Terraform从cloudngfwaws_ngfw获取VPCE ID时遇列表对象属性访问错误

我尝试从cloudngfwaws_ngfw资源中获取endpoint_id并存储到SSM参数中，遇到以下错误：

Can't access attributes on a list of objects. Did you mean to access the attribute "attachment" for a specific element of the list, or across all elements of the list?

原代码如下：

resource "cloudngfwaws_ngfw" "the_cloud_ngfw" {
  count  = length(local.subnet_id_list)
  name        = "${var.projectname}-cloudngfw-${local.account_id}-${local.az_list[count.index]}-${count.index}"
  vpc_id      = local.vpc_id
  account_id  = local.account_id
  description = "NGFW resource for Project ${var.projectname}"
  endpoint_mode = "ServiceManaged"
  subnet_mapping {
    subnet_id = local.subnet_id_list[count.index]
  }
  rulestack = "${var.env_name}-${var.rule_stack_name}"
  tags = {
    project = var.projectname
  }
}

resource "aws_ssm_parameter" "the_cloud_ngfw_endpoint" {
  count  = length(local.subnet_id_list)
  name  = "myngfw/endpoint${count.index}"
  type  = "String"
  value = cloudngfwaws_ngfw.the_cloud_ngfw[*].status.attachment.endpoint_id
}

错误原因 #

cloudngfwaws_ngfw.the_cloud_ngfw[*].status.attachment.endpoint_id会生成一个包含所有NGFW实例endpoint_id的列表，但每个aws_ssm_parameter实例仅需对应单个NGFW的endpoint_id。由于两个资源都使用了count，每个SSM参数需要匹配同索引的NGFW实例，不能用列表展开语法[*]来批量取值。

修正后的代码 #

resource "cloudngfwaws_ngfw" "the_cloud_ngfw" {
  count  = length(local.subnet_id_list)
  name        = "${var.projectname}-cloudngfw-${local.account_id}-${local.az_list[count.index]}-${count.index}"
  vpc_id      = local.vpc_id
  account_id  = local.account_id
  description = "NGFW resource for Project ${var.projectname}"
  endpoint_mode = "ServiceManaged"
  subnet_mapping {
    subnet_id = local.subnet_id_list[count.index]
  }
  rulestack = "${var.env_name}-${var.rule_stack_name}"
  tags = {
    project = var.projectname
  }
}

resource "aws_ssm_parameter" "the_cloud_ngfw_endpoint" {
  count  = length(local.subnet_id_list)
  name  = "myngfw/endpoint${count.index}"
  type  = "String"
  # 通过count.index定位到对应索引的NGFW实例，提取单个endpoint_id
  value = cloudngfwaws_ngfw.the_cloud_ngfw[count.index].status.attachment.endpoint_id
}

说明 #

修改后，每个aws_ssm_parameter实例会精准匹配同索引的cloudngfwaws_ngfw实例，正确提取单个endpoint_id值，解决了列表对象属性访问的错误。

内容的提问来源于stack exchange，提问作者Dalal Alghomlas