In your try() block, when the attribute doesn't exist, it correctly returns . However, when the attribute does exist, it returns the whole nested object (e.g., { host = ..., name = ... }). In Terraform, comparing a complex object/map to an empty string ({...} != ) is technically invalid or doesn't evaluate cleanly to a false check, causing the filter to let it slip through or crash when it expects a string.

infrastructure/secrets.tf

@@ -160,7 +160,7 @@ resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
 locals {
   database_secrets_to_import = {
     for key, value in var.kubernetes : key => value
-    if value.database != null && value.enabled == true && try(value.import_database_secret, "") != ""
+    if value.database != null && value.enabled == true && can(value.import_database_secret.host)
   }
 }
 

infrastructure/variables.auto.tfvars

@@ -2,11 +2,11 @@ kubernetes = {
 
   gluetun = {
     #enabled         = false
-    dns_nameservers = "1.1.1.1"
-    replicas        = 01
-    image           = "qmcgaw/gluetun:latest"
-    exposed         = false
-    service_port    = [8888]
+    dns_nameservers  = "1.1.1.1"
+    replicas         = 01
+    image            = "qmcgaw/gluetun:latest"
+    exposed          = false
+    service_port     = [8888]
     secret_import    = ["5527ba11-07e3-415b-8d1f-b3ee0154eb56", "b0d22160-d81a-4702-a3dd-b40e0168d617", "643dbe99-ace0-4ef5-8a2e-b44f014dccb0"]
     security_context = true
 
@@ -68,8 +68,8 @@ kubernetes = {
       username  = "django_username"
       mountPath = "/var/lib/postgresql/data"
     }
-    secret_ref    = ["django-bitwarden-credentials"]
-    secret_import = ["9fc5a725-75f5-4bab-b595-b474017146c3"]
+    secret_ref = ["django-bitwarden-credentials"]
+    #secret_import = ["9fc5a725-75f5-4bab-b595-b474017146c3"]
     requirements = {
       limits-cpu      = "800m"
       limits-memory   = "800Mi"