在创建资源之前，我们可以在Terraform中匹配多个条件吗

Question

我正试图将AWS CloudFormation脚本转换为Terraform，但我在这里面临的问题是CloudFormation有一种叫做条件的东西，我们可以在创建资源之前指定多个匹配的条件，但我很难在Terraform中复制相同的条件。

ClodeFormation示例代码：

Conditions:
NACLDefaultPublicAllowed: !Equals [ !Ref NACLOpenByDefault, "true"]
NACLDefaultPrivateOnly: !Equals [ !Ref NACLOpenByDefault, "false"]
InboundSSHIsAllowed: !Equals [ !Ref AllowInboundSSH, "true"]
InboundRDPIsAllowed: !Equals [ !Ref AllowInboundRDP, "true"]
InboundVPNIsAllowed: !Equals [ !Ref AllowInboundVPN, "true"]
OutboundHTTPIsAllowed: !Equals [ !Ref AllowOutboundHTTP, "true"]
OutboundHTTPSIsAllowed: !Equals [ !Ref AllowOutboundHTTPS, "true"]
HasRemoteHomeNetwork: !Not [ !Equals [ !Ref RemoteHomeNetworkCIDR, ""]]
HasRemoteRepositories: !Not [ !Equals [ !Ref RemoteRepositoriesCIDR, ""]]

AddMGMTInboundSSHRules: !And
- !Condition HasRemoteHomeNetwork
- !Condition NACLDefaultPrivateOnly
- !Condition InboundSSHIsAllowed
AddMGMTInboundRDPRules: !And
- !Condition HasRemoteHomeNetwork
- !Condition NACLDefaultPrivateOnly
- !Condition InboundRDPIsAllowed
AddMGMTInboundVPNRules: !And
- !Condition HasRemoteHomeNetwork
- !Condition NACLDefaultPrivateOnly
- !Condition InboundVPNIsAllowed
AddMGMTOutboundEphemeralRemoteHomeNetworkRules: !Or
- !Condition AddMGMTInboundSSHRules
- !Condition AddMGMTInboundVPNRules
AddOutboundHTTPAnywhereRules: !And
- !Condition OutboundHTTPIsAllowed
- !Condition NACLDefaultPrivateOnly
AddOutboundHTTPSAnywhereRules: !And
- !Condition OutboundHTTPSIsAllowed
- !Condition NACLDefaultPrivateOnly
AddInboundEphemeralAnywhereRules: !Or
- !Condition AddOutboundHTTPAnywhereRules
- !Condition AddOutboundHTTPSAnywhereRules
AddRemoteRepositoriesCIDR: !And
- !Condition HasRemoteRepositories
- !Condition NACLDefaultPrivateOnly

现在，当我创建一个资源(在CloudFormation中(时，我可以直接使用：

rNACLEntryAllowOutboundHTTPfromPUBLtoRemoteRepositories:
Type: "AWS::EC2::NetworkAclEntry"
Condition: AddRemoteRepositoriesCIDR
Properties:
xxxx
rNACLEntryAllowOutboundHTTPSfromPUBLtoRemoteRepositories:
Type: "AWS::EC2::NetworkAclEntry"
Condition: HasRemoteHomeNetwork
Properties:
xxxx
and so on

如何在地形中获得相同的结果？

Answer 1

在Terraform中，我们将这种条件表示为有条件地在资源的零个或一个实例之间进行选择。如果你想像在CloudFormation中那样考虑条件并给它们命名，那么你可以把条件分配给命名的局部值，比如：

variable "allow_inbound_ssh" {
type = bool
}
variable "nacl_open_by_default" {
type = bool
}
variable "remote_home_network_cidr" {
type    = string
default = null
}
locals {
inbound_ssh_is_allowed    = var.allow_inbound_ssh
nacl_default_private_only = !var.nacl_open_by_default
has_remote_home_network   = var.remote_home_network_cidr != null
add_management_inbound_ssh_rules = (
local.has_remote_home_network &&
local.nacl_default_private_only &&
local.inbound_ssh_is_allowed
)
}

然后，您可以在每个资源中使用这些局部值作为条件count表达式的一部分，如下所示：

# (I'm assuming that aws_network_acl_rule is the Terraform
# equivalent of CloudFormation's AWS::EC2::NetworkAclEntry,
# but I'm not sure.)
resource "aws_network_acl_rule" "example" {
count = local.add_management_inbound_ssh_rules ? 1 : 0
# ...
}

有了这个特殊的count参数，aws_network_acl_rule将是一个单元素列表或零元素列表，这取决于local.add_management_inbound_ssh_rules的最终值。