Dynamic deployment of Private endpoint - azure

Question

I am trying to develop a module that if the variable DeployPrivateEndpoint == true will deploy the private endpoint and if false it will not be deployed.
I currently have the following code:
resource "azurerm_container_registry" "ACR" {
count = length(var.ACR_Name)
name = var.ACR_Name[count.index]
resource_group_name = var.resourcegroup_name
location = var.location
sku = var.ACR_Sku
admin_enabled = var.ACR_AdminEnabled
georeplication_locations = var.ACR_GeoRepLocation
}
resource "azurerm_private_dns_zone" "PDZ" {
count = var.DeployPrivateEndpoint == true ? 1 : 0
name = "privatelink.azurecr.io"
resource_group_name = var.resourcegroup_name
}
resource "azurerm_private_endpoint" "PEP" {
count = var.DeployPrivateEndpoint == true ? length(var.PEP_Name) : 0
name = var.PEP_Name[count.index]
location = var.location
resource_group_name = var.resourcegroup_name
subnet_id = element(concat(var.subnet_id[*], [""]), count.index)
private_dns_zone_group {
name = "private-dns-zone-group"
private_dns_zone_ids = element(concat(azurerm_private_dns_zone.PDZ.*.id, [""]), count.index)
}
private_service_connection {
name = var.PEP_Name[count.index]
private_connection_resource_id = element(concat(azurerm_container_registry.ACR.*.id, [""]), count.index)
subresource_names = [ "registry" ]
is_manual_connection = false
}
}
The code only crashes on the part at private_dns_zone_group at this point if the value of the variable is false. Terraform expects that a private_dns_zone_ids will be given, but it is not created because the variable is set to false. I get the following error:
Error: Invalid index
on .terraform\modules\containerRegistry\outputs.tf line 10, in
output "ACR_PDZID": 10: value =
azurerm_private_dns_zone.PDZ.0.id
|----------------
| azurerm_private_dns_zone.PDZ is empty tuple
any help is appreciated!
Edit:
The module is called trough a main that looks like this:
terraform {
required_version = ">= 0.13"
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "2.47.0"
}
}
}
provider "azurerm" {
subscription_id = "****"
client_id = "****"
client_secret = "*****"
tenant_id = "*****"
features {}
}
module "ResourceGroups" {
source = "git::https://***#dev.azure.com/***/AzureTerraformModules/_git/ResourceGroup"
location = var.location
RG_Name = var.RG_Name
}
module "VirtualNetwork" {
source = "git::https://***#dev.azure.com/***/AzureTerraformModules/_git/VirtualNetwork"
resourcegroup_name = module.ResourceGroups.RG_Name[0]
location = var.location
VNET_Name = var.vnet_name
VNET_Cidr = var.vnet_cidr
}
module "Subnet" {
source = "git::https://***#dev.azure.com/***/AzureTerraformModules/_git/Subnet"
resourcegroup_name = module.ResourceGroups.RG_Name[0]
location = var.location
VNET_name = module.VirtualNetwork.VNET_Name[0]
SNET_cidr = var.subnet_cidr
SNET_name = var.subnet_names
}
module "containerRegistry" {
source = "git::https://***#dev.azure.com/***/AzureTerraformModules/_git/ContainerRegistry"
resourcegroup_name = module.ResourceGroups.RG_Name[0]
location = var.location
subnet_id = module.Subnet.SNET_ID
PEP_Name = ["****", "*****"]
ACR_Name = ["****", "*****" ]
ACR_Sku = "Premium"
DeployPrivateEndpoint = false
}
The output.tf file form the module looks lik this:
output "ACR_ID" {
value = azurerm_container_registry.ACR.*.id
}
output "ACR_LoginServer" {
value = azurerm_container_registry.ACR.*.login_server
}
output "ACR_PDZID" {
value = azurerm_private_dns_zone.PDZ.0.id
}
output "ACR_PEPID" {
value = azurerm_private_endpoint.PEP.*.id
}

Answer 1

You should tune a bit your ACR_PDZID output, change 0 to *
output "ACR_PDZID" should look like this:
output "ACR_PDZID" {
value = azurerm_private_dns_zone.PDZ.*.id
}