配置资源锁遇Missing map element错误，lock_level变量问题排查

变量定义（variable.tf） #

variable "private_dns_zones_for_public_endpoint" {
  type = map(object({
    resource_group_name       = string
    name                      = string
    virtual_network_link_name = string
    lock_level                = optional(string)
  }))
  default     = {}
}

资源配置（main.tf） #

resource "azurerm_management_lock" "this-private_dns_zone" {
  for_each = {for key,value in var.private_dns_zones_for_public_endpoint : key => value if coalesce(var.private_dns_zones_for_public_endpoint.lock_level, var.lock.kind) != "None"}
  name = coalesce(data.azurerm_private_dns_zone.public_endpoint[each.value].name, "lock-${data.azurerm_private_dns_zone.public_endpoint[each.value].name}")
  scope = data.azurerm_private_dns_zone.public_endpoint[each.value].id
  lock_level = var.lock.kind
}

错误信息 #

│ Error: Missing map element
│
│   on ../../main.tf line 639, in resource "azurerm_management_lock" "this-private_dns_zone":
│  639:   for_each = {for key,value in var.private_dns_zones_for_public_endpoint : key => value if coalesce(var.private_dns_zones_for_public_endpoint.lock_level, var.lock.kind) != "None"}
│     ├────────────────
│     │ var.private_dns_zones_for_public_endpoint is map of object with 3 elements
│
│ This map does not have an element with the key "lock_level".

问题原因 #

var.private_dns_zones_for_public_endpoint 是对象类型的Map，lock_level 是Map中每个对象的属性，而非Map本身的键。代码中直接用var.private_dns_zones_for_public_endpoint.lock_level，相当于试图从整个Map中取名为lock_level的键，必然触发错误。

解决方案 #

修改for_each的条件判断，将var.private_dns_zones_for_public_endpoint.lock_level替换为迭代时的当前对象属性value.lock_level；同时修正数据资源的索引方式（用Map的key而非value索引更合理）：

resource "azurerm_management_lock" "this-private_dns_zone" {
  for_each = {for key,value in var.private_dns_zones_for_public_endpoint : key => value if coalesce(value.lock_level, var.lock.kind) != "None"}
  name = coalesce(data.azurerm_private_dns_zone.public_endpoint[each.key].name, "lock-${data.azurerm_private_dns_zone.public_endpoint[each.key].name}")
  scope = data.azurerm_private_dns_zone.public_endpoint[each.key].id
  lock_level = var.lock.kind
}

内容的提问来源于stack exchange，提问作者shameera2008