Another reason not to try

CURSED_KNOWLEDGE.md

@@ -4,6 +4,7 @@
 
 | date       | item                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 |------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 2025-11-06 | Result of `try(local.partially_known_after_apply, [])` is `<something fully known after apply>`. Using `local.partially_known_after_apply == null ? [] : local.partially_known_after_apply` will preserve that variable is partially known. This is important for resource `for_each` using maps, where keys needs to be known during plan, `try(...)` will make the whole map known after apply and this errors out                                                                                                                                                                                                                        |
 | 2025-10-23 | Some [service agents](https://cloud.google.com/iam/docs/service-agents) are not created upon API activation nor calling `google_project_service_identity`. Since we have no way of knowing if they exist, we avoid automatically granting their respective roles in the project module. The list of agents for which we do not perform automatic grants can be found in the [tools/build_service_agents.py](./tools/build_service_agents.py) script.                                                                                                                                                                                        |
 | 2025-10-23 | Use `terraform plan` after `terraform apply` to confirm that the plan is empty after applying the changes. Non-empty plan is a sign of potential bug in either Terraform code or provider and suggests, that configuration might not have been applied as expected or potential problems when implementing future changes                                                                                                                                                                                                                                                                                                                   |                                                                       |
 | 2025-10-23 | Do not use `data` resource. Even if you must, then still it might be [a bad idea](#avoid-data-resources)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |