Terraform for_each inside for_each？

Question

我有这样的代码：

locals {
  portals = ["c" "a" "b"]
}

resource "aws_acm_certificate" "example" {
  for_each    = toset(local.portals)
  domain_name = "${each.value}.aws.${var.environment}.abc.com"
  subject_alternative_names = [
    "${each.value}.${var.environment}-aws.abc.com"
  ]
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

这创造了3个ACM AWS证书。

现在，我需要/要做的是为证书创建的所有DNS创建DNS记录。我的密码是：

resource "aws_route53_record" "example-verify-acm" {
  for_each = {
    for dvo in aws_acm_certificate.example.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.management_zone.zone_id
}

现在，当我运行terraform计划时，我得到了一个错误：

│ Error: Missing resource instance key
│ 
│   on  line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example.domain_validation_options : dvo.domain_name => {
│ 
│ Because aws_acm_certificate.example has "for_each" set, its attributes must be accessed on specific instances.
│ 
│ For example, to correlate with indices of a referring resource, use:
│     aws_acm_certificate.example[each.key]

然后，正如错误说要使用"aws_acm_certificate.exampleeach.key“。我在代码中添加了以下内容：

    for dvo in aws_acm_certificate.website[each.key].domain_validation_options : dvo.domain_name => {

然后我得到了错误：

│ Error: Reference to "each" in context without for_each
│ 
│   on ../../modules/web/acm.tf line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example[each.key].domain_validation_options : dvo.domain_name => {
│ 
│ The "each" object can be used only in "module" or "resource" blocks, and only when the "for_each" argument is set.

如果我加上：

    for dvo in aws_acm_certificate.example[each.value].domain_validation_options : dvo.domain_name => {

我知道错误：

 Error: each.value cannot be used in this context
│ 
│   on ../../modules/web/acm.tf line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example[each.value].domain_validation_options : dvo.domain_name => {
│ 
│ A reference to "each.value" has been used in a context in which it unavailable, such as when the configuration no longer contains
│ the value in its "for_each" expression. Remove this reference to each.value in your configuration to work around this error.

因此，我不知道如何为使用"domain_validation_options“这一资源的所有3个证书传递"aws_route53_record”。有办法纠正这些错误吗？或者有什么不同的方法来完成这件事？

Answer 1

你必须把压平你的aws_acm_certificate。例如：

locals {
  flat_records = merge([
      for cert in aws_acm_certificate.example: {
        for dvo in cert.domain_validation_options: 
          "${cert.domain_name}-${dvo.resource_record_name}" => {
            name   = dvo.resource_record_name
            record = dvo.resource_record_value
            type   = dvo.resource_record_type
          }        
      }
    ]...)
}

然后

resource "aws_route53_record" "example-verify-acm" {
  for_each        = local.flat_records 

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.management_zone.zone_id
}

Answer 2

我没能找到一个很好的解决办法。谢谢你@Marcin的好建议。但我所经历的路径是创建一个terraform模块，它创建ACM、记录和验证，所有这些都是一起完成的。

然后，我使用一个for_each调用模块。通过以下方式：

locals {
  portals = ["c" "a" "b"]
}