如何在Terraform Heredoc字符串中引用map类型变量？

问题重现 #

你定义了如下Map类型变量：

variable somemap {
  type = map(string)
  default = {
    somekey = "abc"
  }
}

在Terraform模块中编写AWS IAM角色资源时，遇到JSON语法错误："assume_role_policy" contains an invalid JSON: invalid character ']'，代码如下：

resource "aws_iam_role" "role_name" {
  name = "RoleName"
  assume_role_policy = <<-TRUSTPOLICY
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "*"
          },
          "Action": [
            "sts:AssumeRole",
            "sts:TagSession"
          ],
          "Condition": {
            "StringLike": {
              "aws:PrincipalArn": [
                "${var.somemap["somekey"]}",
              ]
            }
          }
        }
      ]
    }
  TRUSTPOLICY
}

错误原因与解决方法 #

1. 直接报错原因：JSON数组的尾随逗号 #

报错的核心是JSON数组最后一个元素后多余的逗号——也就是"${var.somemap["somekey"]}",这行末尾的逗号。JSON语法不允许数组最后一项带尾随逗号，这会直接导致解析失败。

2. Heredoc中引用Map变量的正确方式 #

Heredoc字符串完全支持引用Map变量，问题出在引号嵌套的处理上，有两种可靠写法：

写法一：用单引号包裹Map的Key

避免和外层JSON的双引号冲突，Terraform能正确解析：

"${var.somemap['somekey']}"

写法二：使用Terraform模板插值语法%{}

这种方式无需处理引号嵌套，写法更简洁：

%{ var.somemap["somekey"] }

修正后的完整代码 #

resource "aws_iam_role" "role_name" {
  name = "RoleName"
  assume_role_policy = <<-TRUSTPOLICY
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "*"
          },
          "Action": [
            "sts:AssumeRole",
            "sts:TagSession"
          ],
          "Condition": {
            "StringLike": {
              "aws:PrincipalArn": [
                "${var.somemap['somekey']}"
              ]
            }
          }
        }
      ]
    }
  TRUSTPOLICY
}

或者使用模板插值语法的版本：

resource "aws_iam_role" "role_name" {
  name = "RoleName"
  assume_role_policy = <<-TRUSTPOLICY
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "*"
          },
          "Action": [
            "sts:AssumeRole",
            "sts:TagSession"
          ],
          "Condition": {
            "StringLike": {
              "aws:PrincipalArn": [
                "%{ var.somemap["somekey"] }"
              ]
            }
          }
        }
      ]
    }
  TRUSTPOLICY
}

内容的提问来源于stack exchange，提问作者Erik Asplund