For-Each 模块中的 Terraform 参考项答案

【问题标题】：Terraform Reference Item In For-Each ModuleFor-Each 模块中的 Terraform 参考项
【发布时间】：2020-11-05 23:27:53
【问题描述】：

我想弄清楚如何引用一个项目及其在 Terraform for-each 循环中创建的属性。当前情况是 AWS IAM 角色和策略附件。

aws_iam_role 模块：

main.tf

resource "aws_iam_role" "iam_role" {
  for_each = var.roles

  name                 = each.value.role_name
  description          = each.value.description
  assume_role_policy   = file(each.value.assume_role_policy)
  max_session_duration = each.value.max_session_duration
}

变量.tf：

variable "roles" {
  type = map(object({
    role_name            = string
    description          = string
    assume_role_policy   = string
    max_session_duration = string
  }))
}

输出.tf：

output "id" {
  value = [
    for role in aws_iam_role.iam_role:
    role.id
  ]
}

output "arn" {
  value = [
    for role in aws_iam_role.iam_role:
    role.arn
  ]
}

output "name" {
  value = [
    for role in aws_iam_role.iam_role:
    role.name
  ]
}

output "RoleNameARNMapping" {
  value = {
    for role in aws_iam_role.iam_role:
    role.name => role.arn
  }
}

aws_policy_attachment 模块：

main.tf

resource "aws_iam_policy_attachment" "policy_attachment" {
  for_each = var.attachments

  name       = each.value.name
  users      = each.value.users
  roles      = each.value.roles
  groups     = each.value.groups
  policy_arn = each.value.policy_arn
}

变量.tf

variable "attachments" {
  type = map(object({
    name       = string
    users      = list(string)
    roles      = list(string)
    groups     = list(string)
    policy_arn = string
  }))
}

角色配置：

module "IAM_Roles" {
  source = "../modules/aws_iam_role"

  roles = {
    "iam_role_for_lambda" = {
      role_name            = "iam_role_for_lambda"
      description          = "IAM Role For Lambda"
      assume_role_policy   = "../dev/roles/IAMRoleForLambda.json"
      max_session_duration = 3600
    }
  }
}

我需要在策略附件配置中引用创建的角色的名称，如下所示：

module "lambda_role_attachments" {
  source = "../modules/aws_iam_policy_attachment"

  attachments = {
    "lambda-cloudwatch-access" = {
      name = "lambda-cloudwatch-access"
      users = null
      roles = [module.IAM_Roles['iam_role_for_lambda'].name]
      groups = null
      policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
    }
  }
}

不幸的是，这不起作用。 Terraform 不喜欢引号：

单引号无效。使用双引号 (") 将字符串括起来。
应为表达式的开头，但发现无效的表达式标记。

【问题讨论】：

标签： foreach terraform

【解决方案1】：

你得到的错误很明显Single quotes (') are not valid. Use double quotes (")
但如果你想通过 ID ["iam_role_for_lambda"] 访问名称，则需要将名称输出更改为地图：

output "name" {
  value = {
    for role in aws_iam_role.iam_role :
    role.name => role.name
  }
}

那么您使用该输出的位置将是：

module "lambda_role_attachments" {
  source = "../modules/aws_iam_policy_attachment"

  attachments = {
    "lambda-cloudwatch-access" = {
      name       = "lambda-cloudwatch-access"
      users      = null
      roles      = [module.IAM_Roles.name["iam_role_for_lambda"]]
      groups     = null
      policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
    }
  }
}

我这里有一个完整的原型：
https://github.com/heldersepu/hs-scripts/tree/master/TerraForm/modules

但如果你已经知道这个名字，也许这样做会更简单：

module "lambda_role_attachments" {
  source = "../modules/aws_iam_policy_attachment"

  attachments = {
    "lambda-cloudwatch-access" = {
      name       = "lambda-cloudwatch-access"
      users      = null
      roles      = ["iam_role_for_lambda"]
      groups     = null
      policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
    }
  }
}

【讨论】：