Fix for Error: Invalid for_each argument

[innominatus]

what

• a.permission_set_arn is providing a unique value to the account_assignment name.
• However the permission_set_arn can not be determined until after the apply of the permission sets.
• Using a.permission_set_arn in account_assignments before the permission sets have been applied will result in the following error.

Error: Invalid for_each argument

  on .terraform/modules/sso_account_assignments/modules/account-assignments/main.tf line 30, in resource "aws_ssoadmin_account_assignment" "this":
  30:   for_each = local.assignment_map

The "for_each" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the for_each depends on.

why

• Attempting to provide a unique (enough) value that is already predetermined before apply by adding a.permission_set_name instead of arn.

  account_assignments = [
    {
        account = "111111111111",
        permission_set_name = "administratoraccess",
        permission_set_arn = "arn:aws:sso:::permissionSet/ssoins-0000000000000000/ps-31d20e5987f0ce66",
        principal_type = "GROUP",
        principal_name = "Administrators"
    },

• Yes, its less unique but there should be only one assignment using the same account, principal, principal type, and permission set name.
• Yes, you are carrying 2 values over from the permission set (name and arn) instead of just one (arn). But it gets around the uniqueness problem. I couldnt think of any other good choice at the moment. Maybe someone else will come up with a better value. Maybe use a random_string.name.result?

references

• Complete example not working #12

[nicolaevladescu]

I have been successful with a workaround that does not involve another arbitrary key, i have opened a PR, can you guys check it out before we make the compromise? #14

[jgrumboe]

I'm happy with this solution. Although it's a new arbitrary key, you can see it as a description or comment of the assignment and it helps to have stable resource names which avoid unnecessary recreation of resources when the list is altered.
That's a big benefit for me.

[aknysh]

/terraform-fmt

[aknysh]

/test all

[nitrocode]

/test all

[jgrumboe]

I think test all is simply not applicable in this repo.

This Pull Request has been updated, so we're dismissing all reviews.

[jgrumboe]

🎉