Terraform动态块中Condition仅获取单个值问题求助

问题场景 #

本地变量定义了CloudFront ID列表：

locals {
  cf_ids = [
    "E1DZ7XXXXX",
    "E2M7SXXXXX",
    "E1VABXXXXX"
  ]
}

尝试通过aws_iam_policy_document生成IAM策略时，使用dynamic "condition"遍历ID列表，但最终输出的Condition仅包含最后一个CloudFront ID：

原策略代码 #

data "aws_iam_policy_document" "cf_policy_for_s3" {
  statement {
    sid     = "CloudFrontPermissions"
    effect  = "Allow"
    actions = ["s3:GetObject"]
    resources = [
      "arn:aws:s3:::xxxxxxxxxx/*"
    ]

    dynamic "condition" {
      for_each = local.cf_ids
      content {
        test     = "StringEquals"
        variable = "AWS:SourceArn"
        values = ["arn:aws:cloudfront::123456789:distribution/${condition.value}"]
      }
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

实际输出 #

+ Condition = {
    + StringEquals = {
        + "AWS:SourceArn" = [
            "arn:aws:cloudfront::123456789:distribution/E2M7SXXXXX"
          ]
      }
  }

期望输出 #

+ Condition = {
    + StringEquals = {
        + "AWS:SourceArn" = [
            "arn:aws:cloudfront::123456789:distribution/E1DZ7XXXXX",
            "arn:aws:cloudfront::123456789:distribution/E2M7SXXXXX",
            "arn:aws:cloudfront::123456789:distribution/E1VABXXXXX"
          ]
      }
  }

解决方案 #

问题根源是dynamic "condition"会为每个CloudFront ID生成独立的Condition块，而IAM策略中同名的Condition会被覆盖，最终仅保留最后一个。正确做法是在单个Condition块中，通过Terraform的for表达式生成包含所有CloudFront ARN的values数组：

data "aws_iam_policy_document" "cf_policy_for_s3" {
  statement {
    sid     = "CloudFrontPermissions"
    effect  = "Allow"
    actions = ["s3:GetObject"]
    resources = [
      "arn:aws:s3:::xxxxxxxxxx/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      # 使用for表达式遍历cf_ids生成完整ARN列表
      values = [for id in local.cf_ids : "arn:aws:cloudfront::123456789:distribution/${id}"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

这样生成的策略会将所有CloudFront ID对应的ARN加入到AWS:SourceArn的values列表中，符合期望输出。

内容的提问来源于stack exchange，提问作者Alok Nath