Terraform Each Object Context Validator

Threat/Impact Level: MEDIUM | Exploitability/Downtime Risk: HIGH (blocks all applies) | Time to Fix: 5–15 mins

TL;DR

• What broke: A resource, module, data block, or local expression references each.key or each.value but the enclosing block has no for_each meta-argument, making the each object undefined in that scope.
• How to fix it: Add for_each to the block that needs iteration, or remove the orphaned each reference and substitute the correct input variable or local value.
• Fast path: Use our Client-Side Sandbox above to auto-refactor this — paste your failing .tf block and get corrected HCL without sending secrets anywhere.

Error: The "each" object is not valid in this context

  on main.tf line 14, in resource "aws_iam_role_policy_attachment" "this":
  14:   role = each.value.role_name

A reference to "each.value" has been used in a context in which it
is unavailable, such as when the configuration for a resource that
does not use "for_each" references "each".

How to Fix It (The Solution)

Scenario 1 — Missing `for_each` on the resource block

The most common case: each is referenced but for_each was accidentally omitted or removed during a refactor.

 variable "role_attachments" {
   type = map(object({
     role_name  = string
     policy_arn = string
   }))
 }

 resource "aws_iam_role_policy_attachment" "this" {
+  for_each = var.role_attachments
+
   role       = each.value.role_name
   policy_arn = each.value.policy_arn
 }

Scenario 2 — `each` used inside a child module's resource (not the module call)

Bad: Engineer passes a map to the module and tries to use each inside the module's internal resource.

 # modules/iam_attachment/main.tf

- # WRONG: each is not in scope here; this is inside the module, not the call site
- resource "aws_iam_role_policy_attachment" "this" {
-   role       = each.value.role_name
-   policy_arn = each.value.policy_arn
- }

+ # CORRECT: accept inputs via variables; let the caller use for_each on the module
+ variable "role_name"  { type = string }
+ variable "policy_arn" { type = string }
+
+ resource "aws_iam_role_policy_attachment" "this" {
+   role       = var.role_name
+   policy_arn = var.policy_arn
+ }

 # root/main.tf — the module CALL is where for_each lives
 module "iam_attachment" {
   source   = "./modules/iam_attachment"
+  for_each = var.role_attachments
+
+  role_name  = each.value.role_name
+  policy_arn = each.value.policy_arn
 }

Scenario 3 — `each` inside a `locals` block (invalid scope)

 locals {
-  # INVALID: each is never available in locals
-  attachment_id = "${each.key}-attachment"
+  # Use a for expression instead
+  attachment_ids = { for k, v in var.role_attachments : k => "${k}-attachment" }
 }

Enterprise Best Practice

• Encapsulate iteration at the boundary. The for_each meta-argument belongs on the outermost block that needs multiple instances — typically the module call in the root, not inside the module itself. Keep modules stateless with respect to iteration.
• Name your iterators explicitly using iterator in dynamic blocks to avoid shadowing confusion with each:

  dynamic "ingress" {
    for_each = var.ingress_rules
    iterator = rule
    content {
      from_port = rule.value.from_port
    }
  }

• Validate inputs with precondition (Terraform ≥ 1.2) to catch empty maps before for_each produces zero instances silently.

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

- repo: https://github.com/antonbabenko/pre-commit-terraform
  rev: v1.92.0
  hooks:
    - id: terraform_validate

# .tflint.hcl
plugin "terraform" {
  enabled = true
  preset  = "recommended"  # catches invalid each references and missing for_each
}

- name: Terraform Validate
  run: |
    terraform init -backend=false
    terraform validate
  env:
    TF_CLI_ARGS: "-no-color"