Terraform中如何过滤aws_identitystore_groups列表提取指定组？

场景说明 #

通过aws_identitystore_groups数据源获取AWS Identity Center中的所有组，代码如下：

data "aws_identitystore_groups" "this" {
  identity_store_id = local.identity_store_id
}

locals {
  all_groups = data.aws_identitystore_groups.this
}

local.all_groups的输出结构（完整内容）：

groups= [
  {
    description = "Group with ReadOnly access to my app dev env"
    display_name= "GROUP01"
    external_ids= [
      {
        id = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
        issuer = "https://scim.aws.com/zzzzzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
      },
    ]
    group_id= "11111111-1111-1111-1111-111111111111"
    identity_store_id = "d-yyyyyyyyyy"
  },
  {
    description = "Group with ReadOnly access to my app prod env"
    display_name= "GROUP02"
    external_ids= [
      {
        id = "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
        issuer = "https://scim.aws.com/zzzzzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
      },
    ]
    group_id= "22222222-2222-2222-2222-222222222222"
    identity_store_id = "d-yyyyyyyyyy"
  },
  {
    description = "Group with developer access to my app"
    display_name= "GROUP03"
    external_ids= [
      {
        id = "cccccccc-cccc-cccc-cccc-cccccccccccc"
        issuer = "https://scim.aws.com/zzzzzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
      },
    ]
    group_id= "33333333-3333-3333-3333-333333333333"
    identity_store_id = "d-yyyyyyyyyy"
  },
]

报错情况 #

尝试提取display_name= "GROUP02"的条目时，以下两种写法均报错：

写法1 #

my_group = [ for val in local.all_groups : val if val.display_name == "GROUP02" ]

报错信息：

│ Error: Unsupported attribute
│ 
│   on modules/sample/main.tf line 16, in locals:
│   16:   my_group = [ for val in local.all_groups : val if val.display_name == "GROUP02" ]
│ 
│ Can't access attributes on a list of objects. Did you mean to access attribute "display_name" for a specific element of the list, or across all elements of the list?

写法2 #

my_group = { for k, val in local.all_groups : k => val if val.display_name == "GROUP02" }

报错信息：

Error: Unsupported attribute
│ 
│   on modules/sample/main.tf line 16, in locals:
│   16:   my_group = { for k, val in local.all_groups : k => val if val.display_name == "GROUP02" }
│ 
│ Can't access attributes on a list of objects. Did you mean to access attribute "display_name" for a specific element of the list, or across all elements of the list?

解决方法 #

核心问题是local.all_groups指向的是整个数据源对象，而非存储组列表的groups属性。需要调整遍历目标为数据源的groups列表，有两种实现方式：

方式1：修正local变量定义 #

先将local.all_groups指向数据源的groups属性：

locals {
  all_groups = data.aws_identitystore_groups.this.groups
}

再使用原列表推导式即可：

my_group = [for val in local.all_groups : val if val.display_name == "GROUP02"]

方式2：直接遍历数据源的groups属性 #

无需修改local变量，直接在推导式中访问data.aws_identitystore_groups.this.groups：

my_group = [for val in data.aws_identitystore_groups.this.groups : val if val.display_name == "GROUP02"]

最终结果 #

执行上述正确写法后，my_group将得到期望的结果：

groups= [
  {
    description = "Group with ReadOnly access to my app prod env"
    display_name= "GROUP02"
    external_ids= [
      {
        id = "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
        issuer = "https://scim.aws.com/zzzzzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
      },
    ]
    group_id= "22222222-2222-2222-2222-222222222222"
    identity_store_id = "d-yyyyyyyyyy"
  },
]

内容的提问来源于stack exchange，提问作者user2196728