如何用Terraform为多个SNS主题批量订阅邮箱列表？

问题描述 #

我需要基于命名规则动态创建多个AWS SNS主题，同时为每个主题订阅多个邮箱用户，但只能在资源中使用一个for_each或count字段，不想硬编码多个订阅资源，该怎么解决？

现有配置 #

variables.tf #

variable "system" {
  default = ["1", "2"]
}

variable "alert_level" {
  default = ["error", "exception", "info", "warning"]
}

variable "email_subscription" {
  default = ["a@company.com", "b@company.com"]
}

# 原代码中使用但未展示的变量
variable "BASENAME" {}
variable "ENVIRONMENT" {}

sns.tf（原代码） #

locals {
  alerts = flatten([
    for source in var.system:
    formatlist("%s-%s", source, var.alert_level)
  ])
}

resource "aws_sns_topic" "alerts" {
  count             = length(local.alerts)
  name              = "${var.BASENAME}-${var.ENVIRONMENT}-${local.alerts[count.index]}"
}

resource "aws_sns_topic_subscription" "sns-topic" {
  count     = length(local.alerts)
  topic_arn = "arn:aws:sns:us-east-1:123:${var.BASENAME}-${var.ENVIRONMENT}-${local.alerts[count.index]}"
  protocol  = "email"
  endpoint  = var.email_subscription # 此处无法直接遍历邮箱列表
}

解决方案 #

核心思路是生成主题与邮箱的笛卡尔积组合列表，让每个订阅对应唯一的「主题+邮箱」组合，仅用一个count或for_each即可遍历所有需创建的订阅。

1. 生成主题-邮箱组合列表 #

修改locals块，新增包含所有组合的变量：

locals {
  alerts = flatten([
    for source in var.system:
    formatlist("%s-%s", source, var.alert_level)
  ])

  # 生成所有主题与邮箱的笛卡尔积组合
  alert_topic_email_pairs = flatten([
    for alert_topic in local.alerts : [
      for email in var.email_subscription : {
        topic_name = alert_topic
        email      = email
      }
    ]
  ])
}

2. 用count创建订阅资源 #

遍历组合列表，同时直接引用已创建的SNS主题ARN（避免硬编码）：

resource "aws_sns_topic_subscription" "sns-topic" {
  count     = length(local.alert_topic_email_pairs)
  # 通过主题名称匹配对应的SNS主题ARN
  topic_arn = aws_sns_topic.alerts[index(local.alerts, local.alert_topic_email_pairs[count.index].topic_name)].arn
  protocol  = "email"
  endpoint  = local.alert_topic_email_pairs[count.index].email
}

3. 更优方案：用for_each替代count #

count依赖列表顺序，修改主题/邮箱列表可能导致资源重建混乱，建议改用for_each，基于唯一键标识每个订阅：

resource "aws_sns_topic_subscription" "sns-topic" {
  for_each = {
    for pair in local.alert_topic_email_pairs :
    "${pair.topic_name}-${pair.email}" => pair
  }

  topic_arn = aws_sns_topic.alerts[index(local.alerts, each.value.topic_name)].arn
  protocol  = "email"
  endpoint  = each.value.email
}

说明 #

• alert_topic_email_pairs通过嵌套循环生成所有组合：2个系统 × 4个告警级别 × 2个邮箱，最终生成8个订阅实例。
• 直接引用aws_sns_topic.alerts的ARN，既避免硬编码维护问题，又保证Terraform能正确识别资源依赖关系。

内容的提问来源于stack exchange，提问作者Omega