enabling using multiple ssh keys for one user in sftp module

main.tf

@@ -6,13 +6,31 @@ locals {
   is_vpc = var.vpc_id != null
 
   user_names = keys(var.sftp_users)
-
+  sftp_users = { for user, val in var.sftp_users : user => merge(val,
+    { public_key = flatten(tolist([val["public_key"]])) })
+  }
   user_names_map = {
-    for user, val in var.sftp_users :
+    for user, val in local.sftp_users :
     user => merge(val, {
       s3_bucket_arn = lookup(val, "s3_bucket_name", null) != null ? "${local.s3_arn_prefix}${lookup(val, "s3_bucket_name")}" : one(data.aws_s3_bucket.landing[*].arn)
     })
   }
+  ssh_keys = flatten([
+    for user, val in local.sftp_users : [
+      for key in val["public_key"] : {
+        user_name  = val["user_name"]
+        public_key = key,
+        token      = "${val["user_name"]}#${key}"
+      }
+    ]
+  ])
+
+  ssh_keys_expanded = {
+    for v in local.ssh_keys : v["token"] => {
+      public_key = v["public_key"]
+      user_name  = v["user_name"]
+    }
+  }
 }
 
 data "aws_partition" "default" {
@@ -51,7 +69,7 @@ resource "aws_transfer_server" "default" {
 }
 
 resource "aws_transfer_user" "default" {
-  for_each = local.enabled ? var.sftp_users : {}
+  for_each = local.enabled ? local.sftp_users : {}
 
   server_id = join("", aws_transfer_server.default[*].id)
   role      = aws_iam_role.s3_access_for_sftp_users[each.value.user_name].arn
@@ -83,7 +101,7 @@ resource "aws_transfer_user" "default" {
 }
 
 resource "aws_transfer_ssh_key" "default" {
-  for_each = local.enabled ? var.sftp_users : {}
+  for_each = local.enabled ? local.ssh_keys_expanded : {}
 
   server_id = join("", aws_transfer_server.default[*].id)