<p>I am looking for a solution here on Terraform for creating role assignment and selecting the principal ids based on region..
If I am running the code to china, the variable should be &quot;local.principal_ids_cn&quot; and if global, then it has to be &quot;local.principal_ids&quot;..
I do have a env variable where the geo will be set based on cluster-name.. so &quot;if geo = cn use local.principal_ids_cn, else use local.principal_ids&quot;
How can this be incorporated in terraform?</p>
<p>This is my input file:</p>
<pre><code>
    &quot;applications&quot; : [
        {
            &quot;principal_id&quot; : &quot;00000000-000000-global-000000000000&quot;, 
            &quot;principal_id_cn&quot; : &quot;00000000-000000-china-000000000000&quot;,

        }
]
}
</code></pre>
<p>My resource block looks like this:</p>
<pre><code>locals {
# get json
role_data = jsondecode(file(var.inputfile))
principal_ids = distinct([for principal in local.role_data.applications : principal.principal_id])
principal_ids_cn = distinct([for principal_cn in local.role_data.applications : principal.principal_id_cn])
}

data &quot;azurerm_subscription&quot; &quot;primary&quot; {}

resource &quot;azurerm_role_assignment&quot; &quot;custom&quot; {
  for_each = toset(local.principal_ids)
  scope = data.azurerm_subscription.primary.id
  role_definition_name = var.custom_role
  principal_id = each.key
}

resource &quot;azurerm_role_assignment&quot; &quot;builtin&quot; {
  for_each = toset(local.principal_ids)
  scope = data.azurerm_subscription.primary.id
  role_definition_name = var.builtin_role
  principal_id = each.key
}
</code></pre>
<p>variables.tf:</p>
<pre><code>variable &quot;custom_role&quot; {
  type = string
  description = &quot;custom role&quot;
  default = &quot;READER&quot;
}

variable &quot;builtin_role&quot; {
  type = string
  description = &quot;builtin role&quot;
  default = &quot;My_built_in_role&quot;
}
</code></pre>
<p>If there is a possibility to switch over the local variables based on the regions(china and global)?
Any suggestions ate ideas how this can be achieved?</p>

pk_dhruv
<p>You can use conditional expression in Terraform to implement the logic &quot;if geo = cn use local.principal_ids_cn, else use local.principal_ids&quot;</p>
<p>Terraform code for your resource block:</p>
<pre><code>locals {
# get json
  role_data = jsondecode(file(var.inputfile))
  principal_ids = distinct([for principal in local.role_data.applications : principal.principal_id])
  principal_ids_cn = distinct([for principal_cn in local.role_data.applications : principal.principal_id_cn])
  principal = (var.geo == &quot;cn&quot; ? local.principal_ids_cn : local.principal_ids)
}

data &quot;azurerm_subscription&quot; &quot;primary&quot; {}

resource &quot;azurerm_role_assignment&quot; &quot;custom&quot; {
  for_each = toset(local.principal_ids)
  scope = data.azurerm_subscription.primary.id
  role_definition_name = var.custom_role
  principal_id = each.key
}

resource &quot;azurerm_role_assignment&quot; &quot;builtin&quot; {
  for_each = toset(local.principal_ids)
  scope = data.azurerm_subscription.primary.id
  role_definition_name = var.builtin_role
  principal_id = each.key
}
</code></pre>
<p><a href="https://www.terraform.io/docs/language/expressions/conditionals.html" rel="nofollow noreferrer">https://www.terraform.io/docs/language/expressions/conditionals.html</a></p>
