<p>I have the following variable that I try to parse :</p>
<p><strong>variable.tf</strong></p>
<pre class="lang-hcl prettyprint-override"><code>variable &quot;rbac_roles&quot; {
  type = object(
    {
      view = list(object({
        group_name = string,
        group_id = string,
        namespaces = list(string)
      })),
      edit = list(object({
        group_name = string,
        group_id = string,
        namespaces = list(string)
      })),
      admin = list(object({
        group_name = string,
        group_id = string,
        namespaces = list(string)
      }))            
    }
  )
}
</code></pre>
<p><strong>variable.tfvars</strong></p>
<pre class="lang-hcl prettyprint-override"><code>rbac_roles = {
  view = [
    {
      group_name = &quot;group1&quot;,
      group_id   = &quot;123&quot;,
      namespaces = [&quot;default&quot;, &quot;namespace1&quot;]
    },
    {
      group_name = &quot;group2&quot;,
      group_id   = &quot;456&quot;,
      namespaces = [&quot;namespace2&quot;]
    }
  ],
  edit = [
    {
      group_name = &quot;group1&quot;,
      group_id   = &quot;123&quot;,
      namespaces = [&quot;namespace2&quot;]
    }
  ],
  admin = [
    {
      group_name = &quot;group3&quot;,
      group_id   = &quot;789&quot;,
      namespaces = [&quot;default, namespace1, namespace2&quot;]
    },

  ]
}
</code></pre>
<p>I try to create the following resources :</p>
<pre class="lang-hcl prettyprint-override"><code>resource &quot;kubernetes_role_binding&quot; &quot;view_cluster_role_binding&quot; {
  metadata {
    name = ${group}-${namespace}-viewer-binding
    namespace = ${namespace}
  } 
  role_ref {
    api_group = &quot;rbac.authorization.k8s.io&quot;
    kind      = &quot;Role&quot;
    name      = &quot;view&quot;
  }
  subject {
    kind      = &quot;Group&quot;
    name      = ${group}
    api_group = &quot;rbac.authorization.k8s.io&quot;
  }
}  
resource &quot;kubernetes_role_binding&quot; &quot;edit_cluster_role_binding&quot; {
  metadata {
    name = ${group}-${namespace}-viewer-binding
    namespace = ${namespace}
  } 
  role_ref {
    api_group = &quot;rbac.authorization.k8s.io&quot;
    kind      = &quot;Role&quot;
    name      = &quot;edit&quot;
  }
  subject {
    kind      = &quot;Group&quot;
    name      = ${group}
    api_group = &quot;rbac.authorization.k8s.io&quot;
  }
} 
resource &quot;kubernetes_role_binding&quot; &quot;admin_cluster_role_binding&quot; {
  metadata {
    name = ${group}-${namespace}-viewer-binding
    namespace = ${namespace}
  } 
  role_ref {
    api_group = &quot;rbac.authorization.k8s.io&quot;
    kind      = &quot;Role&quot;
    name      = &quot;admin&quot;
  }
  subject {
    kind      = &quot;Group&quot;
    name      = ${group}
    api_group = &quot;rbac.authorization.k8s.io&quot;
  }
} 
</code></pre>
<p>So far I have tried to <code>flatten()</code> my list and to loop over it with <code>for</code> and <code>foreach</code> but I haven't been successful yet. From what I understand I need to use a <code>locals{}</code> to reach my goal, but I can't get the right syntax. Any help will be appreciated !</p>

Will
<p>First this is wrong <code>[&quot;default, namespace1, namespace2&quot;]</code>. It should be <code>[&quot;default&quot;, &quot;namespace1&quot;, &quot;namespace2&quot;]</code>. Once you fix that, you can flatten your data structure as follows:</p>
<pre><code>locals {
   flat_rbac_roles = merge([
         for role, groups in var.rbac_roles:
           merge([
             for group_idx, group in groups:
               {
                 for namespace_idx, namespace in group[&quot;namespaces&quot;]:                     
                       &quot;${role}-${group_idx}-${namespace_idx}&quot; =&gt; {
                       role_name = role
                       group_name = group[&quot;group_name&quot;]
                       group_id = group[&quot;group_id&quot;]
                       namespace = namespace
                   }
               }
           ]...)
     ]...)
}
</code></pre>
<p>which gives:</p>
<pre><code>{                                                                                                                                                                                                      
  &quot;admin-0-0&quot; = {                                                                                                                                                                                             
    &quot;group_id&quot; = &quot;789&quot;                                                                                                                                                                                        
    &quot;group_name&quot; = &quot;group3&quot;                                                                                                                                                                                   
    &quot;namespace&quot; = &quot;default&quot;                                                                                                                                                                                   
    &quot;role_name&quot; = &quot;admin&quot;                                                                                                                                                                                     
  }                                                                                                                                                                                                           
  &quot;admin-0-1&quot; = {                                                                                                                                                                                             
    &quot;group_id&quot; = &quot;789&quot;                                                                                                                                                                                        
    &quot;group_name&quot; = &quot;group3&quot;                                                                                                                                                                                   
    &quot;namespace&quot; = &quot;namespace1&quot;                                                                                                                                                                                
    &quot;role_name&quot; = &quot;admin&quot;                                                                                                                                                                                     
  }                                                                                                                                                                                                           
  &quot;admin-0-2&quot; = {                                                                                                                                                                                             
    &quot;group_id&quot; = &quot;789&quot;                                                                                                                                                                                        
    &quot;group_name&quot; = &quot;group3&quot;                                                                                                                                                                                   
    &quot;namespace&quot; = &quot;namespace2&quot;                                                                                                                                                                                
    &quot;role_name&quot; = &quot;admin&quot;                                                                                                                                                                                     
  }                                                                                                                                                                                                           
  &quot;edit-0-0&quot; = {                                                                                                                                                                                              
    &quot;group_id&quot; = &quot;123&quot;                                                                                                                                                                                        
    &quot;group_name&quot; = &quot;group1&quot;                                                                                                                                                                                   
    &quot;namespace&quot; = &quot;namespace2&quot;                                                                                                                                                                                
    &quot;role_name&quot; = &quot;edit&quot;                                                                                                                                                                                      
  }                                                                                                                                                                                                           
  &quot;view-0-0&quot; = {                                                                                                                                                                                              
    &quot;group_id&quot; = &quot;123&quot;                                                                                                                                                                                        
    &quot;group_name&quot; = &quot;group1&quot;                                                                                                                                                                                   
    &quot;namespace&quot; = &quot;default&quot;                                                                                                                                                                                   
    &quot;role_name&quot; = &quot;view&quot;                                                                                                                                                                                      
  }                                                                                                                                                                                                           
  &quot;view-0-1&quot; = {                                                                                                                                                                                              
    &quot;group_id&quot; = &quot;123&quot;                                                                                                                                                                                        
    &quot;group_name&quot; = &quot;group1&quot;                                                                                                                                                                                   
    &quot;namespace&quot; = &quot;namespace1&quot;                       
    &quot;role_name&quot; = &quot;view&quot;                             
  }                                                  
  &quot;view-1-0&quot; = {                                     
    &quot;group_id&quot; = &quot;456&quot;                               
    &quot;group_name&quot; = &quot;group2&quot;                          
    &quot;namespace&quot; = &quot;namespace2&quot;                       
    &quot;role_name&quot; = &quot;view&quot;                             
  }                                                  
}                             
</code></pre>
