为aws_ec2_transit_gateway_vpc_attachment添加Project标签时Terraform报错

问题根源 #

当你给aws_ec2_transit_gateway_vpc_attachment添加Project标签时，Terraform需要更新该资源（部分场景下会触发重建），导致aws_ec2_transit_gateway_vpc_attachment.tgw_attachments.id在计划阶段变成未知值。你的data.aws_ec2_transit_gateway_attachment.attachment_data依赖这个未知ID，进而让count参数的判断逻辑依赖无法提前确定的资源属性，触发了Terraform的"Invalid count argument"错误。

解决方案 #

直接使用aws_ec2_transit_gateway_vpc_attachment资源自身的state属性控制accepter的创建，无需依赖数据块查询。Terraform能在计划阶段跟踪自身管理资源的状态变化，避免未知值依赖问题。

修正后的完整代码 #

resource "aws_ec2_transit_gateway" "tgw" {
  description                     = "TGW for inter-region connectivity"
  auto_accept_shared_attachments = "disable"
  default_route_table_association = "disable"
  default_route_table_propagation = "disable"
  dns_support                     = "enable"
  tags = {
    "Name"      = "labs tgw",
    "Terraform" = "true",
    "Project"   = var.project_id
  }
}

## Create new TGW Attachments 
resource "aws_ec2_transit_gateway_vpc_attachment" "tgw_attachments" {
  subnet_ids                                       = aws_subnet.tgw[*].id
  transit_gateway_id                               = aws_ec2_transit_gateway.tgw.id
  vpc_id                                           = aws_vpc.vpc.id
  dns_support                                      = "enable"
  transit_gateway_default_route_table_association = "false"
  transit_gateway_default_route_table_propagation = "false"
  tags = {
    "Name"      = "labs_tgw_attachment",
    "Terraform" = "true",
    "Project"   = var.project_id  
  }
}

## Accept attachment if it hasn't already been accepted
resource "aws_ec2_transit_gateway_vpc_attachment_accepter" "accept" {
  count = (aws_ec2_transit_gateway_vpc_attachment.tgw_attachments.state == "pendingAcceptance") ? 1 : 0
  transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.tgw_attachments.id
}

关键说明 #

1. 移除了data.aws_ec2_transit_gateway_attachment.attachment_data数据块，不再依赖外部查询获取状态
2. 直接通过aws_ec2_transit_gateway_vpc_attachment.tgw_attachments.state判断是否需要创建accepter：
   • 创建新附件时，初始状态为pendingAcceptance，count=1，自动创建accepter
   • 更新现有附件（比如修改标签）时，资源状态保持available，count=0，不会重复创建accepter
3. 无需额外的depends_on，因为accepter已直接依赖attachment资源

内容的提问来源于stack exchange，提问作者deadbird23