cosmosdb_account virtual_network_rule for_each

Question

I'm trying to create a set of subnet rules for a cosmosdb account.

I've tried a dynamic and a for_each on the resource and I get the same error each time - am I going about this the wrong way?

Currently trying this:

resource "azurerm_cosmosdb_account" "db" {
  name                = local.name
  location            = var.location
  resource_group_name = var.resource_group_name

  offer_type       = "Standard" #(Required) Specifies the Offer Type to use for this CosmosDB Account - currently this can only be set to Standard.
  enable_free_tier = var.enable_free_tier
  kind             = var.kind

  identity {
    type = "SystemAssigned"
  }

  ip_range_filter = join(",", local.network_rules.ip_rules)

  dynamic "virtual_network_rule" {
    for_each = var.virtual_network_subnet_ids
    content {
      id = each.value
    }
  }
}

Currently getting:

Error: each.value cannot be used in this context
│ 
│   on .terraform/modules/azurerm_cosmosdb_account/azurerm_cosmosdb_account/main.tf line 27, in resource "azurerm_cosmosdb_account" "db":
│   27:       id = each.value
│ 
│ A reference to "each.value" has been used in a context in which it
│ unavailable, such as when the configuration no longer contains the value in
│ its "for_each" expression. Remove this reference to each.value in your
│ configuration to work around this error.
╵

Answer 1

A dynamic block does not use the each keyword, but the value of the iterator argument instead. If omitted, it will use the name of the dynamic block instead. Or as the documentation states it:

The iterator argument (optional) sets the name of a temporary variable that represents the current element of the complex value. If omitted, the name of the variable defaults to the label of the dynamic block.

It's generally fine to omit the iterator argument and just go with the (what should be a) unique name of the block. In your case, replace each.value with virtual_network_rule.value, so you get:

dynamic "virtual_network_rule" {
  for_each = var.virtual_network_subnet_ids

  content {
    id = virtual_network_rule.value
  }
}

If you do want to use the iterator argument, it would look something like this:

dynamic "virtual_network_rule" {
  for_each = var.virtual_network_subnet_ids
  iterator = "rule"

  content {
    id = rule.value
  }
}