Terraform报错：空元组无效索引，求解决跨区域IAM角色创建问题

我希望仅在us-west-2区域运行Terraform代码时创建AWS IAM角色，其他区域不创建，但当前代码运行报错。

原代码 #

resource "aws_iam_role" "trino_s3_ssm_sync" {
  count = var.region == "us-west-2" ? 1 : 0
  name               = "trino-s3-ssm-sync"
  assume_role_policy = data.aws_iam_policy_document.trust_ssm_sync[0].json
}

resource "aws_lambda_function" "trino_s3_ssm_sync" {
  filename         = data.archive_file.trino_s3_ssm_sync.output_path
  function_name    = "trino-users-s3-ssm-sync"
  role             = aws_iam_role.trino_s3_ssm_sync[0].arn
  handler          = "trino-users-s3-ssm-sync.lambda_handler"
  source_code_hash = data.archive_file.trino_s3_ssm_sync.output_base64sha256
  timeout          = 300
  runtime          = "python3.8"
  tags             = merge(local.common_tags)

  environment {
  }
}

报错信息 #

错误：无效索引
│
│ 在ssm_sync_lambda.tf第89行，resource "aws_lambda_function" "trino_s3_ssm_sync"中：
│ 89: role = aws_iam_role.trino_s3_ssm_sync[0].arn
│ ├────────────────
│ │ aws_iam_role.trino_s3_ssm_sync是空元组
│
│ 给定的键未标识此集合值中的元素：集合没有元素。

解决方案 #

问题核心是：非us-west-2区域时，IAM角色的count为0，变成空元组，Lambda代码硬写[0]索引会直接报错。需要同步给Lambda添加区域条件，并规范资源引用方式。

修改后的代码 #

resource "aws_iam_role" "trino_s3_ssm_sync" {
  count = var.region == "us-west-2" ? 1 : 0
  name               = "trino-s3-ssm-sync"
  assume_role_policy = data.aws_iam_policy_document.trust_ssm_sync[0].json
}

resource "aws_lambda_function" "trino_s3_ssm_sync" {
  # 同步添加区域条件，非目标区域不创建Lambda
  count = var.region == "us-west-2" ? 1 : 0
  
  filename         = data.archive_file.trino_s3_ssm_sync.output_path
  function_name    = "trino-users-s3-ssm-sync"
  # 用count.index关联对应角色，避免空索引错误
  role             = aws_iam_role.trino_s3_ssm_sync[count.index].arn
  handler          = "trino-users-s3-ssm-sync.lambda_handler"
  source_code_hash = data.archive_file.trino_s3_ssm_sync.output_base64sha256
  timeout          = 300
  runtime          = "python3.8"
  tags             = merge(local.common_tags)

  environment {
  }
}

补充说明 #

如果需求是所有区域都要创建Lambda，但仅us-west-2用这个角色，可以给role字段加条件判断（需确保默认角色存在）：

role = var.region == "us-west-2" ? aws_iam_role.trino_s3_ssm_sync[0].arn : "arn:aws:iam::你的账号ID:role/默认角色名"

内容的提问来源于stack exchange，提问作者Anmol