for回圈中的Terraformfor回圈

我的 terraform 模塊中有以下 Azure AD 服務主體。

module "test_app" {
  source = "../../../../../my-adapplication/"
  app_owners     = ["[email protected]","[email protected]"]
  app_roles      = [
    {
      allowed_member_types = [
        "User"
      ]
      description = "Read access to Test app"
      display_name = "Test App Read"
      is_enabled   = true
      value        = "TestApp.Read"
      id           = random_uuid.test_app_read.result
    },
    {
      allowed_member_types = [
        "User"
      ]
      description = "Write access to Test app"
      display_name = "Test App Write"
      is_enabled   = true
      value        = "TestApp.Write"
      id           = random_uuid.test_app_write.result
    },
    {
      allowed_member_types = [
        "User"
      ]
      description = "Admin access to Test app"
      display_name = "Test App Admin"
      is_enabled   = true
      value        = "TestApp.Admin"
      id           = random_uuid.test_app_admin.result
    }
  ]

 


  app_role_assignments = [
    {
       app_role_id        = random_uuid.test_app_read.result #"TestApp.Read"
       principal_object_id = data.azuread_group.group_role_read.object_id 
    },
    {
       app_role_id        = random_uuid.test_app_write.result #"TestApp.Write"
       principal_object_id = data.azuread_group.group_role_write.object_id
    },
    {
       app_role_id        = random_uuid.test_app_admin.result #"TestApp.Admin"
       principal_object_id = data.azuread_group.group_role_write.object_id
    }
  ]
   

}

resource "random_uuid" "test_app_read" {
}

resource "random_uuid" "test_app_write" {
}

resource "random_uuid" "test_app_admin" {
}

data "azuread_group" "group_role_read" {
  display_name = "group-role-read"
}

data "azuread_group" "group2_role_read" {
  display_name = "group2-role-read"
}

data "azuread_group" "group_role_write" {
  display_name = "group-role-write"
}

data "azuread_group" "group_role_admin" {
  display_name = "group-role-admin"
}

my-adapplication模塊檔案如下所示：

resource "azuread_application" "app" {
  ...
  ...
  dynamic "app_role" {
    for_each = var.app_roles
    content {
      id                   = app_role.value["id"]
      allowed_member_types = app_role.value["allowed_member_types"]
      description          = app_role.value["description"]
      display_name         = app_role.value["display_name"]
      enabled              = app_role.value["is_enabled"]
      value                = app_role.value["value"]
    }
  }
}

resource "azuread_service_principal" "sp" {
  application_id               = azuread_application.app.application_id
}


resource "azuread_app_role_assignment" "role" {
  for_each            = { for a in var.app_role_assignments : a.app_role_id => a }
  app_role_id         = each.value["app_role_id"]
  principal_object_id = each.value["principal_object_id"]
  resource_object_id  = azuread_service_principal.sp.object_id


}

我遇到的問題與 app_role_assignments 有關。如果我只傳入一個principal_object_id它就可以了。但是，如果我傳入多個principal_object_ids 它就不起作用。例如TestApp.Read下面：

app_role_assignments = [
    {
       app_role_id        = random_uuid.test_app_read.result #"TestApp.Read"
       principal_object_id = [data.azuread_group.group_role_read.object_id,data.azuread_group.group2_role_read.object_id]
    },
    {
       app_role_id        = random_uuid.test_app_write.result #"TestApp.Write"
       principal_object_id = data.azuread_group.group_role_write.object_id
    },
    {
       app_role_id        = random_uuid.test_app_admin.result #"TestApp.Admin"
       principal_object_id = data.azuread_group.group_role_write.object_id
    }
  ]

收到的錯誤是：

Error: Incorrect attribute value type
│ 
│   on .terraform/modules/test_app/main.tf line 116, in resource "azuread_app_role_assignment" "role":
│  116:   principal_object_id = each.value["principal_object_id"]
│     ├────────────────
│     │ each.value["principal_object_id"] is tuple with 2 elements
│ 
│ Inappropriate value for attribute "principal_object_id": string required.
?

如何讓 terraform 遍歷此principal_object_id串列？我想我是在回圈內回圈之后。有沒有比我上面的方法更好的方法？

是否可以這樣做，所以如果我使用/ for_each，我不會遇到串列順序更改的問題。countfor

提前謝謝了。

uj5u.com熱心網友回復：

你必須重新組織你的app_role_assignments，然后把它弄平。如果你想principal_object_id擁有多個值，它應該始終是一個list，即使是單個元素：

app_role_assignments = [
    {
       app_role_id        = random_uuid.test_app_read.result #"TestApp.Read"
       principal_object_id = [data.azuread_group.group_role_read.object_id,data.azuread_group.group2_role_read.object_id]
    },
    {
       app_role_id        = random_uuid.test_app_write.result #"TestApp.Write"
       principal_object_id = [data.azuread_group.group_role_write.object_id]
    },
    {
       app_role_id        = random_uuid.test_app_admin.result #"TestApp.Admin"
       principal_object_id = [data.azuread_group.group_role_write.object_id]
    }
  ]

那么你可以扁平化為：

locals {
  app_role_assignments_flat = merge([
      for val in var.app_role_assignments: {
        for principal_object_id in val["principal_object_id"]: 
            "${val.app_role_id}-${principal_object_id}" => {
                app_role_id = val.app_role_id
                principal_object_id = principal_object_id
          }
      }
    ]...) # please do NOT remove the dots
}

然后

resource "azuread_app_role_assignment" "role" {
  for_each            = local.app_role_assignments_flat
  app_role_id         = each.value["app_role_id"]
  principal_object_id = each.value["principal_object_id"]
  resource_object_id  = azuread_service_principal.sp.object_id
}

標籤：天蓝色 循环 for循环 地形 展平

上一篇：將數字添加到數字N次

下一篇：計算資料框中的夜晚長度