How to fix Error: Missing resource instance key - Because resource has for_each set, its attributes must be accessed on specific instances in Terraform

# WRONG - will cause error
resource "aws_security_group_rule" "example" {
  source_security_group_id = aws_security_group.web_app.id
}

# CORRECT - specify the instance key
resource "aws_security_group_rule" "example" {
  for_each = var.rules
  source_security_group_id = aws_security_group.web_app[each.key].id
}

value = aws_instance.web_app["production"].id

# WRONG
output "instance_ids" {
  value = aws_instance.web_app.id
}

# CORRECT - iterate using for expression
output "instance_ids" {
  value = { for k, v in aws_instance.web_app : k => v.id }
}

# Or as a list
output "instance_ids" {
  value = [for instance in aws_instance.web_app : instance.id]
}

# WRONG - causes error
resource "aws_iam_role_policy" "example" {
  policy = jsonencode({
    Statement = [{
      Action = "s3:GetObject"
      Resource = aws_s3_bucket.example.arn  # ERROR if bucket uses for_each
    }]
  })
}

# CORRECT - iterate over instances
resource "aws_iam_role_policy" "example" {
  for_each = var.bucket_configs
  policy = jsonencode({
    Statement = [{
      Action = "s3:GetObject"
      Resource = aws_s3_bucket.example[each.key].arn
    }]
  })
}

# Or use a dynamic block
resource "aws_iam_role_policy" "example" {
  policy = jsonencode({
    Statement = [{
      Action = "s3:GetObject"
      Resource = [for bucket in aws_s3_bucket.example : bucket.arn]
    }]
  })
}

resource "aws_security_group" "main" {
  name = "main-sg"

  dynamic "ingress" {
    for_each = aws_network_interface.example
    content {
      from_port       = 443
      to_port         = 443
      protocol        = "tcp"
      security_groups = [ingress.value.security_groups]
    }
  }
}

# OLD (with count)
resource "aws_instance" "web_app" {
  count = var.instance_count
  # ...
}

output "ids" {
  value = aws_instance.web_app[*].id  # Works with count
}

# NEW (with for_each)
resource "aws_instance" "web_app" {
  for_each = var.instance_map
  # ...
}

output "ids" {
  value = [for instance in aws_instance.web_app : instance.id]  # Must use for expression
}