aws_security_groupingress块使用dynmaic块

Question

我想我应该能够做这样的事情。但是端口、协议和cidrs的地图是错误的。。。如何制作列表地图并在地图上进行交互。

variable "master-sg-ingress-ports" {
//depends_on [aws_security_group.master-lb-sg, aws_security_group.worker-sg]
description = "List of port numbers for specific security group"
type        = map(any)
//  format should be [ sg1 =  [from_port, to_port, protocol, from_ip_cidr] ]  ]
default     = [ "ingress1" =  [80, 80, "TCP", "0.0.0/0"],
"ingress2" =  [80, 80, "TCP", "::0/0"],
"ingress3" =  [443, 80, "TCP", "0.0.0.0/0"],
"ingress4" =  [443, 80, "TCP", "::0/0"],
"ingress5 "=  [0, 0, "-1", "172.30.0.0/16"],]
}
resource "aws_security_group" "master_sg" {
depends_on  = [aws_security_group.master_lb_sg, aws_security_group.worker_sg]
provider    = aws.region_master
name        = "master-sg"
description = "security group for Jenkins master"
vpc_id      = aws_vpc.vpc_master.id

dynamic "ingress" {
# this for_each is not identical to for_each in line 21
for_each = toset(var.master-sg-ingress-ports) # iterator can be (need to be) configured
iterator = it                                 # set the name of the iterator, which can be any name, but "each" (!!)
content {
from_port   = it[0].value
to_port     = it[1].value
protocol    = it[2].value
cidr_blocks = [it[3].value]
}
}
}

terraform init在ingress1 下给了我以下带下划线的内容

The Terraform configuration must be valid before initialization so that
Terraform can determine which modules and providers need to be installed.
╷
│ Error: Invalid default value for variable
│ 
│   on security_groups.tf line 64, in variable "master-sg-ingress-ports":
│   64:   default     = [ "ingress1" =  [80, 80, "TCP", "0.0.0/0"],
│   65:                   "ingress2" =  [80, 80, "TCP", "::0/0"],
│   66:                   "ingress3" =  [443, 80, "TCP", "0.0.0.0/0"],
│   67:                   "ingress4" =  [443, 80, "TCP", "::0/0"],
│   68:                   "ingress5 "=  [0, 0, "-1", "172.30.0.0/16"],].
╵```

Answer 1

正确的默认值是地图，而不是现在的地图列表。所以应该是：

variable "master-sg-ingress-ports" {

description = "List of port numbers for specific security group"
type        = map(any)
default     = { "ingress1" =  [80, 80, "TCP", "0.0.0.0/0"],
"ingress2" =  [80, 80, "TCP", "::/0"],
"ingress3" =  [443, 80, "TCP", "0.0.0.0/0"],
"ingress4" =  [443, 80, "TCP", "::/0"],
"ingress5 "=  [0, 0, "-1", "172.30.0.0/16"]}
}

master_sg:的更新

resource "aws_security_group" "master_sg" {
# depends_on  = [aws_security_group.master_lb_sg, aws_security_group.worker_sg]
# provider    = aws.region_master
name        = "master-sg"
description = "security group for Jenkins master"
vpc_id      = data.aws_vpc.default.id

dynamic "ingress" {
# this for_each is not identical to for_each in line 21
for_each = var.master-sg-ingress-ports 
content {
from_port   = ingress.value[0]
to_port     = ingress.value[1]
protocol    = ingress.value[2]
cidr_blocks = [ingress.value[3]]
}
}
}