Terraform: How to access nested fields in other modules?

[fewstera]

Hi,

I have a dynamodb_table module that has a global_seconary_index.

resource "aws_dynamodb_table" "api_users" {
  name           = "${var.env}-api-users"
  read_capacity  = 5
  write_capacity = 5
  hash_key       = "UserId"

  attribute {
    name = "UserId"
    type = "S"
  }

  attribute {
    name = "ApiKey"
    type = "S"
  }

  global_secondary_index {
    name               = "ApiKeyIndex"
    hash_key           = "UserId"
    range_key          = "ApiKey"
    write_capacity     = 5
    read_capacity      = 5
    projection_type    = "ALL"
  }

}

And a ECS container that needs to apply a policy to the role which gives it access to both the table and the table index.

module "ecs_service" {
  source = "..."
  task_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDynamodbTableAccess",
      "Action": "dynamodb:*",
      "Effect": "Allow",
      "Resource": [
        "${aws_dynamodb_table.api_users.arn}",
        "${aws_dynamodb_table.api_users.arn}/index/ApiKeyIndex"
      ]
    }
  ]
}
EOF
}

Instead of hard coding ApiKeyIndex is there anyway I can access aws_dynamodb_table.api_users.global_seconary_index.name?

Things I've tried (non have worked)

"${aws_dynamodb_table.api_users.global_seconary_index.name}"
"${lookup(aws_dynamodb_table.api_users.global_seconary_index, "name"}"
"${lookup(element(aws_dynamodb_table.api_users.global_seconary_index, 0), "name"}"

Thank you,

Aidan

[jbardin]

Hi @fewstera,

Sorry you're having trouble here, but I'm a bit confused by the question. You're asking how to access fields from another module, but the intent of the example config seems to be that you want to interpolate aws_dynamodb_table.api_users.global_seconary_index.name.

You didn't include the output, but I'm guessing that the first problem lies in the typo global_seconary_index and the missing closing parentheses.

"${lookup(aws_dynamodb_table.api_users.global_secondary_index[0], "name")}"

Note that the underlying type of the global_secondary_index field is a set and indexing it at [0] and looking up the value as a map is taking advantage of an implementation detail that isn't guaranteed to work consistently between versions.

If you want to avoid having ApiKeyIndex hard-coded in 2 places, I would suggest just using a local value for that, and the same interpolation in both places.

(if the question was actually about accessing attributes from another module -- it's not something you can do directly, values have to be explicitly mapped to outputs)

[fewstera]

Thank you for you help. I think I'll just use a local value like you suggested.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.