terraform 获取资源列表变量

Question

variable "iam_action" {
  type    = "list"
  default = ["ec2.amazonaws.com","ecs.amazonaws.com"]
}

resource "aws_iam_role" "s3_role" {
  name               = "abcd"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": [ "${var.iam_action}"
        ]
      },
      "Effect": "Allow,
      "Sid": ""
    }
  ]
}
EOF
}

错误：

At column 1, line 1: output of an HIL expression must be a string, or a single list (argument 2 is TypeList) in:

我尝试了 join 函数，但我需要将输出作为列表 ["a","b","c"] join 函数给出类似 ["a,b,c"] 的输出

Answer 1

我用jsonencodetemplate_file修复它

首先创建下面的json文件

$ cat s3_policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": ${iam_action}
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}

更新 tf 文件

variable "iam_action" {
  type    = "list"
  default = ["ec2.amazonaws.com", "ecs.amazonaws.com"]
}

data "template_file" "s3_role" {
  template = "${file("${path.module}/s3_policy.json")}"

  vars {
    iam_action = "${jsonencode(var.iam_action)}"
  }
}

resource "aws_iam_role" "s3_role" {
  name = "abcd"

  assume_role_policy = "${data.template_file.s3_role.rendered}"
}

运行template plan

  + aws_iam_role.s3_role
      arn:                   "<computed>"
      assume_role_policy:    "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": [\"ec2.amazonaws.com\",\"ecs.amazonaws.com\"]\n      },\n      \"Effect\": \"Allow\",\n      \"Sid\": \"\"\n    }\n  ]\n}\n"
      create_date:           "<computed>"
      force_detach_policies: "false"
      name:                  "abcd"
      path:                  "/"
      unique_id:             "<computed>"

参考：

terraform interpolation

jsonencode(item) - 返回给定项目的 JSON 编码表示，它可以是字符串、字符串列表或从字符串到字符串的映射。 注意，如果item是字符串，返回值包含双引号。

这里解释了我不能直接在"${var.iam_action}"in template_file 中使用vars 的原因：

vars - （可选）模板内插值的变量。请注意，变量必须都是原语。 直接引用列表或地图会导致验证错误。