Terraform动态嵌套对象读取：AWS Image Builder跨账号同区域镜像共享问题

问题背景 #

开发AWS Image Builder流水线时，需跨多账号多区域共享制作好的镜像。当前Terraform配置中，target_account_ids变量接收账号ID列表，但因AWS Image Builder要求每个区域在distribution配置中仅能出现一次，现有动态块会为每个账号生成单独的distribution块，导致同区域多账号时抛出重复区域的错误。

现有代码 #

variable.tf #

variable "target_account_ids" {
  type = list(map(string))
  default = [ {
    "region" = "eu-west-1"
    "account_id" = "123456789012"
  } ]
}

main.tf #

resource "aws_imagebuilder_distribution_configuration" "this" {
  name  = "image_builder_distribution_configuration"
  dynamic "distribution" {
    for_each = var.target_account_ids
    content {
      region = distribution.value["region"]
      ami_distribution_configuration {
        name               = "<name>"
        description        = "<description>"
        target_account_ids = [distribution.value["account_id"]]
        ami_tags = var.tags
      }
    }  
  }
  tags = var.tags
}

错误场景 #

当传入同区域多个账号时：

target_account_ids = [ 
  {
    "region" = "eu-central-1"
    "account_id" = "123456789012"
  },
  {
    "region" = "eu-central-1"
    "account_id" = "123456789013"
  },
  {
    "region" = "eu-west-1"
    "account_id" = "123456789014"
  }]

抛出错误：

Error: updating Image Builder Distribution Configuration (arn:aws:imagebuilder::<account_id>:distribution-configuration/): InvalidParameterValueException: The value supplied for parameter 'distributions' is not valid. A region may appear in a distribution configuration at most once.

解决方案 #

核心是先按区域对账号ID分组，让每个区域对应一个distribution块，将同区域的所有账号合并到target_account_ids列表中。通过Terraform的groupby函数实现分组，配合列表推导式生成目标结构。

修改后的main.tf：

resource "aws_imagebuilder_distribution_configuration" "this" {
  name  = "image_builder_distribution_configuration"
  
  # 按区域分组，为每个区域生成单个distribution块
  dynamic "distribution" {
    for_each = {
      for region_group in groupby(var.target_account_ids, "region") :
      region_group.key => region_group.values
    }
    content {
      region = distribution.key
      ami_distribution_configuration {
        name               = "<name>"
        description        = "<description>"
        # 提取当前区域下所有账号ID，合并为列表
        target_account_ids = [for account in distribution.value : account.account_id]
        ami_tags           = var.tags
      }
    }
  }
  
  tags = var.tags
}

代码说明 #

1. groupby(var.target_account_ids, "region")：将输入的账号列表按region字段分组，得到以区域名为键、对应账号对象列表为值的结构。
2. 动态块遍历逻辑：针对每个分组后的区域生成一个distribution块，确保每个区域仅出现一次。
3. 账号列表合并：通过列表推导式提取当前区域下所有账号的account_id，合并为符合要求的target_account_ids列表。

此修改既满足了AWS Image Builder的区域唯一性要求，又实现了同区域多账号的镜像共享。

内容的提问来源于stack exchange，提问作者L_sama