Terraform遍历映射列表时出现引用解析错误，求排查解决

你遇到的「unresolved reference」错误，本质是Terraform的类型推断未正确识别local.policy_attachments中对象的属性，或是中间变量的构造方式导致解析异常。以下是两种可行的修复方案：

方案一：为本地变量添加显式类型约束 #

通过显式声明local.policy_attachments的类型，让Terraform明确识别对象结构，解决属性引用问题：

variable "role_map_user_policies" {
  type = map(list(string))
  default = {
    role1 = ["policy_arn1", "policy_arn2"]
    role2 = ["policy_arn1", "policy_arn2", "policy_arn3"]
  }
}

locals {
  policy_attachments = flatten([
    for roleName, policies in var.role_map_user_policies :
      [for policy_arn in policies: {
        roleName = roleName
        policy_arn = policy_arn
      }]
  ]) :: list(object({
    roleName = string
    policy_arn = string
  }))
}

resource "aws_iam_role_policy_attachment" "customer_managed_policy_attachment" {
  for_each = {
    for entry in local.policy_attachments: "${entry.roleName}.${entry.policy_arn}" => entry
  }
  
  role       = each.value.roleName
  policy_arn = each.value.policy_arn
}

方案二：直接在资源块中构造for_each映射 #

省去中间本地变量，直接在资源的for_each中生成键值对，简化逻辑同时避免类型推断问题：

variable "role_map_user_policies" {
  type = map(list(string))
  default = {
    role1 = ["policy_arn1", "policy_arn2"]
    role2 = ["policy_arn1", "policy_arn2", "policy_arn3"]
  }
}

resource "aws_iam_role_policy_attachment" "customer_managed_policy_attachment" {
  for_each = merge([
    for role_name, policy_arns in var.role_map_user_policies : {
      for policy_arn in policy_arns : "${role_name}.${policy_arn}" => {
        role = role_name
        policy_arn = policy_arn
      }
    }
  ]...)

  role       = each.value.role
  policy_arn = each.value.policy_arn
}

两种方案均能实现IAM角色与对应策略列表的正确绑定，其中方案二更简洁高效，推荐优先使用。

内容的提问来源于stack exchange，提问作者NarmadaM