Iam_role assume_role_policy with loop of account ids

Terraform
1

I can’t seem to create a loop for the Principal statement like the following due to syntax issues.

If I do slightly different and use for_each I basically end up creating 4 roles instead of just 1 role with 4 Principals

  resource "aws_iam_role" "external-dns-cross-account" {
    count = local.dns_account

    name  = "external-dns-cross-account"

    assume_role_policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect = "Allow"
          Principal = {
            AWS = [
              for ( id in module.ap-globals.ap_accounts ) {
                "arn:aws:iam::${id}:role/external-dns*"·
              }
            ]
          }
          Action = "sts:AssumeRole"
        }
      ]
    })

    inline_policy {
      name = "route53"

      policy = jsonencode({
        Version = "2012-10-17",
        Statement = [
          {
            Action = "route53:*",
            Resource = var.zones,
            Effect = "Allow"
          }
        ]
      })
    }

    tags = local.tags
  }
2

For Expressions - Configuration Language | Terraform | HashiCorp Developer documents the correct syntax to use - you’re just using different punctuation characters to what the Terraform language syntax defines, for some reason.

3

Thanks I was able to fix the syntax with [for id in modue.ap-global.ap_account : "arn:aws:iam::${id}:role/external-dns*" ]
but that led to a MalformedDocument realized the wildcard was blowing things up so ended up changing to this for completeness:

  resource "aws_iam_role" "external-dns-cross-account" {
    count = local.dns_account

    name  = "external-dns-cross-account"

    # assume_role_policy = data.aws_iam_policy_document.external-dns_assume_role_policy.json
    assume_role_policy = jsonencode({
      Version   = "2012-10-17"
      Statement = [
        {
        Effect    = "Allow"
        Principal = {
          AWS = [ for id in module.ap-globals.ap_accounts : "arn:aws:iam::${id}:root" ]
        }
        Action    = "sts:AssumeRole"
        Condition = {
          StringLike = {
            "aws:PrincipalArn" = [ for id in module.ap-globals.ap_accounts : "arn:aws:iam::${id}:role/external-dns*" ]
          }
        }
        }
      ]
    })

    inline_policy {
      name = "route53"

      policy = jsonencode({
        Version = "2012-10-17",
        Statement = [
          {
            Action = "route53:*",
            Resource = var.zones,
            Effect = "Allow"
          }
        ]
      })
    }

    tags = local.tags
  }