title: Separate structure for variables.tf gets "Object, known only after apply"
body: <p>I have recently separated terraform files from it's variable file as per below structure</p>
  <pre><code>(root)
  | main.tf
  | users.tf
  | roles.tf
  ├── Configuration (folder)
  ├──── azure-pipelines.yml
  ├──── .gitignore
  ├──── variables.tf
  </code></pre>
  <p>and since then I am getting bellow error messages</p>
  <pre><code>│ Error: Unsupported attribute
  │ 
  │   on main.tf line 77, in resource &quot;azurerm_key_vault_secret&quot; &quot;primary_account_storage_access_key&quot;:
  │   77:   name         = &quot;${module.variables.storage-account_name}-access-key&quot;
  │     ├────────────────
  │     │ module.variables is a object, known only after apply
  │ 
  │ This object does not have an attribute named &quot;storage-account_name&quot;.
  ╵
  ╷
  │ Error: Unsupported attribute
  │ 
  │   on main.tf line 78, in resource &quot;azurerm_key_vault_secret&quot; &quot;primary_account_storage_access_key&quot;:
  │   78:   value        = module.variables.storage-access_key
  │     ├────────────────
  │     │ module.variables is a object, known only after apply
  │ 
  │ This object does not have an attribute named &quot;storage-access_key&quot;.
  ╵
  </code></pre>
  <p>This is how problematic resource <code>&quot;primary_account_storage_access_key&quot;</code> is defined</p>
  <pre><code>resource &quot;azurerm_key_vault_secret&quot; &quot;primary_account_storage_access_key&quot; {
    depends_on   = [azurerm_key_vault_access_policy.terraform_sp_access]
    key_vault_id = data.azurerm_key_vault.azvault.id
    name         = &quot;${module.variables.storage-account_name}-access-key&quot;
    value        = module.variables.storage-access_key
  }
  </code></pre>
  <p>Module is defined as below:</p>
  <pre><code>module &quot;variables&quot; {
    source = &quot;./Configuration&quot;
  }
  </code></pre>
  <p>I have no issue with utilizing the same module in other resources placed in the same file (<code>main.tf</code>)</p>
  <pre><code>terraform {
    backend &quot;azurerm&quot; {
      resource_group_name  = module.variables.storage-resource_group_name
      storage_account_name = module.variables.storage-storage_account_name
      container_name       = module.variables.storage-container_name
      key                  = module.variables.storage-key
    }
  }
  </code></pre>
  <p>Found articles here on the site focusing on the error suggesting
  &quot;splat&quot; operator with &quot;toset&quot; / &quot;one&quot; function, however that did not help:</p>
  <pre><code>  name         = &quot;${toset(module.variables[*].storage-account_name)}-access-key&quot;
    value        = toset(module.variables[*].storage-access_key)
  </code></pre>
  <pre><code>  name         = &quot;${one(module.variables[*].storage-account_name)}-access-key&quot;
    value        = one(module.variables[*].storage-access_key)
  </code></pre>
  <p>Content of <code>variables.tf</code> what child module <code>variables</code> uses:</p>
  <pre><code>variable &quot;storage-resource_group_name&quot; {
    type    = string
    default = &quot;Reporting-HFM-integration-rg&quot;
  }
  
  variable &quot;storage-account_name&quot; {
    type    = string
    default = &quot;reportinghfmintegration&quot;
  }
  
  variable &quot;storage-container_name&quot; {
    type    = string
    default = &quot;tfstate-blob&quot;
  }
  
  variable &quot;storage-key&quot; {
    type    = string
    default = &quot;terraform.tfstate&quot;
  }
  
  variable &quot;storage-access_key&quot; {
    type    = string
    default = &quot;u3K...&quot;
  }
  
  variable &quot;keyVault-name&quot; {
    type    = string
    default = &quot;se-dataplat-dwvault-prod&quot;
  }
  
  variable &quot;keyVault-resource_group_name&quot; {
    type    = string
    default = &quot;AzureDataPlatform-dwtools-prod-rg&quot;
  }
  
  variable &quot;keyVault-id&quot; {
    type    = string
    default = &quot;/subscriptions/23a89ca1-9743-4b3b-b5ff-41cea9985deb/resourceGroups/...&quot;
  }
  </code></pre>