如何跳过在根模块中声明值（for_each 循环）

Question

I am trying to build a reusable module that creates multiple S3 buckets. Based on a condition, some buckets may have lifecycle rules, others do not. I am using a for loop in the lifecycle rule resource and managed to do it but not on 100%.

---

• My var:

variable "bucket_details" {
  type = map(object({
    bucket_name      = string
    enable_lifecycle = bool
    glacier_ir_days  = number
    glacier_days     = number
  }))
}

• How I go through the map on the lifecycle resource:

resource "aws_s3_bucket_lifecycle_configuration" "compliant_s3_bucket_lifecycle_rule" {
  for_each = { for bucket, values in var.bucket_details : bucket => values if values.enable_lifecycle }

  depends_on = [aws_s3_bucket_versioning.compliant_s3_bucket_versioning]

  bucket = aws_s3_bucket.compliant_s3_bucket[each.key].bucket

  rule {
    id     = "basic_config"
    status = "Enabled"
    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }

    transition {
      days          = each.value["glacier_ir_days"]
      storage_class = "GLACIER_IR"
    }

    transition {
      days          = each.value["glacier_days"]
      storage_class = "GLACIER"
    }

    expiration {
      days = 2555
    }

    noncurrent_version_transition {
      noncurrent_days = each.value["glacier_ir_days"]
      storage_class   = "GLACIER_IR"
    }

    noncurrent_version_transition {
      noncurrent_days = each.value["glacier_days"]
      storage_class   = "GLACIER"
    }

    noncurrent_version_expiration {
      noncurrent_days = 2555
    }
  }
}

• How I WOULD love to reference it in the root module:

module "s3_buckets" {
  source = "./modules/aws-s3-compliance"

  #

  bucket_details = {
    "fisrtbucketname" = {
      bucket_name      = "onlythefisrtbuckettesting"
      enable_lifecycle = true
      glacier_ir_days  = 555
      glacier_days     = 888
    }
    "secondbuckdetname" = {
      bucket_name      = "onlythesecondbuckettesting"
      enable_lifecycle = false
    }
  }
}

---

So when I reference it like that, it cannot validate, because I am not setting values for both glacier_ir_days & glacier_days - understandable. My question is - is there a way to check if the enable_lifecycle is set to false, to not expect values for these? Currently, as a workaround, I am just setting zeroes for those and since the resource is not created if enable_lifecycle is false , it does not matter, but I would love it to be cleaner.

Thank you in advance.

Answer 1

The forthcoming Terraform v1.3 release will include a new feature for declaring optional attributes in an object type constraint, with the option of declaring a default value to use when the attribute isn't set.

At the time I'm writing this the v1.3 release is still under development and so not available for general use, but I'm going to answer this with an example that should work with Terraform v1.3 once it's released. If you wish to try it in the meantime you can experiment with the most recent v1.3 alpha release which includes this feature, though of course I would not recommend using it in production until it's in a final release.

---

It seems that your glacier_ir_days and glacier_days attributes are, from a modeling perspective, attribtues that are required when the lifecycle is enabled and not required when lifecycle is disabled.

I would suggest modelling that by placing these attributes in a nested object called lifecycle and implementing it such that the lifecycle resource is enabled when that attribute is set, and disabled when it is left unset.

The declaration would therefore look like this:

variable "s3_buckets" {
  type = map(object({
    bucket_name = string
    lifecycle = optional(object({
      glacier_ir_days = number
      glacier_days    = number
    }))
  }))
}

When an attribute is marked as optional(...) like this, Terraform will allow omitting it in the calling module block and then will quietly set the attribute to null when it performs the type conversion to make the given value match the type constraint. This particular declaration doesn't have a default value, but it's also possible to pass a second argument in the optional(...) syntax which Terraform will then use instead of null as the placeholder value when the attribute isn't specified.

The calling module block would therefore look like this:

module "s3_buckets" {
  source = "./modules/aws-s3-compliance"

  #

  bucket_details = {
    "fisrtbucketname" = {
      bucket_name = "onlythefisrtbuckettesting"
      lifecycle = {
        glacier_ir_days  = 555
        glacier_days     = 888
      }
    }
    "secondbuckdetname" = {
      bucket_name = "onlythesecondbuckettesting"
    }
  }
}

Your resource block inside the module will remain similar to what you showed, but the if clause of the for expression will test if the lifecycle object is non-null instead:

resource "aws_s3_bucket_lifecycle_configuration" "compliant_s3_bucket_lifecycle_rule" {
  for_each = {
    for bucket, values in var.bucket_details : bucket => values
    if values.lifecycle != null
  }

  # ...
}

Finally, the references to the attributes would be slightly different to traverse through the lifecycle object:

    transition {
      days          = each.value.lifecycle.glacier_days
      storage_class = "GLACIER"
    }