I'm loading json from Azure KeyVault and convert with jsondecode()
.
While raw string is working, when I load the same string from KeyVault I cannot use it in dynamic
Block.
Error: Invalid dynamic for_each value Cannot use a tuple value in for_each. An iterable collection is required.
Working
resource "azurerm_monitor_action_group" "SIDevelopment" {
name = "Test"
resource_group_name = "kv-test"
short_name = "Test"
dynamic "email_receiver" {
for_each = jsondecode("[\"example1@email.com\",\"example2@email.com\"]")
content {
name = email_receiver.value
email_address = email_receiver.value
use_common_alert_schema = false
}
}
}
Not Working
data "azurerm_key_vault" "this" {
name = var.key_vault_name
resource_group_name = var.resource_group_name
}
data "azurerm_key_vault_secret" "secret" {
name = var.secret_name
key_vault_id = data.azurerm_key_vault.this.id
}
resource "azurerm_monitor_action_group" "SIDevelopment" {
name = "Test"
resource_group_name = "kv-test"
short_name = "Test"
dynamic "email_receiver" {
for_each = jsondecode(data.azurerm_key_vault_secret.secret.value)
content {
name = email_receiver.value
email_address = email_receiver.value
use_common_alert_schema = false
}
}
}
When I try to compare results they are looks equal
output "kv"{
value = jsondecode(data.azurerm_key_vault_secret.secret.value)
sensitive = true
}
output "string"{
value = jsondecode("[\"example1@email.com\",\"example2@email.com\"]")
sensitive = true
}
after read output as json
{
"kv": {
"sensitive": true,
"type": [
"tuple",
[
"string",
"string"
]
],
"value": [
"example1@email.com",
"example2@email.com"
]
},
"string": {
"sensitive": true,
"type": [
"tuple",
[
"string",
"string"
]
],
"value": [
"example1@email.com",
"example2@email.com"
]
}
}
I've try toset, tolist, etc. And still can't figure out why string from KeyVault behave differently.
It's was just a missing nonsensitive
function
for_each = jsondecode(nonsensitive(data.azurerm_key_vault_secret.secret.value))
So to make it work it I've replace code to be like this
resource "azurerm_monitor_action_group" "SIDevelopment" {
name = "Test"
resource_group_name = "kv-test"
short_name = "Test"
dynamic "email_receiver" {
for_each = jsondecode(nonsensitive(data.azurerm_key_vault_secret.secret.value))
content {
name = email_receiver.value
email_address = email_receiver.value
use_common_alert_schema = false
}
}