如何为动态GSI块的读写容量设置ignore_changes？

我尝试为下述代码块中的GSI读写容量添加ignore_changes配置，但多次尝试均未成功。

main.tf 代码 #

resource "aws_dynamodb_table" "default" {
  count            = var.enabled ? 1 : 0
  name             = var.name
  billing_mode     = var.billing_mode
  read_capacity    = var.dynamodb_read_capacity
  write_capacity   = var.dynamodb_write_capacity
  hash_key         = var.hash_key
  range_key        = var.range_key
  stream_enabled   = var.enable_streams
  stream_view_type = var.enable_streams ? var.stream_view_type : ""

  server_side_encryption {
    enabled = var.enable_encryption
    kms_key_arn = var.kms_key_arn
  }

  point_in_time_recovery {
    enabled = var.enable_point_in_time_recovery
  }

  dynamic "attribute" {
    for_each = local.attributes_final
    content {
      name = attribute.value.name
      type = attribute.value.type
    }
  }

  dynamic "global_secondary_index" {
    for_each = var.global_secondary_index_map
    content {
      hash_key           = global_secondary_index.value.hash_key
      name               = global_secondary_index.value.name
      non_key_attributes = lookup(global_secondary_index.value, "non_key_attributes", null)
      projection_type    = global_secondary_index.value.projection_type
      range_key          = lookup(global_secondary_index.value, "range_key", null)
      read_capacity      = lookup(global_secondary_index.value, "read_capacity", null)
      write_capacity     = lookup(global_secondary_index.value, "write_capacity", null)
    }
  }

  ttl {
    attribute_name = var.ttl_attribute
    enabled        = var.ttl_attribute != "" && var.ttl_attribute != null ?  true : false
  }

  tags = var.tags

  lifecycle {
//    ignore_changes = [
//      read_capacity,
//      write_capacity,
//      global_secondary_index[*].read_capacity,
//      global_secondary_index[*].write_capacity
//    ]
    prevent_destroy = true
  }
}

模块调用代码 #

module "test" {
  source                        = "../tf-module/dynamodb"
  enabled                       = local.env == "uat" ? false : local.env == "lt" ? false : local.env == "prod" ? true : false
  name                          = "${local.env}-test"
  hash_key                      = "testhashkey"
  dynamodb_read_capacity        = local.test-read
  dynamodb_write_capacity       = local.test-write
  read_target_value             = local.test-read-target-value
  write_target_value            = local.test-write-target-value
  enable_point_in_time_recovery = local.env == "prod" ? true : false
  tags                          = merge(tomap({ "Name" = join("-", [local.env, local.project, "test"]) }), tomap({ "ResourceType" = "dynamodb" }), local.common_tags)
}

遇到的错误 #

第一次尝试使用global_secondary_index[*].read_capacity和global_secondary_index[*].write_capacity时，出现错误：

│ Error: Invalid expression
│
│   on ../tf-module/dynamodb/main.tf line 108, in resource "aws_dynamodb_table" "default":
│  108:       global_secondary_index[*].write_capacity
│
│ A single static variable reference is required: only attribute access and indexing with constant keys. No calculations, function calls, template expressions, etc are allowed here.

第二次尝试使用global_secondary_index.read_capacity和global_secondary_index.write_capacity时，出现错误：

│   on ../tf-module/dynamodb/main.tf line 107, in resource "aws_dynamodb_table" "default":
│  107:       global_secondary_index.read_capacity
│
│ Block type "global_secondary_index" is represented by a set of objects, and set elements do not have addressable keys. To find elements matching specific criteria, use a "for" expression with an "if" clause.

解决方案 #

global_secondary_index属于集合类型的块，无法直接通过属性路径引用其内部字段，需要使用for表达式遍历每个GSI元素，指定要忽略的读写容量属性。修改lifecycle块如下：

lifecycle {
  ignore_changes = [
    read_capacity,
    write_capacity,
    for gsi in global_secondary_index : gsi.read_capacity,
    for gsi in global_secondary_index : gsi.write_capacity
  ]
  prevent_destroy = true
}

这种写法会精准忽略所有GSI的读写容量配置，同时保留对GSI其他属性（如索引名称、投影类型等）的管理能力。如果后续需要重新通过Terraform管理GSI的读写容量，只需移除对应的ignore_changes条目即可。

内容的提问来源于stack exchange，提问作者tamjidul islam