Terraform嵌套Map/List变量用于for_each多资源创建报错排查

问题核心 #

你定义的private_endpoints变量类型是list(object)，但在terraform.tfvars里传入的是Map格式的配置。Terraform对变量类型校验严格，这直接导致了「Invalid value for input variable」错误。单条配置能运行是因为你误把单个Map当成了List里的唯一元素，多条时类型不匹配的问题就会直接暴露。

方案1：将变量改为map(object)（推荐） #

用Map来定义配置更适配for_each，每个资源有唯一键，后续修改配置时不会因为顺序变化触发资源重建，管理更灵活。

1. 修正variables.tf的变量定义

variable "private_endpoints" {
  type = map(object({
    name                = string
    resource_group_name = string
    subnet_id           = string
    service_resource_id = string
    subresource_names   = list(string)
    # 按需添加其他必填字段
  }))
  description = "Private endpoint configurations mapped by unique identifier"
  default     = {} # 可选默认值
}

2. 保持terraform.tfvars的Map格式配置
   这部分不用改，保留你原本的写法即可：

private_endpoints = {
  storage_pe = {
    name                = "pe-storage-01"
    resource_group_name = "rg-dev"
    subnet_id           = "/subscriptions/xxx/resourceGroups/rg-dev/providers/Microsoft.Network/virtualNetworks/vnet-dev/subnets/snet-pe"
    service_resource_id = "/subscriptions/xxx/resourceGroups/rg-dev/providers/Microsoft.Storage/storageAccounts/stgdev01"
    subresource_names   = ["blob"]
  }
  sql_pe = {
    name                = "pe-sql-01"
    resource_group_name = "rg-dev"
    subnet_id           = "/subscriptions/xxx/resourceGroups/rg-dev/providers/Microsoft.Network/virtualNetworks/vnet-dev/subnets/snet-pe"
    service_resource_id = "/subscriptions/xxx/resourceGroups/rg-dev/providers/Microsoft.Sql/servers/sql-dev-01"
    subresource_names   = ["sqlServer"]
  }
}

3. main.tf中用for_each遍历Map

resource "azurerm_private_endpoint" "this" {
  for_each             = var.private_endpoints
  name                 = each.value.name
  resource_group_name  = each.value.resource_group_name
  location             = azurerm_resource_group[each.value.resource_group_name].location
  subnet_id            = each.value.subnet_id

  private_service_connection {
    name                           = "${each.value.name}-conn"
    private_connection_resource_id = each.value.service_resource_id
    subresource_names              = each.value.subresource_names
    is_manual_connection           = false
  }
}

方案2：保持list(object)变量，修正tfvars格式 #

如果一定要用List类型，需要把tfvars里的配置改成List结构，同时给for_each生成唯一键避免资源意外重建。

1. variables.tf保留原定义

variable "private_endpoints" {
  type = list(object({
    name                = string
    resource_group_name = string
    subnet_id           = string
    service_resource_id = string
    subresource_names   = list(string)
  }))
  description = "List of private endpoint configurations"
}

2. 修改terraform.tfvars为List格式
   把原本的Map外层改成数组：

private_endpoints = [
  {
    name                = "pe-storage-01"
    resource_group_name = "rg-dev"
    subnet_id           = "/subscriptions/xxx/resourceGroups/rg-dev/providers/Microsoft.Network/virtualNetworks/vnet-dev/subnets/snet-pe"
    service_resource_id = "/subscriptions/xxx/resourceGroups/rg-dev/providers/Microsoft.Storage/storageAccounts/stgdev01"
    subresource_names   = ["blob"]
  },
  {
    name                = "pe-sql-01"
    resource_group_name = "rg-dev"
    subnet_id           = "/subscriptions/xxx/resourceGroups/rg-dev/providers/Microsoft.Network/virtualNetworks/vnet-dev/subnets/snet-pe"
    service_resource_id = "/subscriptions/xxx/resourceGroups/rg-dev/providers/Microsoft.Sql/servers/sql-dev-01"
    subresource_names   = ["sqlServer"]
  }
]

3. main.tf中转换List为Map给for_each
   用每个endpoint的name作为唯一键（确保name不重复）：

resource "azurerm_private_endpoint" "this" {
  for_each = { for pe in var.private_endpoints : pe.name => pe }
  
  name                 = each.value.name
  resource_group_name  = each.value.resource_group_name
  location             = azurerm_resource_group[each.value.resource_group_name].location
  subnet_id            = each.value.subnet_id

  private_service_connection {
    name                           = "${each.value.name}-conn"
    private_connection_resource_id = each.value.service_resource_id
    subresource_names              = each.value.subresource_names
    is_manual_connection           = false
  }
}

注意事项 #

• 确保object定义的字段和azurerm_private_endpoint资源要求的字段完全匹配，字段缺失或类型不匹配也会触发类似错误。
• 优先选择方案1，Map结构的配置更稳定，后续调整配置时不会因为List顺序变化导致资源重建。

内容的提问来源于stack exchange，提问作者koti eleswaram