How to filer data from {} in bash

If want to get the connection_resource_type = "*" from the block of code in main.tf, if source contains only source = "git@github.com:/terraform-azure-utils.git//private-endpoint?ref=""** expected_outpu: **connection_resource_type = "cosmosdb-SQL" ** Main.tf

     module "funtionapp_private_dns" {
      count                = var.function_apps_create_private_dns ? 1 : 0
      source               = "git@github.com:test/terraform-azure-private-dns.git?ref=v2"
      subscription_id      = var.subscription_id
      resource_group       = data.azurerm_resource_group.current.name
      resource_name        = "${var.resource_name}-app"
      resource_tags        = var.resource_tags
      domain_list          = ["privatelink.azurewebsites.net"]
      virtual_network_list = var.use_existing_vnet ? [data.azurerm_virtual_network.existing_vnet[0].id] : [module.vnet-subnet[0].id]
      context              = var.context
      key-vault            = true
     
    }
    
    module "network-security-group" {
      source          = "git@github.com:test/terraform-azure-network-security-group.git?ref=v3.1.1"
      subscription_id = var.subscription_id
      connection_resource_type     = "SQL"
      resource_group  = var.resource_group
      resource_name   = local.nsg_name
      security_rules  = var.security_rules
      context         = var.context
    }
   module "tf_azure_private_endpoint_sean125" {
  source                       = "git@github.com:***/terraform-azure-utils.git//private-endpoint?ref=***"
  subscription_id              = "ed6d71e6-0262-49ad-b8ff-074000058889"
  depends_on                   = []
  connection_resource_type     = "cosmosdb-SQL"
  resource_name                = ""
  pgi_private_endpoint_enabled = "false"
  enable_private_endpoint      = "false"
  connection_resource_id       = "wefew"
  resource_group               = "AZ-RG-Sean-Demo-01"
  resource_tags = {
    Application_Id               = "CI002489694"
    Application_Name             = "Demo"
    Billing_Notification_Group   = ""
    Cost_Center                  = "1076015162"
    Original_Requestor           = "***"
    Owner_Notification_Group     = ""
    Owning_Role                  = null
    Security_Notification_Group  = ""
    Stage                        = "Dev"
    Technical_Notification_Group = ""
    WBS_Element                  = null
    terraform_managed            = "true"
  }

bashscript.sh

cat main.tf | sed 's/^}$/||/' | tr '\n' ' ' | sed 's/||/}\n/g' | grep -Eo 'source\s+=\s+.*key-vault\s+=\s+true' | grep -Eo 'source\s+=\s+"[[:alnum:][:punct:]]+"\s'

Here is a bash script that could give you the string you want

#!/bin/bash

blocks=$(cat main.tf | sed 's/^}$/||}/' | tr '\n' ' ' | sed 's/||/}\n/g')

while IFS= read -r block; do
    if [[ $block == *"key-vault = true"* ]]; then
        connection_resource_type=$(echo "$block" | grep -oP "connection_resource_type\s*=\s*\"\K[^\"]+")
        echo "connection_resource_type = $connection_resource_type"
    fi
done <<< "$blocks"

dont forget to give it the right permission chmod +x extract_connection_resource_type.sh then it should work.