Cannot create deployment principal and the CDN in the same terraform run

[abeluck]

Describe the Bug

I would like to create an IAM user and make it the deployment principal in the same terraform execution.

But this isn't possible due to the use of dynamic map keys.

This seems like a very simple and common use-case.

Expected Behavior

I expect to be able to create my deployment principal and the CDN in one go.

Steps to Reproduce

Steps to reproduce the behavior:

1. Run the tf module below

resource "aws_iam_user" "deploy_user" {
  name = module.this.id
  tags = module.this.tags
}

module "cdn" {
  source                              = "cloudposse/cloudfront-s3-cdn/aws"
  version                             = "0.86.0"
  context                             = module.this.context
  cloudfront_access_logging_enabled   = true
  cloudfront_access_log_create_bucket = true
  deployment_principal_arns = {
    (aws_iam_user.deploy_user.arn) = [""]
    # this also doesn't work
    # "${aws_iam_user.deploy_user.arn}" = [""]
  }
}

Result:

╷
│ Error: Invalid for_each argument
│ 
│   on .terraform/modules/cdn/main.tf line 191, in data "aws_iam_policy_document" "deployment":
│  191:   for_each = local.enabled ? var.deployment_principal_arns : {}
│     ├────────────────
│     │ local.enabled is true
│     │ var.deployment_principal_arns is a map of list of string, known only after apply
│ 
│ The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource.
│ 
│ When working with unknown values in for_each, it's better to define the map keys statically in your configuration and place apply-time results only in the map values.
│ 
│ Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a second time to fully converge.

Environment (please complete the following information):

Anything that will help us triage the bug will help. Here are some ideas:

• TF version 1.3.8

Additional Info

Hashicorp recommends storing only known values in map keys, and leaving all dynamic/unknown values in the map values (source0, source1).

Fixing it I think will require deprecating the existing deployment_principal_arns variable, and adding a new one that uses a map of objects:

...
  deployment_principal_arns = {
    "deploy_user1" : {
      "arn" : aws_iam_user.deploy_user.arn,
      "path_prefix" : ""
    }
  }
...

[abeluck]

Created a PR for this.