在Terraform中，当动态获取vnet或subnet的值时，可能需要花费时间来创建，并且其他依赖资源无法获取所需的值，因此发生此错误。

• • 错误：**

The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource.

使用静态定义值的代码来解决错误：
示例：
代码：

• • 变量. tf：**

variable "virtual_network_name" {
  type    = string
  default = "my-virtual-network"
}

variable "subnet_address_prefixes" {
  type    = list(string)
  default = ["10.0.1.0/24", "10.0.2.0/24"]
}

variable "subnet_names" {
  type    = set(string)
  default = ["subnet1", "subnet2"]
}

variable "nsg_names" {
  type    = set(string)
  default = ["nsg1", "nsg2"]
}

variable "subnet_nsg_mappings" {
  type    = map(string)
  default = {
    "subnet1" = "nsg1"
    "subnet2" = "nsg2"
  }
}

• • 主文件. tf**

resource "azurerm_virtual_network" "virtual_network" {
  name                = var.virtual_network_name
  address_space       = ["10.0.0.0/16"]
  location                    = data.azurerm_resource_group.example.location
   resource_group_name  = data.azurerm_resource_group.example.name
   
}

resource "azurerm_network_security_group" "nsg" {
  for_each = toset(var.nsg_names)

  name                = each.value
  location                    = data.azurerm_resource_group.example.location
   resource_group_name  = data.azurerm_resource_group.example.name

    security_rule {
    name                       = "allow_http"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "80"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

resource "azurerm_subnet" "subnet" {
  for_each = toset(var.subnet_names)

  name                 = each.value
  virtual_network_name = azurerm_virtual_network.virtual_network.name
  address_prefixes     = var.subnet_address_prefixes
  resource_group_name  = data.azurerm_resource_group.example.name
 // enable_multiple_address_prefixes = true
  
}

# Associate each subnet with its corresponding NSG
resource "azurerm_subnet_network_security_group_association" "subnet_nsg" {
 
 for_each = var.subnet_nsg_mappings

  subnet_id              = azurerm_subnet.subnet[each.key].id
  network_security_group_id = azurerm_network_security_group.nsg[each.value].id
  //subnet_id              = azurerm_subnet.subnet[each.key].id
 // network_security_group_id = azurerm_network_security_group.nsg[var.subnet_nsg_mappings[each.value]].id
}

或者

• • 为Map定义局部变量。**

locals {
  subnet_nsg_mappings = {
    "subnet1" = "nsg1",
    "subnet2" = "nsg2",
    "subnet3" = "nsg3"
  }
}

resource "azurerm_subnet_network_security_group_association" "subnet_nsg" {
  for_each = toset(var.subnet_names)

  subnet_id                = azurerm_subnet.subnet[each.value].id
  network_security_group_id = azurerm_network_security_group.nsg[local.subnet_nsg_mappings[each.value]].id
}

如果动态值必须用于_each，则在应用时不能确定密钥。在这种情况下，请使用-target选项首先应用vnet和子网值，即：for_each值所依赖并完全应用的资源。

terraform apply -target="azurerm_virtual_network.virtual_network" -target="azurerm_subnet.subnet"

• • 参考：**azurerm_subnet_network_security_group_association | Resources | hashicorp/azurerm | Terraform Registry