Terraform嵌套循环创建Vault Policy遇类型错误求助

错误信息 #

╷
│ Error: Incorrect attribute value type
│
│   on ..\..\modules\policy_new\vault_policy.tf line 36, in data "vault_policy_document" "ad_hoc_policy_content":
│   36:       path         = each.value.paths
│     ├────────────────
│     │ each.value.paths is list of string with 2 elements
│
│ Inappropriate value for attribute "path": string required.
╵

问题原因 #

在dynamic "rule"块中，你已经通过for_each = each.value.paths遍历单个策略的路径列表，但在content块里错误地将整个路径列表each.value.paths赋值给path属性——而path要求单个字符串类型。dynamic块的迭代变量是你定义的rule，每个迭代元素对应路径列表中的单个字符串，应该用rule.value来引用。

此外，vault_policy资源的for_each映射可以简化，和data "vault_policy_document"保持一致，避免冗余的路径映射。

修正后的代码 #

locals {
  vault_adhoc_readonly_policies_capabilities = ["read", "list"]
}

variable "vault_adhoc_readonly_policies" {
  type = list(object({
    policy_name = string
    paths = list(string)
  }))
  description = "动态生成策略的路径和权限列表"
  default = [
    {
      policy_name = "demo_adhoc"
      paths = [
        "static-secrets/data/infrastructure/platform-showcase/rabbitmq",
        "static-secrets/data/infrastructure/platform-showcase/redis",
      ]
    }
  ]
}

# 创建Ad-Hoc策略文档
data "vault_policy_document" "ad_hoc_policy_content" {
  for_each = { for policy in var.vault_adhoc_readonly_policies : policy.policy_name => policy }

  dynamic "rule" {
    for_each = each.value.paths
    content {
      path         = rule.value  # 使用dynamic块的迭代变量获取单个路径
      capabilities = local.vault_adhoc_readonly_policies_capabilities
    }
  }
}

# 创建Vault策略资源
resource "vault_policy" "vault_adhoc_policies" {
  for_each = data.vault_policy_document.ad_hoc_policy_content  # 复用data块的for_each映射

  name   = each.key
  policy = each.value.hcl
}

关键修正点 #

• 在dynamic "rule"块内，使用rule.value替代each.value.paths，获取当前迭代的单个路径字符串，满足path属性的字符串类型要求
• 简化vault_policy资源的for_each配置，直接复用data.vault_policy_document.ad_hoc_policy_content的映射结果，避免重复逻辑

内容的提问来源于stack exchange，提问作者CodyK