google-cloud-platform - Terraform 0.12+ Error Inappropriate value for attribute "service_account": string required with try() function

Question

I have a module for google_service_account, and just converted to Terraform-12 (0.12.24)

resource "google_service_account" "service_account" {
  count        = var.enabled ? 1 : 0
  account_id   = var.account_id
  display_name = var.display_name
}

output.tf retrieves the email

output "email" {
  value = try(google_service_account.service_account.*.email, null)
  # value = element( --> Commented out part works fine
  #   concat(google_service_account.service_account.*.email, [""]),
  #   0,
  # )
  description = "The e-mail address of the service account. Usually use this when constructing IAM policies."

When using this module in another resource as follows

resource "google_storage_bucket_iam_member" "registry_bucket_iam" {
  bucket = "artifacts.${var.project}.appspot.com"
  role   = "roles/storage.objectViewer"
  member = "serviceAccount:${module.k8s-node-service-account.email}"
}

I get the following error

  48:   member = "serviceAccount:${module.k8s-node-service-account.email}"
    |----------------
    | module.k8s-node-account.email is tuple with 1 element

Cannot include the given value in a string template: string required.

How can this be resolved ?

Answer 1

google_service_account.service_account.*.email评估为 1 或 0 个元素的数组，具体取决于var.enabled- 而如果is则google_service_account.service_account[0].email评估为 astring或错误。因此，在使用时，您要评估或在出现错误的情况下默认为var.enabledfalsetry()stringnull

将您的输出更改为以下应该会导致具有类型的电子邮件输出的预期结果string。

output "email" {
  value = try(google_service_account.service_account[0].email, null)
}