modules/authentik/main.tf

@@ -3,7 +3,7 @@ resource "authentik_group" "this" {
 
   name         = each.value.name
   is_superuser = each.value.is_superuser
-  parents      = each.value.parents != null ? [for p in each.value.parents : authentik_group.this[p].id] : []
+  parents      = each.value.parents
   attributes   = jsonencode(each.value.attributes)
 }
 

modules/authentik/variables.tf

@@ -2,8 +2,10 @@ variable "groups" {
   type = map(object({
     name         = string
     is_superuser = optional(bool, false)
-    parents      = optional(list(string), null)
+    # PKs of existing parent groups. These must be literal group PKs, not keys
-    attributes   = optional(map(string), {})
+    # into this map: authentik_group cannot reference itself.
+    parents    = optional(list(string), null)
+    attributes = optional(map(string), {})
   }))
   default = {}
 }