Terraform计划为何不必要删除重建Elastic Beanstalk环境变量

在创建或应用Elastic Beanstalk环境的Terraform计划时，总是出现如下变更（环境变量值完全一致，但Terraform会先删除再重新添加）：

- setting {
    - name      = "TWILIO_ACCOUNT_SID" -> null
    - namespace = "aws:elasticbeanstalk:application:environment" -> null
    - value     = "AC2e9cb3789c4ec87ac9XXXXXXXXXXXXXX" -> null
  }
+ setting {
    + name      = "TWILIO_ACCOUNT_SID"
    + namespace = "aws:elasticbeanstalk:application:environment"
    + value     = "AC2e9cb3789c4ec87ac9XXXXXXXXXXXXXX"
  }

环境配置代码如下：

resource "aws_elastic_beanstalk_environment" "backend" {
  name                   = "${var.eb_application_name}-${var.env}"
  application            = aws_elastic_beanstalk_application.backend.name
  solution_stack_name    = "64bit Amazon Linux 2 v3.5.1 running Docker"
  wait_for_ready_timeout = "30m"

  dynamic "setting" {
    for_each = local.all_settings
    content {
      namespace = setting.value["namespace"]
      name      = setting.value["name"]
      value     = setting.value["value"]
    }
  }
}

locals {
  all_settings = concat(local.load_balancer_settings, local.spring_boot_environment_variable_settings)

  load_balancer_settings = [
    {
      namespace = "aws:elasticbeanstalk:environment"
      name      = "LoadBalancerType"
      value     = var.loadbalancer_type
    }
  ]

  spring_boot_environment_variable_settings = [
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "TWILIO_ACCOUNT_SID"
      value     = var.twilio_account_sid
    }
  ]
}

• 核心原因：当前配置中dynamic块使用列表（concat返回列表）作为for_each数据源，Terraform会依赖列表索引识别配置项。一旦列表元素顺序、数量变化，或者Elastic Beanstalk API返回的配置顺序与本地状态记录不匹配，就会触发“删除再重建”的误判。此外，列表元素本身没有稳定的唯一标识，也是Terraform无法准确识别配置项的关键。

• 解决办法：将for_each的数据源从列表改为映射（Map），用namespace+name作为唯一键标识每个配置项，让Terraform能稳定识别每个setting，避免索引或顺序导致的误操作。

修改后的配置示例：

locals {
  # 将列表转为映射，用namespace+name作为唯一键
  all_settings = merge(
    { for s in local.load_balancer_settings : "${s.namespace}-${s.name}" => s },
    { for s in local.spring_boot_environment_variable_settings : "${s.namespace}-${s.name}" => s }
  )

  load_balancer_settings = [
    {
      namespace = "aws:elasticbeanstalk:environment"
      name      = "LoadBalancerType"
      value     = var.loadbalancer_type
    }
  ]

  spring_boot_environment_variable_settings = [
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "TWILIO_ACCOUNT_SID"
      value     = var.twilio_account_sid
    }
  ]
}

resource "aws_elastic_beanstalk_environment" "backend" {
  name                   = "${var.eb_application_name}-${var.env}"
  application            = aws_elastic_beanstalk_application.backend.name
  solution_stack_name    = "64bit Amazon Linux 2 v3.5.1 running Docker"
  wait_for_ready_timeout = "30m"

  dynamic "setting" {
    # 遍历映射的键值对，用唯一键标识每个配置项
    for_each = local.all_settings
    content {
      namespace = setting.value["namespace"]
      name      = setting.value["name"]
      value     = setting.value["value"]
    }
  }
}

• 补充说明：namespace和name组合是Elastic Beanstalk配置项的唯一标识，用它作为映射键能确保每个setting都有稳定的身份，Terraform就不会再误判为需要重建配置项。

内容的提问来源于stack exchange，提问作者Blair Nangle