How to refer conditional resources on another resource in terraform - terraform

Question

I created 2 buckets. One will create always and one will create when env is QA.
resource "aws_s3_bucket" "bucket_always" {
bucket_prefix = format("bucket.always")
acl = "private"
versioning {
enabled = true
}
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "aws:kms"
}
}
}
}
resource "aws_s3_bucket" "bucket_conditional" {
count = var.name == "qa" ? 1 : 0
bucket_prefix = format("bucket.conditional")
acl = "private"
versioning {
enabled = true
}
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "aws:kms"
}
}
}
}
Now how can I create an IAM and add both buckets arn? The below policy won't work because of conditional bucket
data "aws_iam_policy_document" "test_policy_document" {
statement {
actions = [
"s3:ListBucket",
]
resources = [
aws_s3_bucket.bucket_always.arn,
aws_s3_bucket.bucket_conditional.arn,
]
}
statement {
actions = [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
]
resources = [
"${aws_s3_bucket.bucket_always.arn}/*",
"${aws_s3_bucket.bucket_conditional.arn}/*",
]
}
}

Answer 1

Split the IAM statements up, and use dynamic blocks. You don't really need to iterate over a specific list of values here, just pass it a list with one value if you want to create the block, or an empty list if you don't want to create the block. For example:
data "aws_iam_policy_document" "test_policy_document" {
statement {
actions = [
"s3:ListBucket",
]
resources = [
aws_s3_bucket.bucket_always.arn
]
}
statement {
actions = [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
]
resources = [
"${aws_s3_bucket.bucket_always.arn}/*"
]
}
dynamic "statement" {
for_each = var.name == "qa" ? ["qa"] : []
content {
actions = [
"s3:ListBucket",
]
resources = [
aws_s3_bucket.bucket_conditional[0].arn
]
}
}
dynamic "statement" {
for_each = var.name == "qa" ? ["qa"] : []
content {
actions = [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
]
resources = [
"${aws_s3_bucket.bucket_conditional[0].arn}/*"
]
}
}
}