如何在for_each集合的cred资源中访问aadapp关联的locals值？

你的问题核心是：联合身份凭据资源的for_each指向了Azure AD应用，导致无法直接获取locals集合里的repo和environment字段。但因为两个资源的for_each用的是同一个locals集合的key，所以可以通过key反向关联回原始数据，不用模块就能搞定。

给你两种简便的解决办法：

方法一：让凭据资源直接使用locals集合做for_each #

直接把凭据资源的for_each改成local.github_repos_with_apps，这样each.value就是locals里的原始条目，能直接拿到repo和environment，同时通过key关联到对应的AD应用object_id：

resource "azuread_application_federated_identity_credential" "cred" {
  for_each              = local.github_repos_with_apps
  application_object_id = azuread_application.aadapp[each.key].object_id
  display_name          = "my-repo-deploy"
  description           = "Deployments for ${each.value.repo}"
  audiences             = ["api://AzureADTokenExchange"]
  issuer                = "https://token.actions.githubusercontent.com"
  subject               = "repo:my-org/${each.value.repo}:environment:${each.value.environment}"
}

方法二：保持凭据资源for_each指向AD应用，通过key反向取locals值 #

如果想保持凭据资源对AD应用的依赖指向，就用each.key从locals集合里直接取对应的值：

resource "azuread_application_federated_identity_credential" "cred" {
  for_each              = azuread_application.aadapp
  application_object_id = each.value.object_id
  display_name          = "my-repo-deploy"
  description           = "Deployments for ${local.github_repos_with_apps[each.key].repo}"
  audiences             = ["api://AzureADTokenExchange"]
  issuer                = "https://token.actions.githubusercontent.com"
  subject               = "repo:my-org/${local.github_repos_with_apps[each.key].repo}:environment:${local.github_repos_with_apps[each.key].environment}"
}

两种方法都能解决你的问题，选哪个看你对依赖关系的偏好：方法一更直观，直接用原始数据源；方法二则明确绑定了凭据与AD应用的依赖关系。

内容的提问来源于stack exchange，提问作者Bortos