Terraform aws_iam_policy_document：属性“资源”的值不合适：元素 0：需要字符串

Question

我正在尝试使用此问题的答案生成的 output 来生成 IAM 策略的 arns 列表：

data "aws_iam_policy_document" "test" {
  statement {
    effect    = "Allow"
    actions   = [ "s3:*" ]
    resources = [
        for arn in local.s3_folder_arns: [
            arn
        ]
    ]
  }
}

而且我不断收到这样的错误：

Error: Missing item separator
│
│   on lambda.tf line 111, in data "aws_iam_policy_document" "test":
│  111:     resources = [
│  112:         for arn in local.s3_folder_arns: [
│  114:             arn
│  115:         ]
│  116:     ]
│     ├────────────────
│     │ local.s3_folder_arns is list of string with 9 elements
│
│ Inappropriate value for attribute "resources": element 0: string required.

即使输出变量确认它看起来像我想要的：

Changes to Outputs:
  + s3_folder_arns = [
      + "arn:aws:s3:::<my bucket>/Partner1/client1/User1/output/*",
      + "arn:aws:s3:::<my bucket>/Partner1/client1/User2/output/*",
      + "arn:aws:s3:::<my bucket>/Partner1/client1/User3/output/*",
      + "arn:aws:s3:::<my bucket>/Partner1/client1/User4/output/*",
      + "arn:aws:s3:::<my bucket>/Partner1/client1/User5/output/*",
      + "arn:aws:s3:::<my bucket>/Partner1/client2/User1/output/*",
      + "arn:aws:s3:::<my bucket>/Partner1/client3/User1/output/*",
      + "arn:aws:s3:::<my bucket>/Partner2/client1/User1/output/*",
      + "arn:aws:s3:::<my bucket>/Partner3/client1/User1/output/*",
    ]

如果我将资源索引为arn[0] ，那行得通，但这不是我想要的。 我希望动态生成填充 IAM 策略的资源列表。

我究竟做错了什么？

Answer 1

结果我使用了一对额外的方括号。 改变

resources = [
        for arn in local.s3_folder_arns: [
            arn
        ]
    ]

到

resources = [
        for arn in local.s3_folder_arns: arn
    ]

解决了这个问题。