Terraform combine lookup and splat syntax - terraform

Question

I'm trying to provision multiple Azure virtual machines with Terraform and then get the MSI identity ID for entitlements. I started with this MSI example (https://www.terraform.io/docs/providers/azurerm/authenticating_via_msi.html) that works for me and am trying to add count, i.e.
resource "azurerm_virtual_machine" "virtual_machine" {
count = "5"
name = "test"
....
identity = {
type = "SystemAssigned"
}
.....
}
resource "azurerm_virtual_machine_extension" "virtual_machine_extension" {
count = "5"
name = "test"
location = "${var.location}"
resource_group_name = "test"
virtual_machine_name = "${element(azurerm_virtual_machine.virtual_machine.*.name, count.index)}"
publisher = "Microsoft.ManagedIdentity"
type = "ManagedIdentityExtensionForWindows"
type_handler_version = "1.0"
settings = <<SETTINGS
{
"port": 50342
}
SETTINGS
}
output "vm_principals" {
# original had --- "${lookup(azurerm_virtual_machine.virtual_machine.identity[0], "principal_id"}"
value = ["${azurerm_virtual_machine.virtual_machine.*.identity[0]}"]
}
Problem is that I get an output array as following:
vm_principals = [
{
principal_id = xxxxxxxxxxxxx,
type = SystemAssigned
},
{
principal_id = yyyyyyyyyyyyy,
type = SystemAssigned
}
]
What I'm trying to get is
vm_principals = [
xxxxxxxxxxxxxxxxx,
yyyyyyyyyyyyyyyyy
]
I tried the obvious variations, but I suspect this is a Terraform limitation.
value = ["${lookup(azurerm_virtual_machine.virtual_machine.*.identity[0], "principal_id)}"]
Any thoughts?

Answer 1

Unfortunately, you're right. I believe you're hitting this issue. However, this will probably be solved in v0.12 of Terraform as it will introduce a revamped language (HCL). See this Hashicorp blog article for more details.

Answer 2

Here's how I dealt with this issue
resource "azurerm_virtual_machine" "kubenode" {
count = "3"
...
}
For a azurerm_virtual_machine resource named kubenode, you can do this:
${azurerm_virtual_machine.kubenode.*.identity.0.principal_id}
Which will return a list of principal ids. you can then do:
${azurerm_virtual_machine.kubenode.*.identity.0.principal_id[count.index]}
For example in a role-assignment scenario:
resource "azurerm_role_assignment" "kubenode-subscription-reader-role" {
count = "${azurerm_virtual_machine.kubenode.count}"
scope = "${data.azurerm_subscription.primary.id}"
role_definition_name = "Reader"
principal_id = "${azurerm_virtual_machine.kubenode.*.identity.0.principal_id[count.index]}"
}