fix: use static ARNs in attached_policies to resolve for_each unknown value error #3
+3
−3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 3 commits
July 9, 2026 16:06
Replace SSH-style git@ source with git::https:// for all three aws-iam-role module references (patch_role, patch_execution_role, patch_execproxy_role). HTTPS is required in environments where SSH agent forwarding is unavailable or not configured.
…alue error
Terraform cannot use compute-time resource ARNs (aws_iam_policy.*.arn) as
for_each set keys since they are unknown at plan time. Replace with statically
constructed ARNs using locals that are always known at plan time:
format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.<name>)
Fixes 'Invalid for_each argument' errors on all three role modules.
Sign in
to join this conversation on GitHub.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
attached_policies = [aws_iam_policy.*.arn]with statically constructed ARNs in all three role module calls (patch_role,patch_execution_role,patch_execproxy_role)Purpose
Terraform cannot use compute-time resource ARNs as
for_eachset keys because they are unknown at plan time. This causedInvalid for_each argumenterrors on everytf planrun when the IAM policies and role policy attachments were being created together for the first time.The fix constructs the ARN using locals that are always resolved during plan:
local.partitionandlocal.account_idcome fromdata.aws_partitionanddata.aws_caller_identitywhich are always resolved at plan time. Policy names are derived fromvar.name_prefixwhich is a static input.tf-plan output
Plan run from
036728032133-lab-gov-operations-nonprod/infrastructure/global/apps/inf-patchwith this fix applied:No errors. Deprecation warnings only (unrelated to this change).