CODEWITHSUNDEEP
amazon-web-servicesforeachsyntaxterraformterraform-provider-aws
devgirl
devgirl

Reputation: 773

Terraform for_each inside for_each?

I have this code:

locals {
  portals = ["c" "a" "b"]
}

resource "aws_acm_certificate" "example" {
  for_each    = toset(local.portals)
  domain_name = "${each.value}.aws.${var.environment}.abc.com"
  subject_alternative_names = [
    "${each.value}.${var.environment}-aws.abc.com"
  ]
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

and this created 3 ACM AWS certs.

Now, what I need/want to do is to create DNS records for all the DNS created by the certs. The code for that I have is:

resource "aws_route53_record" "example-verify-acm" {
  for_each = {
    for dvo in aws_acm_certificate.example.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.management_zone.zone_id
}

Now, I when I run terraform plan, I get the error:

│ Error: Missing resource instance key
│ 
│   on  line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example.domain_validation_options : dvo.domain_name => {
│ 
│ Because aws_acm_certificate.example has "for_each" set, its attributes must be accessed on specific instances.
│ 
│ For example, to correlate with indices of a referring resource, use:
│     aws_acm_certificate.example[each.key]

Then, as the error says to use "aws_acm_certificate.example[each.key]" .. I added that in my code:

    for dvo in aws_acm_certificate.website[each.key].domain_validation_options : dvo.domain_name => {

then I get the error:

│ Error: Reference to "each" in context without for_each
│ 
│   on ../../modules/web/acm.tf line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example[each.key].domain_validation_options : dvo.domain_name => {
│ 
│ The "each" object can be used only in "module" or "resource" blocks, and only when the "for_each" argument is set.

and if I add:

    for dvo in aws_acm_certificate.example[each.value].domain_validation_options : dvo.domain_name => {

I get the error:

 Error: each.value cannot be used in this context
│ 
│   on ../../modules/web/acm.tf line 24, in resource "aws_route53_record" "example-verify-acm":
│   24:     for dvo in aws_acm_certificate.example[each.value].domain_validation_options : dvo.domain_name => {
│ 
│ A reference to "each.value" has been used in a context in which it unavailable, such as when the configuration no longer contains
│ the value in its "for_each" expression. Remove this reference to each.value in your configuration to work around this error.

So, I do not know how to pass in the "domain_validation_options" for all the 3 certs using this one resource of "aws_route53_record". Is there a way to fix these errors? or Is there a different way to get this done?

Upvotes: 2

Views: 7226

Answers (2)

devgirl
devgirl

Reputation: 773

I was not able to find a good solution for this. Thank you to @Marcin for the great suggestion.. but the path I went through for this was to create a terraform module which creates the ACM, the records and does the validation, all together.

Then, I just called the module using a for_each .. with:

locals {
  portals = ["c" "a" "b"]
}

Upvotes: 0

Marcin
Marcin

Reputation: 238081

You have to flatten your aws_acm_certificate. For example:

locals {
  flat_records = merge([
      for cert in aws_acm_certificate.example: {
        for dvo in cert.domain_validation_options: 
          "${cert.domain_name}-${dvo.resource_record_name}" => {
            name   = dvo.resource_record_name
            record = dvo.resource_record_value
            type   = dvo.resource_record_type
          }        
      }
    ]...)
}

then

resource "aws_route53_record" "example-verify-acm" {
  for_each        = local.flat_records 

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.management_zone.zone_id
}

Upvotes: 3

Related Questions