test.go
+++ b/internal/terraform/context_apply_test.go
@@ -4924,8 +4924,8 @@ func TestContext2Apply_provisionerDestroyRemoved(t *testing.T) {
 	}
 
 	state := states.NewState()
-	root := state.RootModule()
-	root.SetResourceInstanceCurrent(
+	foo := state.EnsureModule(mustModuleInstance("module.foo"))
+	foo.SetResourceInstanceCurrent(
 		mustResourceInstanceAddr(`aws_instance.foo["a"]`).Resource,
 		&states.ResourceInstanceObjectSrc{
 			Status:    states.ObjectReady,
diff --git a/internal/terraform/testdata/apply-provisioner-destroy-removed/main.tf b/internal/terraform/testdata/apply-provisioner-destroy-removed/main.tf
index 541fce3040..c3a793c39b 100644
--- a/internal/terraform/testdata/apply-provisioner-destroy-removed/main.tf
+++ b/internal/terraform/testdata/apply-provisioner-destroy-removed/main.tf
@@ -1,5 +1,5 @@
 removed {
-  from = aws_instance.foo
+  from = module.foo.aws_instance.foo
 
   provisioner "shell" {
     when     = "destroy"
diff --git a/internal/terraform/transform_attach_config_resource.go b/internal/terraform/transform_attach_config_resource.go
index fd0fb5e570..9ef259f0e8 100644
--- a/internal/terraform/transform_attach_config_resource.go
+++ b/internal/terraform/transform_attach_config_resource.go
@@ -34,6 +34,22 @@ type AttachResourceConfigTransformer struct {
 }
 
 func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
+	// Collect removed blocks to attach to any resources. These are collected
+	// independently because removed blocks may live in a parent module of the
+	// resource referenced.
+	removed := addrs.MakeMap[addrs.ConfigResource, *configs.Removed]()
+
+	t.Config.DeepEach(func(c *configs.Config) {
+		for _, rem := range c.Module.Removed {
+			resAddr, ok := rem.From.RelSubject.(addrs.ConfigResource)
+			if !ok {
+				// Not for a resource at all, so can't possibly match.
+				// Non-resource removed targets have nothing to attach.
+				continue
+			}
+			removed.Put(resAddr, rem)
+		}
+	})
 
 	// Go through and find GraphNodeAttachResource
 	for _, v := range g.Vertices() {
@@ -46,6 +62,12 @@ func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
 		// Determine what we're looking for
 		addr := arn.ResourceAddr()
 
+		// Check for a removed block first, since that would preclude any resource config.
+		if remCfg, ok := removed.GetOk(addr); ok {
+			log.Printf("[TRACE] AttachResourceConfigTransformer: attaching to %q (%T) removed block from %#v", dag.VertexName(v), v, remCfg.DeclRange)
+			arn.AttachResourceConfig(nil, remCfg)
+		}
+
 		// Get the configuration.
 		config := t.Config.Descendent(addr.Module)
 
@@ -66,27 +88,6 @@ func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
 				}
 			}
 		}
-
-		for _, r := range config.Module.Removed {
-			crAddr, ok := r.From.RelSubject.(addrs.ConfigResource)
-			if !ok {
-				// Not for a resource at all, so can't possibly match
-				continue
-			}
-			rAddr := crAddr.Resource
-			if rAddr != addr.Resource {
-				// Not the same resource
-				continue
-			}
-
-			log.Printf("[TRACE] AttachResourceConfigTransformer: attaching to %q (%T) removed block from %#v", dag.VertexName(v), v, r.DeclRange)
-
-			// Validation ensures that there can't be both a resource/data block
-			// and a removed block referring to the same configuration, so
-			// we can assume that this isn't clobbering a non-removed resource
-			// configuration we already attached above.
-			arn.AttachResourceConfig(nil, r)
-		}
 	}
 
 	return nil