如何简化Terraform中aws_iam_role_policy_attachment的for_each嵌套表达式？

问题背景 #

想要简化以下Terraform代码里aws_iam_role_policy_attachment.role_policy_attachments的for_each属性表达式，类似Python中嵌套字典推导式的简洁写法，但暂未找到对应的Terraform/HCL写法。

原Terraform代码：

locals {
  roles    = [<a list of aws_iam_role resource objects...>]
  policies = [
    "AmazonEC2ContainerRegistryReadOnly",
    "AmazonS3FullAccess",
    <...>
  ]
}

# Attach all policies to all roles
resource "aws_iam_role_policy_attachment" "role_policy_attachments" {
  for_each = { for role_policy in flatten([
    for role in local.roles : [
      for policy in local.policies : {
        role   = role.name
        policy = policy
      }
    ]
    ]) :
    "${role_policy.role}-${role_policy.policy}" => role_policy
  }

  role       = each.value.role
  policy_arn = "arn:aws:iam::aws:policy/${each.value.policy}"
}

对应的Python简洁写法：

for_each = {f"{role.name}-{policy}": {"role": role.name, "policy": policy} for role in roles for policy in policies}

简化方案 #

可以简化，Terraform 0.12及以上版本支持直接在for表达式中处理多集合的笛卡尔积，无需使用flatten函数，写法更贴近Python的推导式：

resource "aws_iam_role_policy_attachment" "role_policy_attachments" {
  for_each = {
    for role in local.roles, policy in local.policies :
    "${role.name}-${policy}" => {
      role   = role.name
      policy = policy
    }
  }

  role       = each.value.role
  policy_arn = "arn:aws:iam::aws:policy/${each.value.policy}"
}

说明 #

这种写法通过for role in local.roles, policy in local.policies直接生成角色与策略的笛卡尔积，同时一步完成键（"${role.name}-${policy}"）和对应值的构建，省去了原代码中嵌套列表生成后再flatten的步骤，代码结构更紧凑清晰，逻辑和Python的推导式完全对应。

内容的提问来源于stack exchange，提问作者palotasb