为count创建的VM系统身份配置AKV访问策略遇for_each报错

我尝试为通过count创建的多台虚拟机的系统身份（object_id）配置Azure Key Vault访问策略，使用的Terraform代码如下：

resource "azurerm_key_vault_access_policy" "terra_kva_pol_arr" {
  for_each = azurerm_windows_virtual_machine.terra_vma_arr[*].identity[*].principal_id

  key_vault_id = azurerm_key_vault.terra_kva[0].id
  tenant_id    = var.tenant_id
  object_id    = each.value

  secret_permissions = [
    "Get",
  ]
}

执行时触发以下错误：

│ Error: Invalid for_each argument
│
│   on key_vault.tf line 30, in resource "azurerm_key_vault_access_policy" "terra_kva_pol_arr":
│   30:   for_each = azurerm_windows_virtual_machine.terra_vma_arr[*].identity[*].principal_id
│     ├────────────────
│     │ azurerm_windows_virtual_machine.terra_vma_arr is tuple with 1 element
│
│ The given "for_each" argument value is unsuitable: the "for_each" argument must be a map, or set of strings, and you have provided a value of type tuple.

问题原因 #

azurerm_windows_virtual_machine.terra_vma_arr[*].identity[*].principal_id返回的是嵌套元组结构，而for_each要求输入为字符串集合（set(string)）或map类型，类型不匹配导致报错。

修复方案 #

方案1：扁平化嵌套结构并转为集合

用flatten()把嵌套的principal_id转为一维列表，再通过toset()转换为符合要求的字符串集合：

resource "azurerm_key_vault_access_policy" "terra_kva_pol_arr" {
  for_each = toset(flatten(azurerm_windows_virtual_machine.terra_vma_arr[*].identity[*].principal_id))

  key_vault_id = azurerm_key_vault.terra_kva[0].id
  tenant_id    = var.tenant_id
  object_id    = each.value

  secret_permissions = [
    "Get",
  ]
}

• flatten()：消除嵌套层级，把多维结构转为一维列表
• toset()：将列表转为无序唯一的集合，满足for_each的类型要求

方案2：直接遍历VM实例（更直观严谨）

如果VM是用count创建的，直接遍历VM实例，以VM的ID作为map的key，提取对应的principal_id：

resource "azurerm_key_vault_access_policy" "terra_kva_pol_arr" {
  for_each = { for vm in azurerm_windows_virtual_machine.terra_vma_arr : vm.id => vm.identity[0].principal_id }

  key_vault_id = azurerm_key_vault.terra_kva[0].id
  tenant_id    = var.tenant_id
  object_id    = each.value

  secret_permissions = [
    "Get",
  ]
}

这种方式每个策略对应唯一的VM实例，避免潜在的重复ID问题，逻辑更清晰。

内容的提问来源于stack exchange，提问作者Cookies