Terraform -自动为CloudFront ip创建SGs

Question

我正在尝试自动为CloudFront ip创建SGs，以便我可以将它们与我的ALB相关联。

这篇文章对如何实现它有很好的见解，但不幸的是它在我的环境中不起作用。

这是代码:

data "aws_ip_ranges" "cloudfront" {
regions = ["global"]
services = ["cloudfront"]
}
locals {
chunks_v4 = chunklist(data.aws_ip_ranges.cloudfront.cidr_blocks, 60)
}
resource "aws_security_group" "cloudfront" {
count = length(local.chunks_v4)
ingress {
from_port = 443
to_port   = 443
protocol  = "tcp"
cidr_blocks = [local.chunks_v4[count.index]]
}
egress {
from_port = 0
to_port   = 0
protocol  = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
lifecycle {
create_before_destroy = true
}
}

，这是错误信息:

╷
│ Error: Incorrect attribute value type
│ 
│   on main.tf line 34, in resource "aws_security_group" "cloudfront":
│   34:         cidr_blocks = [local.chunks_v4[count.index]]
│     ├────────────────
│     │ count.index is a number, known only after apply
│     │ local.chunks_v4 is a list of list of dynamic, known only after apply
│ 
│ Inappropriate value for attribute "cidr_blocks": element 0: string required.
╵

应该是这样的:

local.chunks_v4[count.index][0 to 59???]

如何使用Terraform实现?

Answer 1

编辑:由于有60个CIDR块的硬限制，我们需要将其分成块，谢谢你的提醒@Marcin!

locals {
chunks_v4 = chunklist(data.aws_ip_ranges.cloudfront.cidr_blocks, 60)
}
data "aws_ip_ranges" "cloudfront" {
regions  = ["global"]
services = ["cloudfront"]
}
resource "aws_security_group" "cloudfront" {
count = length(local.chunks_v4)
ingress {
from_port   = 443
to_port     = 443
protocol    = "tcp"
cidr_blocks = local.chunks_v4[count.index]
}
egress {
from_port   = 0
to_port     = 0
protocol    = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
lifecycle {
create_before_destroy = true
}
}