Passing module outputs back into module with for_each

Terraform
1

Hello everyone!

I have a question I have been unable to find good documentation on, and before I open a bug report, I am curious if anyone else has been met with this issue.

We recently upgraded our entire terraform stack from 0.12.30 to 0.14.5 and we are VERY excited about being able to use depends_on and for_each in modules.

However, the modules we currently manage were written with 0.12.30 in mind, and might need to be tweaked. Our current workflow for something like an S3 bucket is:

module "s3" {
  source   = "../../../../../../providers/aws/modules/s3"
  # ... truncated for brevity
  policy_statements = {
    default = {
      sid         = "DefaultBucketPolicy"
      effect      = "Allow"
      type        = "AWS"
      identifiers = [
        "arn:aws:iam::${module.s3.aws_caller_identity.account_id}:role/somerole"
      ]
      actions     = ["s3:*"]
    }
  }
}

Inside the S3 module, we are creating policies, and if needed, kms keys, iam roles, etc. We also define an output for the aws_caller_identity so it can be used as needed for policies.

The above syntax for passing the output of the aws_caller_identity as defined within the s3 module works great for a single bucket.

However, as soon as we add a for_each to the module and modify the output call to module.s3[each.key].aws_caller_identity.account_id, we get a cycle error in terraform.

Is it possible that we were just getting lucky before and that was never intended behavior? If not, is the cycle issue inside for_each a bug? Is there a way around it?

Our model is very self service for devs who need resources, so we have a lot of people quite unfamiliar with terraform contributing to the repo and simply copying some examples, so it would be nice to keep it simple and not have to have them also call the data object natively within the state (or any other output that does not depend on apply, which starts to get more complicated).

Any help would be much appreciated! Thanks!