Terraform中如何为指定子网动态添加资源参数而非块？

我在Terraform中使用对象映射在Azure部署子网列表，通过for_each遍历所有子网，已成功使用dynamic块为部分子网添加delegation块。现在需要为其中一个子网添加service_endpoint参数，但该参数是单个参数而非块，无法使用dynamic块实现，请问该如何处理？

原代码如下：

resource "azurerm_subnet" "subnets" {
  for_each             = var.subnets
  #name                 = "${each.key}${title(var.stage)}Subnet"
  name                 = each.key != "AzureBastion" ? "${each.key}${title(var.stage)}Subnet" : "${each.key}Subnet"
  address_prefixes     = each.value.address_prefix
  resource_group_name  = azurerm_resource_group.network_rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name

    dynamic "delegation" {
    for_each = each.value.databricks_subnet_delegation ? [each.key] : []
    content {
      name = "databricksDelegation"
      service_delegation {
        name = "Microsoft.Databricks/workspaces"
        actions = [
        "Microsoft.Network/virtualNetworks/subnets/join/action",
        "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
        "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"]
      }
    }
  }
service_endpoint : ##this should be added with only one of the subnets

}

针对单个子网设置service_endpoint参数，直接用条件表达式即可实现，无需依赖dynamic块。核心逻辑是：判断当前遍历的子网是否为目标子网，若是则指定对应的服务端点列表，否则传入空列表（或null，视Terraform版本和资源参数要求而定）。

假设要给名为ExampleSubnet的子网添加Microsoft.Storage类型的服务端点，修改后的代码如下：

resource "azurerm_subnet" "subnets" {
  for_each             = var.subnets
  name                 = each.key != "AzureBastion" ? "${each.key}${title(var.stage)}Subnet" : "${each.key}Subnet"
  address_prefixes     = each.value.address_prefix
  resource_group_name  = azurerm_resource_group.network_rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name

  dynamic "delegation" {
    for_each = each.value.databricks_subnet_delegation ? [each.key] : []
    content {
      name = "databricksDelegation"
      service_delegation {
        name = "Microsoft.Databricks/workspaces"
        actions = [
          "Microsoft.Network/virtualNetworks/subnets/join/action",
          "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
          "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"
        ]
      }
    }
  }

  # 条件设置service_endpoints参数
  service_endpoints = each.key == "ExampleSubnet" ? ["Microsoft.Storage"] : []
}

关键说明 #

• service_endpoints是AzureRM子网资源的参数，类型为list(string)，即使不需要设置，也要传入空列表而非留空。
• 将"ExampleSubnet"替换为实际需要添加服务端点的子网key值，["Microsoft.Storage"]替换为目标服务端点类型（如Microsoft.Sql、Microsoft.KeyVault等）。
• 若Terraform版本支持null作为参数值，也可写成each.key == "ExampleSubnet" ? ["Microsoft.Storage"] : null，AzureRM provider的子网资源service_endpoints参数支持null值。

内容的提问来源于stack exchange，提问作者pieter-jan goeman