Terraform 1.5.7中基于变量创建可选S3 Bucket Policy资源报错求助

问题根源 #

你的var.policy中包含了依赖apply阶段资源属性的插值（比如示例里的${local.name}），即使是明文内容，Terraform也会将其标记为「仅apply阶段可知」。此时var.policy != null的判断结果也会变成未知，导致count/for_each无法在plan阶段确定资源实例数量，触发报错。

解决方案 #

方案一：新增显式布尔控制变量（推荐）

通过新增一个布尔变量，显式控制是否创建bucket policy，彻底避开「apply阶段未知值」的问题。

模块变量定义修改：

variable "name" {
  description = "Name of S3 bucket"
  type        = string
}
variable "policy" {
  description = "Bucket policy content. Required if enable_bucket_policy is true"
  type        = string
  nullable    = true
  default     = null
}
variable "enable_bucket_policy" {
  description = "Whether to create an S3 bucket policy"
  type        = bool
  default     = false
}

模块主配置修改：

resource "aws_s3_bucket" "bucket" {
  bucket = var.name
}

resource "aws_s3_bucket_policy" "policy" {
  count  = var.enable_bucket_policy ? 1 : 0
  bucket = aws_s3_bucket.bucket.id
  policy = var.policy

  # 可选：添加前置验证，避免启用策略时未传入policy
  lifecycle {
    precondition {
      condition     = var.policy != null
      error_message = "policy must be provided when enable_bucket_policy is true."
    }
  }
}

使用示例：

locals {
  name = "testOptionalPolicy"
}

module "s3" {
  source                = "../../modules/s3"
  name                  = local.name
  enable_bucket_policy  = true
  policy                = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::${local.name}/*",
      "Principal": "*"
    }
  ]
}
EOF
}

方案二：使用for_each结合静态键（适用于不愿新增变量的场景）

如果不想新增变量，可将for_each的键设为静态值，仅在var.policy非空时包含该键。注意：此方案仅适用于var.policy是否为null的判断在plan阶段可确定的场景，若var.policy本身是未知值，仍会报错。

模块主配置修改：

resource "aws_s3_bucket_policy" "policy" {
  for_each = var.policy != null ? { "bucket_policy" = var.policy } : {}
  bucket   = aws_s3_bucket.bucket.id
  policy   = each.value
}

内容的提问来源于stack exchange，提问作者lony