WAF适用于使用地形的账户中的所有ALB

Question

这是我的waf.tf地形文件：

resource "aws_wafv2_web_acl" "waf_acl-dev" {
name        = "waf_log4j_Protections-dev"
description = "WAFv2 for dev"
scope       = "REGIONAL"
default_action {
allow {}
}
rule {
name     = "AWSManagedRulesKnownBadInputsRule"
priority = 1
override_action {
count {}
}
statement {
managed_rule_group_statement {
name        = "AWSManagedRulesKnownBadInputsRuleSet"
vendor_name = "AWS"
# Excluding all these leaves only Log4JRCE
excluded_rule {
name = "Host_localhost_HEADER"
}
excluded_rule {
name = "PROPFIND_METHOD"
}
excluded_rule {
name = "ExploitablePaths_URIPATH"
}
}
}
visibility_config {
cloudwatch_metrics_enabled = true
metric_name                = "AWSManagedRulesKnownBadInputsRule"
sampled_requests_enabled   = true
}
}
visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "AWSManagedKnownBadInputsRule"
sampled_requests_enabled = true
}
}
variable "lb_arn" {
type = string
default = ""
}
data "aws_lb" "all_alb" {

tags = {
Environment = "Dev"
}
# arn = var.lb_arn
# for_each = data.aws_lb.all_alb
# id = each.value
}
output "all_alb" {
value = data.aws_lb.all_alb
}
resource "aws_wafv2_web_acl_association" "waf_acl-association-dev" {
for_each = data.aws_lb.all_alb.arn
resource_arn = each.value
web_acl_arn = aws_wafv2_web_acl.waf_acl-dev.arn
}

我的目标是创建一个有规则的WAF(该部分工作正常(，并使用每个ALB上的标签将多个ALB附加到WAF。我在一个teamcity循环中运行它，该循环会循环到多个AWS帐户(这超出了范围(。每个帐户都可以有一个或多个带有标签的ALB。当我运行此代码时，我得到以下错误：

Error: Search returned 2 results, please revise so only one is returned
17:39:18     │ 
17:39:18     │   with data.aws_lb.all_alb,
17:39:18     │   on xa-waf-inow.tf line 49, in data "aws_lb" "all_alb":
17:39:18     │   49: data "aws_lb" "all_alb" {

我还尝试了一些其他的选择，比如在第49行的末尾放[0]，但我仍然会遇到一些语法错误。有人能帮忙吗？感谢

编辑：

我还在数据块中尝试了for_each

data "aws_lb" "all_alb" {
for_each = {
tags = {
Environment = "Dev"
}
}
arn = each.key

}

output "all_alb" {
value = data.aws_lb.all_alb
}

resource "aws_wafv2_web_acl_association" "waf_acl-association-dev" {
# for_each = data.aws_lb.all_alb.arn
resource_arn = data.aws_lb.all_alb[each.key]
web_acl_arn = aws_wafv2_web_acl.waf_acl-dev.arn
}

但是得到了这个错误：

Error: Reference to "each" in context without for_each
18:24:01     │ 
18:24:01     │   on xa-waf-inow.tf line 65, in resource "aws_wafv2_web_acl_association" "waf_acl-association-dev":
18:24:01     │   65:     resource_arn = data.aws_lb.all_alb[each.key]
18:24:01     │ 
18:24:01     │ The "each" object can be used only in "module" or "resource" blocks, and
18:24:01     │ only when the "for_each" argument is set.

Answer 1

我能够让它为自己工作。我的问题是列表和集合的混合。我相信我可以将我的变量更改为一个集合，而不必处理这里的任何集合，但我知道下面的操作是正常的。

VARIABLES.TF

variable "list_of_alb" {
type = list(string)
}

MAIN.TF

list_of_alb = [
"${terraform.workspace}-unique-1",
"${terraform.workspace}-unique-2"
]

DATA.TF-问题子

data "aws_lb" "main" {
for_each = toset( var.list_of_alb )
name = each.value
}

WAF.TF

resource "aws_wafv2_web_acl_association" "main" {
for_each = toset(var.list_of_alb)
resource_arn = data.aws_lb.main[each.value].arn
web_acl_arn  = aws_wafv2_web_acl.main.arn
}

Answer 2

aws_lb数据源必须只返回一个结果。你无法改变这一点，因为这就是它的命运。

如果你想返回多个ALB，你有两个选择：

1. 将for_each与数据源一起使用。这样，您的数据源将为您的alb的每个id运行。这意味着您必须提供alb-ids作为输入变量
2. 或者，创建您自己的自定义数据源。由于这是您必须编写的完全自定义代码，因此它可以克服TF内置数据源的任何限制