使用单一地形模块创建多个nsg错误

Question

我创建了一个用于创建多个nsg的terraform模块。我得到下面的错误，而实现它。

main.tf

data "azurerm_resource_group" "rg" {
name = var.resource_group_name
}
resource "azurerm_network_security_group" "nsg" {
for_each            = var.nsgs
name                = each.key
resource_group_name = data.azurerm_resource_group.rg.name
location            = data.azurerm_resource_group.rg.location
}

resource "azurerm_network_security_rule" "custom_rules" {
for_each = local.custom_rules
name                                       = each.value.name
priority                                   = each.value.priority
direction                                  = each.value.direction
access                                     = each.value.access
protocol                                   = each.value.protocol
source_port_ranges                         = each.value.source_port_ranges
destination_port_ranges                    = each.value.destination_port_ranges
description                                = each.value.description
source_address_prefix                      = each.value.source_address_prefix
source_address_prefixes                    = each.value.source_address_prefixes
destination_address_prefix                 = each.value.destination_address_prefix
destination_address_prefixes               = each.value.destination_address_prefixes
resource_group_name                        = data.azurerm_resource_group.rg.name
network_security_group_name                = azurerm_network_security_group.nsg.name
source_application_security_group_ids      = each.value.source_application_security_group_ids
destination_application_security_group_ids = each.value.destination_application_security_group_ids
}

locals.tf

locals {
nsgs1 = {
for_each = var.nsgs 
custom_rules1 = each.value.custom_rules
}
custom_rules = {
for r in local.custom_rules1 :
r.name => {
name                                       = r.name
priority                                   = lookup(r, "priority")
direction                                  = lookup(r, "direction", "Any")
access                                     = lookup(r, "access", "Allow")
protocol                                   = lookup(r, "protocol", "*")
source_port_ranges                         = split(",", replace(lookup(r, "source_port_range", "*"), "*", "0-65535"))
destination_port_ranges                    = split(",", replace(lookup(r, "destination_port_range", "*"), "*", "0-65535"))
source_address_prefix                      = lookup(r, "source_application_security_group_ids", null) == null && lookup(r, "source_address_prefixes", null) == null ? lookup(r, "source_address_prefix", "*") : null
source_address_prefixes                    = lookup(r, "source_application_security_group_ids", null) == null ? lookup(r, "source_address_prefixes", null) : null
destination_address_prefix                 = lookup(r, "destination_application_security_group_ids", null) == null && lookup(r, "destination_address_prefixes", null) == null ? lookup(r, "destination_address_prefix", "*") : null
destination_address_prefixes               = lookup(r, "destination_application_security_group_ids", null) == null ? lookup(r, "destination_address_prefixes", null) : null
description                                = lookup(r, "description", "Security rule for ${lookup(r, "name", "default_rule_name")}")
resource_group_name                        = data.azurerm_resource_group.rg.name
network_security_group_name                = azurerm_network_security_group.nsg.name
source_application_security_group_ids      = lookup(r, "source_application_security_group_ids", null)
destination_application_security_group_ids = lookup(r, "destination_application_security_group_ids", null)
}
}
}

variables.tf

variable "resource_group_name" {
description = The name of the resource group in which to create the network security group.
type        = string
}

variable "nsgs"{
type = map(object({
custom_rules = any
}))
default = {
nsg_nm = {
custom_rules =[      {
name                   = "DenyAllIn"
priority               = 4096
direction              = "Inbound"
access                 = "Deny"
protocol               = "tcp"
source_port_range      = "*"
destination_port_range = "*"
source_address_prefix  = "*"
destination_address_prefix = "*"
description            = "Deny all inbound ports"
},
{
name                   = "DenyAllOut"
priority               = 4096
direction              = "Outbound"
access                 = "Deny"
protocol               = "tcp"
source_port_range      = "*"
destination_port_range = "*"
source_address_prefix  = "*"
destination_address_prefix = "*"
description            = "Deny all outbound ports"
},
]
},
nsg_nv = {
custom_rules =[      {
name                   = "DenyAllIn"
priority               = 4096
direction              = "Inbound"
access                 = "Deny"
protocol               = "tcp"
source_port_range      = "*"
destination_port_range = "*"
source_address_prefix  = "*"
destination_address_prefix = "*"
description            = "Deny all inbound ports"
},
{
name                   = "DenyAllOut"
priority               = 4096
direction              = "Outbound"
access                 = "Deny"
protocol               = "tcp"
source_port_range      = "*"
destination_port_range = "*"
source_address_prefix  = "*"
destination_address_prefix = "*"
description            = "Deny all outbound ports"
},
]
}
}
}

当我调用这个模块时，我得到的错误如下所示:

错误:。值不能在此上下文中使用││on main。在locals中，第24行:│24:custom_rules1 = each.value.custom_rules││对"each.value"的引用已在不可用的上下文中使用，例如当配置不再使用时│在其"for_each"表达式。删除对每一个的引用。值
│处理此错误。

调用该模块的代码如下:

resource "azurerm_resource_group" "rg2" {
name     = "rg2"
location = "Australia East"
}

module "nsgs" {
source = "./multiplensgs"
resource_group_name = azurerm_resource_group.rg2.name
}

对于不同的nsgs nsg_nm和nsg_nv，规则应该如下所示:

{
name                   = "DenyAllIn"
priority               = 4096
direction              = "Inbound"
access                 = "Deny"
protocol               = "tcp"
source_port_range      = "*"
destination_port_range = "*"
source_address_prefix  = "*"
destination_address_prefix = "*"
description            = "Deny all inbound ports"
},
{
name                   = "DenyAllOut"
priority               = 4096
direction              = "Outbound"
access                 = "Deny"
protocol               = "tcp"
source_port_range      = "*"
destination_port_range = "*"
source_address_prefix  = "*"
destination_address_prefix = "*"
description            = "Deny all outbound ports"
},

Answer 1

我想我明白你想做什么，这是平嵌套变量var.nsgs。如果是，您可以执行以下操作:

locals {
custom_rules = merge([
for k,v in var.nsgs: {
for idx, rules in v.custom_rules:
"${k}-${idx}" => merge(rules, {sg_name = k})
}   
]...)
}

将导致:

custom_rules = {
"nsg_nm-0" = {
"access" = "Deny"
"description" = "Deny all inbound ports"
"destination_address_prefix" = "*"
"destination_port_range" = "*"
"direction" = "Inbound"
"name" = "DenyAllIn"
"priority" = 4096
"protocol" = "tcp"
"sg_name" = "nsg_nm"
"source_address_prefix" = "*"
"source_port_range" = "*"
}
"nsg_nm-1" = {
"access" = "Deny"
"description" = "Deny all outbound ports"
"destination_address_prefix" = "*"
"destination_port_range" = "*"
"direction" = "Outbound"
"name" = "DenyAllOut"
"priority" = 4096
"protocol" = "tcp"
"sg_name" = "nsg_nm"
"source_address_prefix" = "*"
"source_port_range" = "*"
}
"nsg_nv-0" = {
"access" = "Deny"
"description" = "Deny all inbound ports"
"destination_address_prefix" = "*"
"destination_port_range" = "*"
"direction" = "Inbound"
"name" = "DenyAllIn"
"priority" = 4096
"protocol" = "tcp"
"sg_name" = "nsg_nv"
"source_address_prefix" = "*"
"source_port_range" = "*"
}
"nsg_nv-1" = {
"access" = "Deny"
"description" = "Deny all outbound ports"
"destination_address_prefix" = "*"
"destination_port_range" = "*"
"direction" = "Outbound"
"name" = "DenyAllOut"
"priority" = 4096
"protocol" = "tcp"
"sg_name" = "nsg_nv"
"source_address_prefix" = "*"
"source_port_range" = "*"
}
}