如何仅用for_each实现Terraform staging环境下动态创建CloudWatch指标资源

The "count" and "for_each" meta-arguments are mutually-exclusive, only one should be used to be explicit about the number of resources to be created.

报错核心是Terraform不允许在同一个资源块中同时声明count和for_each两个元参数，二者只能选其一。你的需求是仅在staging环境创建资源且只能用for_each实现，所以可以直接把环境判断逻辑放到for_each的取值逻辑中。
另外你当前的locals块存在语法错误：定义本地变量时不需要加local.前缀，前缀仅在引用本地变量时使用。

直接通过三元运算符判断环境，非staging环境时给for_each传入空map，就不会生成任何资源：

locals {
  prefix  = terraform.workspace
  metrics = {
    "AAA - Attempt" = {
      source         = "frontend"
      filter-pattern = "YYY"
      metric-value   = 1
    },
    "AAA - Cancel" = {
      source         = "frontend"
      filter-pattern = "XXX"
      metric-value   = 1
    }
  }
}

resource "aws_cloudwatch_log_metric_filter" "app-metrics" {
  # 仅staging环境时传入metrics map，其他环境传入空map不创建资源
  for_each       = local.prefix == "staging" ? local.metrics : {}
  name           = "${local.prefix}-${each.key}"
  pattern        = each.value["filter-pattern"]
  log_group_name = aws_cloudwatch_log_group.frontend_logs.name 

  metric_transformation {
    name      = each.key
    namespace = "${local.prefix}-metrics"
    value     = each.value["metric-value"]
  }
}

• 当workspace为staging时，for_each取值为完整的local.metrics map，会遍历生成2个对应的CloudWatch指标过滤资源
• 当workspace为其他值时，for_each取值为空map，不会生成任何该类型的资源
• 完全符合仅使用for_each实现条件判断的要求，没有用到count参数，不会触发互斥报错

内容的提问来源于stack exchange，提问作者Akram Dhiabi