通过包含名称的变量动态引用 Terraform 数据资源

Question

我正在尝试连接 Terraform 数据分配中声明的变量以构建动态调用。

有以下代码：

# Policy 1
data "aws_iam_policy_document" "1_s3_access_policy" {
   statement {
     effect = "Allow"
     actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
     ]
     resources = [
      "arn:aws:s3:::1_s3_access_policy/*",
      "arn:aws:s3:::1_s3_access_policy",
     ]
     principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::67435677645:user/d2c-user-us-west-1"]
     }
   }
 }
# policy 2
data "aws_iam_policy_document" "2_s3_access_policy" {
    statement {
     effect = "Allow"
     actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
     ]
     resources = [
      "arn:aws:s3:::2_s3_access_policy/*",
      "arn:aws:s3:::2_s3_access_policy",
     ]
     principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::67435677645:user/d2c-user-us-west-1"]
     }
   }
 }
# Policy 3
...
variable "s3_bucket_names" {
      type    = list(any)
      default = ["1_s3_access_policy", "2_s3_access_policy", "3_s3_access_policy"]
}

module "platform-cloud" {
      source              = "./module"
      count               = length(var.s3_bucket_names) //count will be 3
      bucket_name         = var.s3_bucket_names[count.index]
      sse_algorithm       = "aws:kms"
      iam_policy_document =  data.aws_iam_policy_document.${var.s3_bucket_names[count.index]}.json
}

失败并出现错误：

Error: Invalid character

on main.tf line 10, in module "platform-cloud":

iam_policy_document = data.aws_iam_policy_document.${var.s3_bucket_names[count.index]}.json

This character is not used within the language.

有没有办法在 terraform data 调用中连接变量？

Answer 1

Terraform 无法以您尝试的方式动态查找资源，因为这意味着在评估时间之前不会决定资源依赖关系，但 Terraform 需要在评估任何表达式之前知道正确的依赖关系顺序。

但是，您可以满足您的用例动态选择资源的额外步骤，即使用键创建映射，然后您将使用这些键来选择每个资源：

locals {
  bucket_policies = {
    s3_access_policy_1 = data.aws_iam_policy_document.s3_access_policy_1
    s3_access_policy_2 = data.aws_iam_policy_document.s3_access_policy_2
    s3_access_policy_3 = data.aws_iam_policy_document.s3_access_policy_3
  }
}

module "platform-cloud" {
  source = "./module"
  count  = length(var.s3_bucket_names) //count will be 3

  bucket_name         = var.s3_bucket_names[count.index]
  sse_algorithm       = "aws:kms"
  iam_policy_document = local.bucket_policies[var.s3_bucket_names[count.index]].json
}

我已将您的数据资源的名称更改为 s3_access_policy_1 而不是 1_s3_access_policy，因为 Terraform 不允许资源名称以数字开头。 Terraform 尚未报告该错误消息，因为您有语法错误，但解决语法错误会暴露命名错误。

请注意，现在module.platform-cloud 的iam_policy_document 指的是整个local.bucket_policies，而这又依赖于所有三个数据资源。因此，Terraform 明白它必须在评估模块参数之前评估所有这三个数据资源，这会产生正确的评估顺序。

---

虽然与您的问题没有直接关系，但我建议您阅读When to use for_each instead of count 以决定在您的module "platform-cloud" 块中使用for_each 是否会更好，而不是count。

Answer 2

通常你会这样做：

iam_policy_document =  data.aws_iam_policy_document[var.s3_bucket_names[count.index]].json

具体细节取决于data.aws_iam_policy_document 的定义方式。但遗憾的是，您的问题中没有提供此类信息。