如何解决我在政策文档中的以下代码中收到的错误消息

Question

运行terraform apply时，我收到以下错误：无效的模板插值var.oidc_condition_statement是包含2个元素的字符串列表。不能在字符串模板中包含给定值：字符串是必需的。

resource "aws_iam_role" "Orchestration_role"{
name = var.orchestration_role_name
assume_role_policy = <<EOF
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRoleWithWebIdentity",
"Principal":{
"Federated":"arn:aws:iam::${var.aws_oidc_account}:oidc-provider/token.actions.githubusercontent.com"
},
"Condition":{
"ForAnyValue:StringLike":{
"token.actions.githubusercontent.com:sub": "${var.oidc_condition_statement}"
}
}
}
]
}
EOF
}
variable.tf
variable "oidc_condition_statement"{
type = list(string)
}
tfvars
oidc_condition_statement          = ["repo:organization/terraform-aws-githubaction:ref:refs/heads/staging","repo:organization/terraform-aws-githubaction:pull_request"]

Answer 1

请使用jsonencode:

resource "aws_iam_role" "Orchestration_role"{
name = var.orchestration_role_name
assume_role_policy = <<EOF
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRoleWithWebIdentity",
"Principal":{
"Federated":"arn:aws:iam::${var.aws_oidc_account}:oidc-provider/token.actions.githubusercontent.com"
},
"Condition":{
"ForAnyValue:StringLike":{
"token.actions.githubusercontent.com:sub": ${jsonencode(var.oidc_condition_statement)}
}
}
}
]
}
EOF
}