使用for_each查找数据源的terraform

Question

在aws_ssoadmin_permission_set_inline_policy重新源中，我使用for_each解析与数据源名称对应的名称列表。它在使用each.key时不起作用，但在硬编码值inline_policy = data.aws_iam_policy_document.emobg-sso-billing-admin.json时唤醒

data "aws_iam_policy_document" "emobg-sso-billing-admin" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "aws-marketplace:*",
      "aws-portal:*",
      "budgets:*"
    ]
    resources = [
      "*",
    ]
  }
}

data "aws_iam_policy_document" "emobg-sso-billing-audit" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "support:*",
      "tag:*",
      "s3:*"
    ]
    resources = [
      "*",
    ]
  }
}

resource "aws_ssoadmin_permission_set" "emobg" {
  for_each = toset(local.permission_sets_name)

  name             = each.key
  description      = each.key
  instance_arn     = local.sso_instance_arn
  session_duration = local.session_duration
}

resource "aws_ssoadmin_permission_set_inline_policy" "emobg" {
  for_each           = toset(local.permission_sets_name)

  inline_policy      = format("data.aws_iam_policy_document.%s.json", each.key) # <-- doesn't works
#  inline_policy      = data.aws_iam_policy_document.emobg-sso-billing-admin.json # <-- works
  instance_arn       = local.sso_instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.emobg[each.key].arn
}

locals {
  session_duration    = "PT8H"

  permission_sets_name = [
    "emobg-sso-billing-admin",
    "emobg-sso-billing-audit",
  ]
}

错误消息是：

2022-11-01T01:19:43.923+0100 [ERROR] vertex "aws_ssoadmin_permission_set_inline_policy.emobg[\"emobg-sso-billing-admin\"]" error: "inline_policy" contains an invalid JSON policy
2022-11-01T01:19:43.923+0100 [ERROR] vertex "aws_ssoadmin_permission_set_inline_policy.emobg (expand)" error: "inline_policy" contains an invalid JSON policy
╷
│ Error: "inline_policy" contains an invalid JSON policy
│
│   with aws_ssoadmin_permission_set_inline_policy.emobg["emobg-sso-billing-admin"],
│   on permission_set.tf line 13, in resource "aws_ssoadmin_permission_set_inline_policy" "emobg":
│   13:   inline_policy      = format("data.aws_iam_policy_document.%s.json", each.value)

我真的不明白JSON策略有什么问题，因为它是一样的。也许我漏掉了什么？

Answer 1

因为您使用的是format("data.aws_iam_policy_document.%s.json", each.key)，所以策略将是文字字符串 "data.aws_iam_policy_document.%s.json"。

您只有单一策略，因此必须直接使用它：

 inline_policy      = data.aws_iam_policy_document.emobg-sso-billing-admin.json 

这就是为什么它起作用了。您的代码中没有超过一个aws_iam_policy_document。

感谢，Marcin在评论中给了我答案:你不能做你想做的事。TF不支持对不同资源的动态引用。

Answer 2

正如前面提到的，terraform不允许进行动态引用，所以我最终使用了一个映射，即使策略的名称与基本名称相同。

data "aws_iam_policy_document" "emobg-sso-billing-admin" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "aws-marketplace:*",
      "aws-portal:*",
      "budgets:*"
    ]
    resources = [
      "*",
    ]
  }
}

data "aws_iam_policy_document" "emobg-sso-billing-audit" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "support:*",
      "tag:*",
      "s3:*"
    ]
    resources = [
      "*",
    ]
  }
}

... [ ALL OTHERS DATA SOURCES POLICIES ARE LISTED HERE ]

resource "aws_ssoadmin_permission_set" "emobg" {
  for_each = local.permission_set_map

  name             = each.key
  description      = each.key
  instance_arn     = local.sso_instance_arn
  session_duration = local.session_duration
}

resource "aws_ssoadmin_permission_set_inline_policy" "emobg" {
  for_each = local.inline_policies_map

  inline_policy      = each.value
  instance_arn       = local.sso_instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.emobg[each.key].arn
}

locals {
  session_duration = "PT8H"
  permission_set_map  = { for ps in local.permission_sets : ps.name => ps }
  inline_policies_map = { for ps in local.permission_sets : ps.name => ps.inline_policy if ps.inline_policy != "" }
}

locals {
  permission_sets = [
    {
      name          = "emobg-sso-billing-admin",
      inline_policy = data.aws_iam_policy_document.emobg-sso-billing-admin.json
    },
    {
      name          = "emobg-sso-billing-audit",
      inline_policy = data.aws_iam_policy_document.emobg-sso-billing-audit.json
    },
    {
      ... [ All MY POLICIES ARE LISTED HERE ]
    }
  ]
}