Terraform：如何提取ARN后缀角色名并按count.index匹配传递？

你可以用Terraform的split函数拆分ARN字符串，提取斜杠/之后的角色名部分。以下是两种实现方式：

方式一：提前在locals中预处理角色名列表 #

先把角色名从ARN里提取出来存到单独的本地变量，后续直接引用，代码更清晰：

locals {
  org_sub_accounts = [
    "111111111111",
    "222222222222",
    "333333333333",
  ]

  role_arns = [
    "arn:aws:iam::111111111111:role/DataConnector1",
    "arn:aws:iam::222222222222:role/DataConnector2",
    "arn:aws:iam::333333333333:role/DataConnector3",
  ]

  # 预处理提取角色名：拆分ARN后取最后一段
  role_names = [for arn in local.role_arns : split("/", arn)[length(split("/", arn)) - 1]]
}

resource "aws_cloudformation_stack_set_instance" "stack" {
  count               = length(local.org_sub_accounts)
  account_id          = local.org_sub_accounts[count.index]
  region              = "ap-east-1"
  parameter_overrides = {
    RoleName = local.role_names[count.index]
  }
  stack_set_name      = aws_cloudformation_stack_set.stackset.name
}

方式二：直接在resource中动态提取 #

如果不想新增本地变量，也可以直接在parameter_overrides里处理：

locals {
  org_sub_accounts = [
    "111111111111",
    "222222222222",
    "333333333333",
  ]

  role_arns = [
    "arn:aws:iam::111111111111:role/DataConnector1",
    "arn:aws:iam::222222222222:role/DataConnector2",
    "arn:aws:iam::333333333333:role/DataConnector3",
  ]
}

resource "aws_cloudformation_stack_set_instance" "stack" {
  count               = length(local.org_sub_accounts)
  account_id          = local.org_sub_accounts[count.index]
  region              = "ap-east-1"
  parameter_overrides = {
    RoleName = split("/", local.role_arns[count.index])[length(split("/", local.role_arns[count.index])) - 1]
  }
  stack_set_name      = aws_cloudformation_stack_set.stackset.name
}

补充说明 #

• split("/", arn)会把ARN按斜杠拆分成列表，比如arn:aws:iam::111111111111:role/DataConnector1会拆成["arn:aws:iam::111111111111:role", "DataConnector1"]
• 用length(split(...)) - 1取列表最后一个元素，就是我们需要的角色名
• 实际场景中如果role_arns来自其他资源输出（比如aws_iam_role的arn属性），上述方法同样适用，只需要把local.role_arns替换为对应的资源输出列表即可

内容的提问来源于stack exchange，提问作者hlesnt395