Terraform循环空值报错修复：处理ACL生成的可选属性null值

问题背景 #

现有Terraform代码用于根据输入的权限配置生成ACL条目，但当输入对象中未定义可选的WO属性时，会触发报错：A null value cannot be used as the collection in a 'for' expression.，需要修正循环逻辑以忽略null值，确保可选属性未设置时仍正常运行。

原代码 #

变量定义 #

variable "appr" {
  description = "A complex object "
  type = map(object({
    RO  = optional(list(string))
    WO    = optional(list(string)) 
  }))
}

ACL生成逻辑 #

locals {
  acl_out = flatten([
    for opi, clsan in var.appr : [
      for co, coo in clsan : [
        for applo in coo : [
           for op in ( co == "RO" ? ["READ","DESCRIBE"] : ["WRITE"]) : {
             oper = op
             appid_lo = applo
             opic-name = opi
             process = co
           }
        ]
      ]
    ]
  ])
}

报错原因 #

RO和WO为可选属性，当输入对象未设置某一属性时，该属性值会是null。原代码直接遍历clsan的所有键值对，当值为null时，for applo in coo循环无法处理null集合，从而触发报错。

修正方案 #

在遍历clsan的键值对时，增加过滤条件，仅处理非null的属性值。修改后的ACL生成逻辑如下：

locals {
  acl_out = flatten([
    for opi, clsan in var.appr : [
      # 过滤掉值为null的属性
      for co, coo in clsan : [
        for applo in coo : [
           for op in ( co == "RO" ? ["READ","DESCRIBE"] : ["WRITE"]) : {
             oper = op
             appid_lo = applo
             opic-name = opi
             process = co
           }
        ]
      ] if coo != null
    ]
  ])
}

核心修改点 #

在第二层for循环末尾添加if coo != null，跳过值为null的属性，避免对null集合进行遍历操作。

验证示例 #

使用以下包含缺失WO属性的输入：

appr = {
  product1 = { WO = ["6470"], RO = ["6471","5538"] },
  product2 = { RO = ["6472"]},
  product3 = { WO = ["6473"], RO = ["6474"] },
}

修正后的代码会正常生成如下格式的ACL条目（以product1和product2部分为例）：

{
   opic-name = "product1"
   oper = "WRITE"
   appid_lo = "6470"
},
{
   opic-name = "product1"
   oper = "READ"
   appid_lo = "6471"
},
{
   opic-name = "product1"
   oper = "DESCRIBE"
   appid_lo = "6471"
},
{
   opic-name = "product2"
   oper = "READ"
   appid_lo = "6472"
},
{
   opic-name = "product2"
   oper = "DESCRIBE"
   appid_lo = "6472"
}

内容的提问来源于stack exchange，提问作者Nabob