如何在 terraform 中将条件资源引用到另一个资源上

Question

我创建了 2 个存储桶。一个会一直创建，一个会在 env 是 QA 时创建。

resource "aws_s3_bucket" "bucket_always" {
  bucket_prefix = format("bucket.always")
  acl           = "private"

  versioning {
    enabled = true
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "aws:kms"
      }
    }
  }
} 

resource "aws_s3_bucket" "bucket_conditional" {
  count = var.name == "qa" ? 1 : 0
  bucket_prefix = format("bucket.conditional")
  acl           = "private"

  versioning {
    enabled = true
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "aws:kms"
      }
    }
  }
} 

现在如何创建 IAM 并添加两个存储桶 arn？由于条件桶，以下策略将不起作用

data "aws_iam_policy_document" "test_policy_document" {
  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      aws_s3_bucket.bucket_always.arn,
      aws_s3_bucket.bucket_conditional.arn,
    ]
  }

  statement {
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    resources = [
      "${aws_s3_bucket.bucket_always.arn}/*",
      "${aws_s3_bucket.bucket_conditional.arn}/*",
    ]
  }
}

Answer 1

拆分 IAM 语句，并使用 dynamic blocks。您实际上不需要在这里迭代特定的值列表，如果您想创建块，只需传递一个带有一个值的列表，或者如果您不想创建块，则传递一个空列表。例如：

data "aws_iam_policy_document" "test_policy_document" {
  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      aws_s3_bucket.bucket_always.arn
    ]
  }

  statement {
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    resources = [
      "${aws_s3_bucket.bucket_always.arn}/*"
    ]
  }

  dynamic "statement" {
    for_each = var.name == "qa" ? ["qa"] : []
    content {
      actions = [
        "s3:ListBucket",
      ]

      resources = [
        aws_s3_bucket.bucket_conditional[0].arn
      ]
    }
  }

  dynamic "statement" {
    for_each = var.name == "qa" ? ["qa"] : []
    content {
      actions = [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
      ]

      resources = [
        "${aws_s3_bucket.bucket_conditional[0].arn}/*"
      ]
    }
  }
}