Terraform如何从Map中取值并赋值给本地变量？

要实现仅为需要的Lambda创建aws_lambda_permission资源，核心是过滤出method_path不等于"false"的Lambda条目，而非针对单个Lambda做全局判断。具体修改如下：

1. 修正本地变量定义 #

替换原有的add_method_path，创建一个过滤后的Lambda映射，仅保留需要配置权限的实例：

locals {
  # 筛选出method_path不为"false"的Lambda函数
  lambdas_with_permission = {
    for k, v in var.lambda_function : k => v
    if v.method_path != "false"
  }
}

2. 调整Lambda权限资源的for_each #

将aws_lambda_permission的for_each指向上述过滤后的映射，这样只会为符合条件的Lambda生成权限资源：

resource "aws_lambda_permission" "lmp" {
  for_each      = local.lambdas_with_permission
  statement_id  = "AllowAPIGatewayInvoke-${each.key}" # 添加唯一ID避免冲突
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lm[each.key].function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${var.ag_id}/*${each.value.method_path}"
}

额外修正点 #

• 你的aws_lambda_function资源中for_each使用了var.lambda_function_l3，但变量定义里只有var.lambda_function，属于笔误，需修正为var.lambda_function否则会报错。
• layers字段判断逻辑有误，原代码中each.value.layer1 == "null"应改为each.value.layers == null，结合变量定义调整后：

layers = each.value.layers != null ? [aws_lambda_layer_version.lm[each.value.layers[0]].arn] : null

（注：若layers是多元素列表，可根据实际需求调整取值逻辑）

完整修改后的核心代码片段 #

main.tf #

locals {
  lambdas_with_permission = {
    for k, v in var.lambda_function : k => v
    if v.method_path != "false"
  }
}

resource "aws_lambda_function" "lm" {
  for_each      = var.lambda_function # 修正笔误
  s3_bucket     = aws_s3_bucket.lm.id
  s3_key        = "code/${each.value.s3_key}"
  function_name = "lm-${var.stack_id}-${each.key}"
  role          = aws_iam_role.lm[each.value.role].arn
  handler       = "index.${each.value.handler}"
  runtime       = each.value.runtime
  memory_size   = each.value.memory_size
  layers        = each.value.layers != null ? [aws_lambda_layer_version.lm[each.value.layers[0]].arn] : null
  depends_on    = [aws_lambda_layer_version.lm]
  
  environment {
    variables = each.value.env_key
  }
  
  vpc_config {
    subnet_ids         = [local.subnet_private[0], local.subnet_private[5]]
    security_group_ids = ["sg-0591b309a73f15dd4"]
  }
}

resource "aws_lambda_permission" "lmp" {
  for_each      = local.lambdas_with_permission
  statement_id  = "AllowAPIGatewayInvoke-${each.key}"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lm[each.key].function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${var.ag_id}/*${each.value.method_path}"
}

内容的提问来源于stack exchange，提问作者Jefraibo