Bug: optional cpu_options enum fields fail validation when omitted

[stefankrzyz]

When configuring only CPU core and thread counts, validation fails because contains() receives null for omitted optional fields.

Reproduction

cpu_options = {
  core_count       = 8
  threads_per_core = 1
}

Actual behaviour

Terraform errors during variable validation:

Invalid value for "value" parameter: argument must not be null.

Expected behaviour

Configurations that omit amd_sev_snp and nested_virtualization should validate successfully. The omitted fields should remain null and therefore not be emitted in aws_launch_template.cpu_options.

Non-null values must continue to be restricted to enabled or disabled.

Root cause

The validation uses || to guard contains(), but Terraform still evaluates:

contains(["enabled", "disabled"], null)

when an optional attribute is omitted.

This affects both public input surfaces:

• Root module: runner_cpu_options in variables.tf
• Runners module: cpu_options in modules/runners/variables.tf

Suggested fix

Use conditional expressions so contains() is only evaluated for non-null values:

validation {
  condition = var.cpu_options == null ? true : (
    (var.cpu_options.amd_sev_snp == null ? true : contains(["enabled", "disabled"], var.cpu_options.amd_sev_snp)) &&
    (var.cpu_options.nested_virtualization == null ? true : contains(["enabled", "disabled"], var.cpu_options.nested_virtualization))
  )

  error_message = "When set, cpu_options.amd_sev_snp and cpu_options.nested_virtualization must be one of: enabled, disabled."
}

Apply the equivalent change to the root runner_cpu_options validation.

Test coverage

Add Terraform tests proving:

1. cpu_options = { core_count = 8, threads_per_core = 1 } plans successfully.
2. amd_sev_snp and nested_virtualization remain null in the planned aws_launch_template.cpu_options block when omitted.
3. Invalid non-null values for either enum field are rejected.