A module takes variable settings of type object({ name = string, retention_days = number, encrypted = bool }). Callers must be able to pass only name, with retention_days defaulting to 30 and encrypted defaulting to true. How should the type constraint change?
Select an answer to reveal the explanation.
Short Explanation
An object type is a form with required boxes; optional() is how you mark a box as not required and pre-fill it. A variable default doesn't do that, because it only kicks in when the caller passes nothing at all. That's the trap: a default is all-or-nothing, not per attribute.
Full Explanation
Object type constraints normally require every declared attribute, and Terraform rejects a caller's value that omits one during type conversion. The optional() modifier marks an attribute as omittable and, with its second argument, supplies the value Terraform inserts when the caller leaves it out, so object({ name = string, retention_days = optional(number, 30), encrypted = optional(bool, true) }) accepts { name = "logs" } and yields the full object. A variable default is used only when the caller provides no value at all; once a caller passes an object, the default is ignored entirely rather than merged, and the missing attributes still fail conversion. nullable controls whether a caller may pass null for the whole variable; it does not make individual attributes optional. lookup() cannot help because the value never reaches the module body: type conversion fails at the module boundary before any expression evaluates. Exam caveat: optional attribute defaults apply during conversion and also work on nested objects, which makes them the standard way to build forgiving module interfaces. Operational check: call the module with only name, then run terraform console in the module context or add a temporary output to confirm retention_days is 30 and encrypted is true.