Terraform for_each 里面的 for_each？

Question

我有这段代码：

locals {
  portals = ["c" "a" "b"]
}

resource "aws_acm_certificate" "example" {
  for_each    = toset(local.portals)
  domain_name = "${each.value}.aws.${var.environment}.abc.com"
  subject_alternative_names = [
    "${each.value}.${var.environment}-aws.abc.com"
  ]
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

这创建了 3 个 ACM AWS 证书。

现在，我需要/想要做的是为证书创建的所有 DNS 创建 DNS 记录。 我的代码是：

resource "aws_route53_record" "example-verify-acm" {
  for_each = {
    for dvo in aws_acm_certificate.example.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.management_zone.zone_id
}

现在，当我运行 terraform 计划时，出现错误：

│ Error: Missing resource instance key
│ 
│   on  line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example.domain_validation_options : dvo.domain_name => {
│ 
│ Because aws_acm_certificate.example has "for_each" set, its attributes must be accessed on specific instances.
│ 
│ For example, to correlate with indices of a referring resource, use:
│     aws_acm_certificate.example[each.key]

然后，正如错误所说的那样使用“aws_acm_certificate.example[each.key]”。我在我的代码中添加了它：

    for dvo in aws_acm_certificate.website[each.key].domain_validation_options : dvo.domain_name => {

然后我得到错误：

│ Error: Reference to "each" in context without for_each
│ 
│   on ../../modules/web/acm.tf line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example[each.key].domain_validation_options : dvo.domain_name => {
│ 
│ The "each" object can be used only in "module" or "resource" blocks, and only when the "for_each" argument is set.

如果我添加：

    for dvo in aws_acm_certificate.example[each.value].domain_validation_options : dvo.domain_name => {

我收到错误：

 Error: each.value cannot be used in this context
│ 
│   on ../../modules/web/acm.tf line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example[each.value].domain_validation_options : dvo.domain_name => {
│ 
│ A reference to "each.value" has been used in a context in which it unavailable, such as when the configuration no longer contains
│ the value in its "for_each" expression. Remove this reference to each.value in your configuration to work around this error.

因此，我不知道如何使用“aws_route53_record”这一资源为所有 3 个证书传递“domain_validation_options”。 有没有办法修复这些错误？ 或者是否有不同的方法来完成这项工作？

Answer 1

您必须展平您的aws_acm_certificate 。 例如：

locals {
  flat_records = merge([
      for cert in aws_acm_certificate.example: {
        for dvo in cert.domain_validation_options: 
          "${cert.domain_name}-${dvo.resource_record_name}" => {
            name   = dvo.resource_record_name
            record = dvo.resource_record_value
            type   = dvo.resource_record_type
          }        
      }
    ]...)
}

然后

resource "aws_route53_record" "example-verify-acm" {
  for_each        = local.flat_records 

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.management_zone.zone_id
}

Answer 2

我无法为此找到好的解决方案。 感谢@Marcin 的伟大建议.. 但我为此经历的路径是创建一个 terraform 模块，该模块一起创建 ACM、记录和验证。

然后，我只是使用 for_each.. 调用模块：

locals {
  portals = ["c" "a" "b"]
}