Terraform中为google_cloudfunctions_function配置secret_environment_variables的正确语法

我是Terraform新手，尝试部署Google Cloud Function并将多个Secret暴露为环境变量，但多次尝试均失败。我的代码片段如下：

resource "google_cloudfunctions_function" "function" {
  name        = "function-test"
  description = "My function"
  runtime     = "python310"
  ...
  entry_point                  = "helloGET"
 
  environment_variables = {
    MY_ENV_VAR = "my-env-var-value"
  }

  secret_environment_variables = [  
    {
      key     = "envID"
      secret  = var.envID
      version = "latest"
    },
    {
      key     = "client_id"
      secret  = var.client_id
      version = "latest"
    },
    {
      key     = "client_secret"
      secret  = var.client_secret
      version = "latest"
    }
  ]
}

执行terraform plan时出现如下错误：

Error: Unsupported argument
│
│ on resources.tf line 378, in resource "google_cloudfunctions_function" "cloud_function":
│ 378: secret_environment_variables = [
│
│ An argument named "secret_environment_variables" is not expected here. Did you mean to define a block of type "secret_environment_variables"?

正确语法 #

错误提示已经点明核心问题：secret_environment_variables是嵌套块类型，不能像普通参数那样用=赋值为数组。正确写法是为每个Secret单独定义一个secret_environment_variables块：

resource "google_cloudfunctions_function" "function" {
  name        = "function-test"
  description = "My function"
  runtime     = "python310"
  ...
  entry_point                  = "helloGET"
 
  environment_variables = {
    MY_ENV_VAR = "my-env-var-value"
  }

  secret_environment_variables {
    key     = "envID"
    secret  = var.envID
    version = "latest"
  }

  secret_environment_variables {
    key     = "client_id"
    secret  = var.client_id
    version = "latest"
  }

  secret_environment_variables {
    key     = "client_secret"
    secret  = var.client_secret
    version = "latest"
  }
}

说明 #

Terraform的Google Cloud Provider中，google_cloudfunctions_function资源的secret_environment_variables属于嵌套块，而非列表类型参数。每个需要注入的Secret对应一个独立的块，这样Terraform才能正确识别并处理每个Secret的配置。

内容的提问来源于stack exchange，提问作者William Wang