将 terraform 自定义变量隐藏到某些特定格式问题

Question

以下是用于创建特定 AWS 资源的自定义变量

输入变量：

VAR = {
        "commonPolicy" = [
            "DenyRootUser",
            "denyIamAccessKeyCreation"
        ]
        "extraPolicy" = [
            "denyGlobalService",
            "denyBillingModify"
        ]
}

我在下面使用的插值/修改方法使用 Terraform 控制台修改值。

方法：

> { for i,j in var.VAR  : "${i}" =>  [ for k in j : "file('policies/${k}.json')}" ] }

通过这种方法，当我从特定键解析值时，我能够得到这个值：

像这样：

> { for i,j in var.VAR  : "${i}" =>  [ for k in j : "file('policies/${k}.json')}" ] }["commonPolicy"]

OUTPUT：

[
  "file('policies/DenyRootUser.json')}",
  "file('policies/denyIamAccessKeyCreation.json')}",
]

但是我想从插值方法得到以下值

预期 Output：

[
  file("policies/DenyRootUser.json")},
  file("policies/denyIamAccessKeyCreation.json")},
]

笔记：

• output 和预期的 output 之间的区别在于我想要没有双引号的值列表。
• 在文件 function 下，位置/路径应在双引号下。

Answer 1

您可以按如下方式使用它，这将产生如下结果：

locals {
    a = ["a.json","b.json"]
    test = [for i in local.a: file("${i}")]
}


data "aws_iam_policy_document" "b" {
  source_policy_documents =  local.test
}


terraform  console

> data.aws_iam_policy_document.b.json
<<EOT
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*"
    },
    {
      "Sid": "UniqueSidOne",
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    },
    {
      "Sid": "UniqueSidTwo",
      "Effect": "Allow",
      "Action": "iam:*",
      "Resource": "*"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": "lambda:*",
      "Resource": "*"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": "ec3:*",
      "Resource": "*"
    },
    {
      "Sid": "uu",
      "Effect": "Allow",
      "Action": "s4:*",
      "Resource": "*"
    },
    {
      "Sid": "rr",
      "Effect": "Allow",
      "Action": "iamm:*",
      "Resource": "*"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": "scp:*",
      "Resource": "*"
    }
  ]
}
EOT

这是预期的 output 吗？

Answer 2

[已解决] 我通过以下方法解决了这个问题。

目录结构：

.
├── main.tf
└── policies
    ├── denyIamAccessKeyCreation.json
    └── denyRootUser.json

方法：

主文件

VAR = {
        "commonPolicy" = [
            "DenyRootUser",
            "denyIamAccessKeyCreation"
        ]
        "extraPolicy" = [
            "denyGlobalService",
            "denyBillingModify"
        ]
}

locals {
  local_policy_list = { for i,j in local.VAR  : "${i}" =>  [ for k in j : file("policies/${k}.json") ] }
}

data "aws_iam_policy_document" "b" {
  for_each = local.test
  source_policy_documents =  each.value
}

上面的local_policy_list变量收集文件输入并在特定的 map 变量下创建了一个列表。

Terraform 控制台：

> data.aws_iam_policy_document.b["commonPolicy"].json
> data.aws_iam_policy_document.b["extraPolicy"].json

当我得到预期的 output 但结果类似于aws_iam_policy_document数据变量source_policy_documents要求。

例子：

<<EOT
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyRootUser",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:root"
          ]
        }
      }
    }
  ]
}
EOT