Replace for_each with count for aws_ssoadmin_account_assignment resource

[nicolaevladescu]

what

• Replace for_each with count for aws_ssoadmin_account_assignment resource
• Retrieve per iteration values using count.index from var.account_assignments
• Deprecate assignment_map

why

• a.permission_set_arn is providing a unique value to the account_assignment name.
• However the permission_set_arn can not be determined until after the apply of the permission sets.
• Using a.permission_set_arn in account_assignments before the permission sets have been applied will result in the following error.

Error: Invalid for_each argument

  on .terraform/modules/sso_account_assignments/modules/account-assignments/main.tf line 30, in resource "aws_ssoadmin_account_assignment" "this":
  30:   for_each = local.assignment_map

The "for_each" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the for_each depends on.

references

• Closes Complete example not working #12

[jgrumboe]

But doesn't count rely on the order how the account_assignments are defined?
Inserting or removing entries in var.account_assignment would lead to unknown recreation of resources, wouldn't it? (I think that's more or less the state as it was with version 0.2.1)
I would like to test it tomorrow.

[nicolaevladescu]

I didn't have time to test all scenarios, but you might be right, i will test also and come back with the findings.

[nicolaevladescu]

@jgrumboe

So i managed to test and you are right, if you change items inside var.account_assignment being it a removal of an item or prepend instead of an append, everything gets recreated. The only scenario when this is fine is if you do only gradual append, yet the nature of the resources allows you to live with the recreations if you want to.

So i guess it's another compromise, but it's more severe than #13, not sure which one is easier to live with, but i cannot consider this a worthy candidate for a fix.

I guess it's back to the drawing board.

[jgrumboe]

Thanks for testing!