Terraform遍历GCF时处理https_trigger与event_trigger冲突问题

1. 调整JSON配置，明确触发类型 #

给每个函数的触发类型做明确标记，避免参数混放：

[
  {
    "name": "http-test-func",
    "runtime": "nodejs20",
    "trigger_type": "http",
    "http_settings": {
      "url": "https://us-central1-your-project.cloudfunctions.net/http-test-func"
    }
  },
  {
    "name": "storage-event-func",
    "runtime": "nodejs20",
    "trigger_type": "event",
    "event_settings": {
      "event_type": "google.storage.object.finalize",
      "resource": "projects/_/buckets/your-bucket",
      "service_account_email": "cloud-functions@system.gserviceaccount.com"
    }
  }
]

2. Terraform用动态块按需生成触发配置 #

核心思路是只在需要的时候才生成对应触发块，彻底避免同时声明两个互斥块：

locals {
  func_configs = jsondecode(file("${path.module}/functions-config.json"))
}

resource "google_cloudfunctions_function" "all_funcs" {
  for_each = { for func in local.func_configs : func.name => func }

  name        = each.value.name
  runtime     = each.value.runtime
  entry_point = "handler"
  source_archive_bucket = "your-source-bucket"
  source_archive_object = "${each.value.name}.zip"

  # 仅当触发类型为http时，生成https_trigger块
  dynamic "https_trigger" {
    for_each = each.value.trigger_type == "http" ? [1] : []
    content {
      url = each.value.http_settings.url
    }
  }

  # 仅当触发类型为event时，生成event_trigger块
  dynamic "event_trigger" {
    for_each = each.value.trigger_type == "event" ? [1] : []
    content {
      event_type            = each.value.event_settings.event_type
      resource              = each.value.event_settings.resource
      service_account_email = each.value.event_settings.service_account_email
    }
  }
}

错误原因说明 #

之前的写法之所以报错，是因为Terraform中只要声明了https_trigger或event_trigger块，哪怕内部参数设为null或false，Terraform仍会将该块传递给GCP API。而GCP Cloud Functions API强制要求两种触发方式二选一，因此触发互斥校验错误。

用动态块的方式，不符合条件的触发块根本不会被生成，从根源上规避了这个问题。

内容的提问来源于stack exchange，提问作者Elazar