Terraform读取YAML文件时无法识别access_policies属性问题

问题场景 #

使用Terraform读取包含sites、keyvaults和access_policies的YAML配置文件，编写本地变量代码后执行terraform plan，报错提示该对象没有名为access_policies的属性，报错行位于遍历keyvault.access_policies的代码处。

相关配置 #

YAML配置文件（sites.yaml）

sites:
  - name: site1
    counter: "001"
    keyvaults:
      - name: "KV1"
        role_id: "0023"
        access_policies:
          SP1:
            object_id: "0000-0000-0000-00000"
            tenant_id: "xxxx-xxxx-xxxx-xxxx"
            certificate_permissions: ["Get"]
            key_permissions: []
            storage_permissions: []
            secret_permissions: ["Get"]

Terraform本地变量代码

locals {
  sites = yamldecode(file("${path.module}/sites.yaml"))["sites"]
  keyvaults = merge(flatten([
     for site in local.sites : {
      for keyvault in site.keyvaults : "${site.name}-${keyvault.name}" => {
        keyvault_name                 = keyvault.name
        keyvault_role_id              = keyvault.role_id
        counter                       = site.counter
        access_policies               = keyvault.access_policies
    }
   }
  ])...)
}

报错信息

Error: Unsupported attribute
│ 
│   on appservice_env.tf line 66, in locals:
│   66:           for policy_name, policy in tomap(keyvault.access_policies) : policy_name => {
│ 
│ This object does not have an attribute named "access_policies".

问题原因 #

核心原因有两个：

1. 部分keyvault未定义access_policies字段：即使当前示例YAML里有该字段，但实际环境中可能存在未配置access_policies的keyvault条目，Terraform遍历到这类条目时会因找不到属性报错。
2. YAML解析异常：示例YAML中的转义符\"属于冗余内容，可能导致解析后access_policies字段意外丢失，触发属性不存在错误。

解决方案 #

方案1：给所有keyvault添加默认空access_policies #

确保YAML中每个keyvault都包含该字段，空值也需显式声明：

sites:
  - name: site1
    counter: "001"
    keyvaults:
      - name: "KV1"
        role_id: "0023"
        access_policies:
          SP1:
            object_id: "0000-0000-0000-00000"
            tenant_id: "xxxx-xxxx-xxxx-xxxx"
            certificate_permissions: ["Get"]
            key_permissions: []
            storage_permissions: []
            secret_permissions: ["Get"]
      - name: "KV2"
        role_id: "0024"
        access_policies: {} # 显式声明空的access_policies

方案2：Terraform代码中添加默认值处理 #

在定义local.keyvaults时，用lookup函数为不存在的access_policies设置默认空映射：

locals {
  sites = yamldecode(file("${path.module}/sites.yaml"))["sites"]
  keyvaults = merge(flatten([
     for site in local.sites : {
      for keyvault in site.keyvaults : "${site.name}-${keyvault.name}" => {
        keyvault_name                 = keyvault.name
        keyvault_role_id              = keyvault.role_id
        counter                       = site.counter
        # 若access_policies不存在，默认返回空映射
        access_policies               = lookup(keyvault, "access_policies", {})
    }
   }
  ])...)
}

同时，遍历access_policies时也做安全处理：

for policy_name, policy in tomap(lookup(keyvault, "access_policies", {})) : policy_name => {
  # 你的policy处理逻辑
}

方案3：修正YAML语法错误 #

去掉YAML中冗余的转义符，确保解析正常：

sites:
  - name: site1
    counter: "001"
    keyvaults:
      - name: "KV1"
        role_id: "0023"
        access_policies:
          SP1:
            object_id: "0000-0000-0000-00000"
            tenant_id: "xxxx-xxxx-xxxx-xxxx"
            certificate_permissions: ["Get"]
            key_permissions: []
            storage_permissions: []
            secret_permissions: ["Get"]

内容的提问来源于stack exchange，提问作者mystack