Terraform报错：aws_ssm_parameter的value需字符串，传递endpoint_id失败

架构老林

2026-7-1

Terraform SSM参数值类型不匹配问题解决

错误信息

│ 在main.tf第40行的resource "aws_ssm_parameter" "the_cloud_ngfw_endpoint"中：::error::Terraform以代码1退出。│
40: value = cloudngfwaws_ngfw.the_cloud_ngfw[*].status[0].attachment[0].endpoint_id
│ ├──────────────── │ │ cloudngfwaws_ngfw.the_cloud_ngfw是包含2个元素的元组 │ │ 属性"value"的值不恰当：需要字符串类型。

问题原因

cloudngfwaws_ngfw.the_cloud_ngfw是通过count创建的包含2个实例的元组，使用splat表达式（[*]）会提取所有实例的endpoint_id生成列表，但aws_ssm_parameter的value字段要求是单个字符串，类型不匹配导致报错。同时两个资源都用了count = length(local.subnet_id_list)，每个SSM参数需要对应单个NGFW实例的endpoint_id，用splat表达式会把所有值传给每个参数，逻辑也不匹配。

修正后的代码

resource "cloudngfwaws_ngfw" "the_cloud_ngfw" {
  count  = length(local.subnet_id_list)
  name        = "${var.projectname}-cloudngfw1-${local.account_id}-${local.az_list[count.index]}-${count.index}"
  vpc_id      = local.vpc_id
  account_id  = local.account_id
  description = "NGFW resource for Project ${var.projectname}"
  endpoint_mode = "ServiceManaged"
  subnet_mapping {
    subnet_id = local.subnet_id_list[count.index]
  }
  rulestack = "${var.env_name}-${var.rule_stack_name}"
  tags = {
    project = var.projectname
  }
}

resource "aws_ssm_parameter" "the_cloud_ngfw_endpoint" {
  count  = length(local.subnet_id_list)
  name  = "/test/endpoint${count.index}"
  type  = "String"
  # 通过count.index匹配对应位置的NGFW实例，获取单个endpoint_id字符串
  value = cloudngfwaws_ngfw.the_cloud_ngfw[count.index].status[0].attachment[0].endpoint_id
}