Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Allow for custom_iam_policy_arns that are unknown during terraform apply

Abierto
  • ¿Algo no está bien?
#72 1 comentario 2 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
aws, terraform
Área
cloud, infrastructure

Línea de trabajo

Comienza con el recurso generado aws_iam_role_policy_attachment.custom en iam-role.tf, en la línea 89, e inspecciona cómo se usa local.custom_iam_policy_arns_map en for_each. Reproduce la configuración de ejemplo y verifica que plan y apply puedan manejar un ARN de policy disponible en apply y crear la asociación de la policy junto con el rol de Lambda.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Describe the Bug

Getting below mentioned error:

╷
│ Error: Invalid for_each argument
│
│ on .terraform\modules\data_science_lambda.data_science_lambda\iam-role.tf line 89, in resource "aws_iam_role_policy_attachment" "custom":
│ 89: for_each = local.enabled ? local.custom_iam_policy_arns_map : {}
│ ├────────────────
│ │ local.custom_iam_policy_arns_map will be known only after apply
│ │ local.enabled is true
│
│ The "for_each" map includes keys derived from resource attributes that
│ cannot be determined until apply, and so Terraform cannot determine the
│ full set of keys that will identify the instances of this resource.
│
│ When working with unknown values in for_each, it's better to define the map
│ keys statically in your configuration and place apply-time results only in
│ the map values.
│
│ Alternatively, you could use the -target planning option to first apply
│ only the resources that the for_each value depends on, and then apply a
│ second time to fully converge.
╵

=====================================================

Expected Behavior

Policy should be created and alingned with Lambda role at runtime along with AWS Lambda function

Steps to Reproduce

Sample Code:

locals {
enabled = module.this.enabled
custom_iam_policy_arns = [ aws_iam_policy.custom_s3_policy.arn ]
s3_lambda_environment = var.abc_lambda_env == null ? null : { variables = var.abc_lambda_env }
}

data "aws_iam_policy_document" "custom_s3_policy" {
version = "2012-10-17"

statement {
actions = [
"s3:ListBucket"
]
resources = [
"arn:aws:s3:::${data.terraform_remote_state.abc_bucket_id.outputs.bucket_id}"
]
}

statement {
actions = [
"secretsmanager:DescribeSecret",
"secretsmanager:GetSecretValue",
"secretsmanager:ListSecrets",
"secretsmanager:ListSecretVersionIds"
]
resources = [
"*"
]
}
}

resource "aws_iam_policy" "custom_s3_policy" {
name = "${module.this.id}-access-policy"
description = "Custom policy to allow access to one S3 bucket only."
policy = data.aws_iam_policy_document.custom_s3_policy.json
tags = module.this.tags
}

data "terraform_remote_state" "abc_bucket_id" {
backend = "s3"

config = {
bucket = var.abc_tfstate_bucket_name
key = var.abc_s3_bucket_key
region = "XXX"
}
}

module "abc_lambda" {
source = "cloudposse/lambda-function/aws"
version = "0.5.5"

enabled = true
function_name = "${module.this.id}"
description = "Lambda test."
s3_bucket = var.s3_lambda_s3_bucket
s3_key = var.s3_lambda_s3_key
runtime = var.s3_lambda_runtime
handler = var.s3_lambda_handler
lambda_environment = local.s3_lambda_environment
architectures = ["x86_64"]
memory_size = var.s3_lambda_memory_size
ephemeral_storage_size = var.s3_lambda_storage_size
timeout = var.s3_lambda_timeout
custom_iam_policy_arns = local.custom_iam_policy_arns
context = module.this.context
vpc_config = var.abc_lambda_vpc_config
}

resource "aws_lambda_permission" "allow_s3" {
statement_id = "AllowExecutionFromS3"
action = "lambda:InvokeFunction"
function_name = module.abc_lambda.function_name
principal = "s3.amazonaws.com"
source_arn = data.terraform_remote_state.abc_bucket_id.outputs.bucket_arn
}

Screenshots

No response

Environment

No response

Additional Context

No response

Lenguaje dominante
HCL
Estrellas
36
Forks
44
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de cloudposse/terraform-aws-lambda-function

Todos los issues de cloudposse/terraform-aws-lambda-function

Issues similares

Más issues de Cloud

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.