Terraform for_each中如何通过key值引用对应helm_release资源属性

Terraform 不支持通过字符串拼接动态构造资源引用地址。Terraform的资源依赖关系、属性取值解析都发生在配置加载的静态校验阶段，早于for_each等循环逻辑的运行时执行阶段。你尝试使用的helm_release.${each.key}、join函数拼接资源路径的写法，本质是将资源引用作为普通字符串处理，静态解析阶段Terraform无法识别其对应的实际资源，自然无法获取status属性，也不能正确处理资源间的依赖顺序。

方案1（推荐）：统一使用for_each创建helm_release资源 #

这是Terraform的标准实践，无需单独定义三个独立的helm_release资源，直接基于已有的local.chart_versions批量创建，后续校验逻辑可以直接引用for_each生成的资源集合，无需任何动态拼接：

locals {
  chart_versions = {
    redis = "6.0.1"
    nginx = "1.2.1"
    vault = "1.0.0"
  }
}

resource "helm_release" "this" {
  for_each = local.chart_versions

  name    = each.key
  # 修正原配置中vault的chart拼写错误（原配置写为valult）
  chart   = each.key == "redis" ? "bitnami/redis" : each.key
  version = each.value
}

resource "null_resource" "helm_release_status" {
  for_each = helm_release.this

  provisioner "local-exec" {
    command = <<EOF
      echo 'The name of the chart ${each.key} has been ${each.value.status}' >> Infra-Smoke-Tests.txt 
    EOF
  }
  # 无需手动写depends_on，直接引用each.value时Terraform会自动识别依赖关系
}

方案2：保留独立helm_release资源时手动构造资源映射 #

如果因为特殊场景必须保留三个单独定义的helm_release资源，可以在locals块中手动按key组装资源映射表，后续遍历该映射表即可正常引用资源属性：

locals {
  chart_versions = {
    redis = "6.0.1"
    nginx = "1.2.1"
    vault = "1.0.0"
  }
  # 手动建立key到对应helm_release资源的映射
  helm_release_map = {
    redis = helm_release.redis
    nginx = helm_release.nginx
    vault = helm_release.vault
  }
}

# 保留原有的三个独立helm_release定义不变
resource "helm_release" "redis" {
  name    = "redis"
  chart   = "bitnami/redis"
  version = local.chart_versions.redis
}

resource "helm_release" "nginx" {
  name    = "nginx"
  chart   = "nginx"
  version = local.chart_versions.nginx
}

resource "helm_release" "vault" {
  name    = "vault"
  chart   = "vault" # 修正原拼写错误
  version = local.chart_versions.vault
}

resource "null_resource" "helm_release_status" {
  for_each = local.helm_release_map

  provisioner "local-exec" {
    command = <<EOF
      echo 'The name of the chart ${each.key} has been ${each.value.status}' >> Infra-Smoke-Tests.txt 
    EOF
  }
}

注意：两种方案中都不需要手动配置depends_on，只要在配置中显式引用了对应helm_release的属性，Terraform就会在静态解析阶段自动识别依赖，保证helm_release部署完成后再执行状态校验脚本。

内容的提问来源于stack exchange，提问作者ANURAG parchuri