Terraform for_each 里面的 for_each？

Question

我有這段代碼：

locals {
  portals = ["c" "a" "b"]
}

resource "aws_acm_certificate" "example" {
  for_each    = toset(local.portals)
  domain_name = "${each.value}.aws.${var.environment}.abc.com"
  subject_alternative_names = [
    "${each.value}.${var.environment}-aws.abc.com"
  ]
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

這創建了 3 個 ACM AWS 證書。

現在，我需要/想要做的是為證書創建的所有 DNS 創建 DNS 記錄。 我的代碼是：

resource "aws_route53_record" "example-verify-acm" {
  for_each = {
    for dvo in aws_acm_certificate.example.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.management_zone.zone_id
}

現在，當我運行 terraform 計划時，出現錯誤：

│ Error: Missing resource instance key
│ 
│   on  line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example.domain_validation_options : dvo.domain_name => {
│ 
│ Because aws_acm_certificate.example has "for_each" set, its attributes must be accessed on specific instances.
│ 
│ For example, to correlate with indices of a referring resource, use:
│     aws_acm_certificate.example[each.key]

然后，正如錯誤所說的那樣使用“aws_acm_certificate.example[each.key]”。我在我的代碼中添加了它：

    for dvo in aws_acm_certificate.website[each.key].domain_validation_options : dvo.domain_name => {

然后我得到錯誤：

│ Error: Reference to "each" in context without for_each
│ 
│   on ../../modules/web/acm.tf line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example[each.key].domain_validation_options : dvo.domain_name => {
│ 
│ The "each" object can be used only in "module" or "resource" blocks, and only when the "for_each" argument is set.

如果我添加：

    for dvo in aws_acm_certificate.example[each.value].domain_validation_options : dvo.domain_name => {

我收到錯誤：

 Error: each.value cannot be used in this context
│ 
│   on ../../modules/web/acm.tf line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example[each.value].domain_validation_options : dvo.domain_name => {
│ 
│ A reference to "each.value" has been used in a context in which it unavailable, such as when the configuration no longer contains
│ the value in its "for_each" expression. Remove this reference to each.value in your configuration to work around this error.

因此，我不知道如何使用“aws_route53_record”這一資源為所有 3 個證書傳遞“domain_validation_options”。 有沒有辦法修復這些錯誤？ 或者是否有不同的方法來完成這項工作？

Answer 1

您必須展平您的aws_acm_certificate 。 例如：

locals {
  flat_records = merge([
      for cert in aws_acm_certificate.example: {
        for dvo in cert.domain_validation_options: 
          "${cert.domain_name}-${dvo.resource_record_name}" => {
            name   = dvo.resource_record_name
            record = dvo.resource_record_value
            type   = dvo.resource_record_type
          }        
      }
    ]...)
}

然后

resource "aws_route53_record" "example-verify-acm" {
  for_each        = local.flat_records 

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.management_zone.zone_id
}

Answer 2

我無法為此找到好的解決方案。 感謝@Marcin 的偉大建議.. 但我為此經歷的路徑是創建一個 terraform 模塊，該模塊一起創建 ACM、記錄和驗證。

然后，我只是使用 for_each.. 調用模塊：

locals {
  portals = ["c" "a" "b"]
}