如何在Terraform仅支持字符串时，通过Terragrunt传入数组型密钥库访问策略

当前Terraform配置中，Key Vault的每个访问策略对应单个Object ID，希望实现传入数组形式的多个Object ID并复用相同权限配置，同时将这些ID存入全局变量文件供多环境复用，修改object_id类型为set(string)后报错object_id must be string，以下是解决方法：

1. 调整变量定义（variables.tf） #

修改access_policies变量的结构，将原object_id字段改为object_ids，支持传入字符串集合：

variable "access_policies" {
  type = set(
    object({
      object_ids = set(string),
      secret_permissions = set(string),
      key_permissions = set(string)
    })
  )
}

2. 修改Key Vault资源配置（main.tf） #

通过嵌套动态块+flatten函数，将每个权限组内的Object ID拆分为独立的access_policy块，同时复用相同的权限配置：

resource "azurerm_key_vault" "example" {
  name                        = "examplekeyvault"
  location                    = azurerm_resource_group.example.location
  resource_group_name         = azurerm_resource_group.example.name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days  = 7
  purge_protection_enabled    = false
  sku_name                    = "standard"

  dynamic "access_policy" {
    for_each = flatten([
      for policy in var.access_policies : [
        for obj_id in policy.object_ids : {
          object_id          = obj_id
          secret_permissions = policy.secret_permissions
          key_permissions    = policy.key_permissions
        }
      ]
    ])
    content {
      tenant_id           = data.azurerm_client_config.current.tenant_id
      object_id           = access_policy.value.object_id
      secret_permissions  = access_policy.value.secret_permissions
      key_permissions     = access_policy.value.key_permissions
    }
  }
}

3. 配置全局变量（global_var.hcl） #

在全局变量文件中定义多环境复用的Object ID集合：

locals {
  shared_object_ids = ["xyz", "abc"]
}

4. 在Terragrunt中引用全局变量（keyvault/terragrunt.hcl） #

引入全局变量并按新结构传入访问策略配置：

include "global" {
  path = find_in_parent_folders("global_var.hcl")
}

inputs = {
  access_policies = [
    {
      object_ids = local.global.shared_object_ids,
      secret_permissions = ["Get", "Set"],
      key_permissions = ["Get"]
    },
    {
      object_ids = ["def"],
      secret_permissions = ["Get"],
      key_permissions = ["Get"]
    }
  ]
}

说明 #

Azure Key Vault的access_policy块要求object_id必须为单个字符串，无法直接传入数组。上述方案通过Terraform的嵌套循环和flatten函数，将每个Object ID拆分为独立的访问策略块，既满足Azure API的要求，又实现了多ID复用同一权限配置的需求，同时通过全局变量实现了ID的跨环境复用。

内容的提问来源于stack exchange，提问作者Ashraf Baig