There is a bug in the current version of the official aws_elasticsearch_domain resource which prevents you from creating new OpenSearch domains (and also changing existing domains).

To circumvent this, I'm working on a module that creates an OpenSearch domain via a CloudFormation stack using the Terraform aws_cloudformation_stack resource.

I want to pass the CloudFormation template via the jsonencode() function, so that I can work in HCL instead of JSON.

Some of the resource parameters are conditional, e.g. CustomEndpoint. You're only allowed to provide a value if CustomEndpointEnabled is set to true. Otherwise the parameter has to be omitted completely.

In Terraform one would usually do this via a conditional statement, like this:

  DomainEndpointOptions = {
    CustomEndpoint                = var.custom_endpoint_enabled ? var.custom_endpoint : null
    CustomEndpointCertificateArn  = var.custom_endpoint_enabled ? var.custom_endpoint_certificate_arn : null
    CustomEndpointEnabled         = var.custom_endpoint_enabled
    EnforceHTTPS                  = true
    TLSSecurityPolicy             = "Policy-Min-TLS-1-2-2019-07"
  }

jsonencode() encodes the null value which is the expected behaviour. But the AWS API will throw an error since null is an unexpected value.

So my question is: What is the correct way of omitting conditional values inside jsonencode() blocks?