conditional-update-map.tf

# variables.tf
variable "security_group_id" {
  default    = ""
  definition = "ID of the Security Group that we want to attach to the Kubernetes ingress"
}

# main.tf
locals {
  ingress_annotations_required = {
    "kubernetes.io/ingress.class"            = "alb"
    "alb.ingress.kubernetes.io/scheme"       = "internet-facing"
    "alb.ingress.kubernetes.io/target-type"  = "ip"
    "alb.ingress.kubernetes.io/listen-ports" = [{ "HTTP": 80 }, { "HTTPS": 443 }]
  }
  
  ingress_annotations_optional = {
    security_group = var.security_group_id == "" ? {} : { "alb.ingress.kubernetes.io/security-groups" = var.security_group_id }
  }
 
  ingress_annotations = merge(
    local.ingress_annotations_required,
    local.ingress_annotations_optional["security_group"]
  )
}

resource "kubernetes_ingress" "ingress" {
  [...] 
  
  metadata {
    [...]
      
    annotations = local.ingress_annotations
  }
  
  [...]
}