如何在不修改local变量的前提下简化Terraform的for_each配置

原for_each配置 #

for_each = merge([
    for virtual_network in local.virtual_networks : merge({
      for subnet in virtual_network.subnets : "${virtual_network.name}\\${subnet.name}" => {
        network_security_group = subnet.network_security_group
        resource_group_name    = virtual_network.resource_group_name
      } if try(subnet.network_security_group, null) != null
    })
  ]...)

本地变量local.virtual_networks结构 #

virtual_networks = [
  {
    name                = "vnet-uks-001"
    resource_group_name = "network-uks-001"
    subnets             = [
      {
        name                   = "PrivateEndpoints"
        address_prefixes       = ["10.1.0.0/24"]
        network_security_group = "nsg-uks-001"
      },
      {
        name                   = "snet-uks-001"
        address_prefixes       = ["10.1.1.0/26"]
        network_security_group = "nsg-uks-002"
      },
      {
        name             = "snet-uks-002"
        address_prefixes = ["10.1.2.0/26"]
      }
    ]
  }
]

预期输出 #

{
  "vnet-uks-001\\PrivateEndpoints" = {
    network_security_group = "nsg-uks-001"
    resource_group_name    = "network-uks-001"
  }
  "vnet-uks-001\\snet-uks-001" = {
    network_security_group = "nsg-uks-002"
    resource_group_name    = "network-uks-001"
  }
}

优化后的for_each配置 #

原配置运行正常，在不修改上述本地变量的前提下，可通过以下方式提升可读性：

for_each = merge([
    for virtual_network in local.virtual_networks : {
      for subnet in virtual_network.subnets : "${virtual_network.name}\\${subnet.name}" => {
        network_security_group = subnet.network_security_group
        resource_group_name    = virtual_network.resource_group_name
      } if can(subnet.network_security_group)
    }
  ]...)

优化说明 #

• 移除内层冗余的merge()调用，直接用{...}生成映射结构，减少不必要的嵌套
• 将条件判断try(subnet.network_security_group, null) != null替换为更简洁的can(subnet.network_security_group)，语义更直观：直接检查subnet.network_security_group字段是否存在且可正常访问

内容的提问来源于stack exchange，提问作者Jeffrey