Terraform：如何动态映射选项名称与对应配置？

1. 声明适配的变量类型 #

你需要用map(object)类型的变量来存储每个选项的完整配置，以此实现option_name与专属设置的绑定。示例变量声明如下：

variable "db_options" {
  type = map(object({
    # 可选字段，按需添加或移除
    vpc_security_group_memberships = optional(list(string))
    option_settings = list(object({
      name  = string
      value = string
    }))
  }))
  description = "DB Option Group的选项配置，key对应option_name"
}

2. 配置变量示例值 #

对应你给出的硬编码示例，变量值可这样设置（比如在terraform.tfvars中）：

db_options = {
  "Timezone" = {
    option_settings = [
      {
        name  = "TIME_ZONE"
        value = "Europe/Berlin"
      }
    ]
  }
  "SSL" = {
    vpc_security_group_memberships = [aws_security_group.db-sg.id]
    option_settings = [
      {
        name  = "FIPS.SSLFIPS_140"
        value = "FALSE"
      },
      {
        name  = "SQLNET.CIPHER_SUITE"
        value = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
      },
      {
        name  = "SQLNET.SSL_VERSION"
        value = "1.2"
      }
    ]
  }
}

3. 用嵌套Dynamic块实现动态配置 #

在aws_db_option_group资源中，通过外层dynamic "option"遍历所有选项，内层dynamic "option_settings"遍历每个选项下的配置项：

resource "aws_db_option_group" "db-opt-grp" {
  name                     = var.db_option_group_name
  option_group_description = "DB Option Group managed by Terraform"
  engine_name              = var.db_server_engine_type
  major_engine_version     = var.db_major_engine_version

  # 遍历每个DB选项
  dynamic "option" {
    for_each = var.db_options
    content {
      option_name = option.key

      # 处理可选的安全组配置
      if lookup(option.value, "vpc_security_group_memberships", null) != null {
        vpc_security_group_memberships = option.value.vpc_security_group_memberships
      }

      # 遍历当前选项下的所有设置项
      dynamic "option_settings" {
        for_each = option.value.option_settings
        content {
          name  = option_settings.value.name
          value = option_settings.value.value
        }
      }
    }
  }
}

核心逻辑说明 #

• var.db_options的key直接作为option_name，value包含该选项的全部专属配置，保证每个选项的设置独立不重复。
• 嵌套的dynamic "option_settings"会自动遍历每个选项下的设置列表，生成对应配置块。
• 通过lookup和if语句处理可选字段，避免未配置时出现语法错误。

内容的提问来源于stack exchange，提问作者Saurabh