Terraform：添加单个规则时，所有安全组规则都将被销毁和替换

Question

地形信息：

Terraform v0.12.18
provider.aws v2.43.0
provider.template v2.1.2

我定义了一个安全组：

如果我运行 terraform plan 或 terraform apply 针对我现有的堆栈，则没有待处理的更改，状态完全是最新的。

resource "aws_security_group" "sg_apps" {
  name        = "Custom apps ${var.env}"
  description = "Custom apps ${var.env}"
  vpc_id      = data.terraform_remote_state.vpc.outputs.vpc_east_id
  tags = {
    Name = "Custom apps ${var.env} - TF"
  }

  ingress {
    from_port = 3306
    to_port   = 3306
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8800
    to_port   = 8808
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8503
    to_port   = 8503
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8889
    to_port   = 8889
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }
}

如果我再添加一条规则：

resource "aws_security_group" "sg_tlapps" {
  name        = "Custom apps ${var.env}"
  description = "Custom apps ${var.env}"
  vpc_id      = data.terraform_remote_state.vpc.outputs.vpc_east_id
  tags = {
    Name = "Custom apps ${var.env} - TF"
  }

  ingress {
    from_port = 3306
    to_port   = 3306
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8800
    to_port   = 8808
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8503
    to_port   = 8503
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8889
    to_port   = 8889
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 9200
    to_port = 9200
    protocol = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }
}

apply 想要删除所有规则并重新创建它们 -- 我不明白为什么它想要全部替换它们。

这对于非生产环境来说很好，但我真的不想在产品中破坏我的防火墙规则以防万一任务中途失败或其他什么。我只是想将规则附加到 sg.

  # aws_security_group.sg_apps will be updated in-place
  ~ resource "aws_security_group" "sg_apps" {
        arn                    = "arn:aws:ec2:us-east-1:xxxxx:security-group/sg-xxxxxxxx"
        description            = "Custom apps prod"
        egress                 = []
        id                     = "sg-xxxxxxxxx"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "10.10.100.0/24",
                  - "10.10.200.0/24",
                  - "10.10.1.0/24",
                  - "10.10.0.0/24",
                ]
              - description      = ""
              - from_port        = 3306
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 3306
            },
          - {
              - cidr_blocks      = [
                  - "10.10.100.0/24",
                  - "10.10.200.0/24",
                  - "10.10.1.0/24",
                  - "10.10.0.0/24",
                ]
              - description      = ""
              - from_port        = 8503
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 8503
            },
          - {
              - cidr_blocks      = [
                  - "10.10.100.0/24",
                  - "10.10.200.0/24",
                  - "10.10.1.0/24",
                  - "10.10.0.0/24",
                ]
              - description      = ""
              - from_port        = 8800
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 8808
            },
          - {
              - cidr_blocks      = [
                  - "10.10.100.0/24",
                  - "10.10.200.0/24",
                  - "10.10.1.0/24",
                  - "10.10.0.0/24",
                ]
              - description      = ""
              - from_port        = 8889
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 8889
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = ""
              + from_port        = 9200
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 9200
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = null
              + from_port        = 3306
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 3306
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = null
              + from_port        = 8503
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 8503
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = null
              + from_port        = 8800
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 8808
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = null
              + from_port        = 8889
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 8889
            },
        ]
        name                   = "Custom apps prod"
        owner_id               = "xxxxxxxxxx"
        revoke_rules_on_delete = false
        tags                   = {
            "Name" = "Custom apps ${var.env} - TF"
        }
        vpc_id                 = "vpc-xxxxxxxxxxxxxxx"

        timeouts {}
    }

Answer 1

如果您将 aws_security_group 资源中的 ingress 和 egress 块转换为单独的 aws_security_group_rule 资源，则在任何一个时都不会重新创建规则或更多其他规则被修改。例如：

resource "aws_security_group_rule" "mysql" {
  type              = "ingress"
  from_port         = 3306
  to_port           = 3306
  protocol          = "tcp"
  cidr_blocks       = [
    data.terraform_remote_state.vpc.outputs.m-1a_cidr,
    data.terraform_remote_state.vpc.outputs.m-1b_cidr,
    data.terraform_remote_state.vpc.outputs.p-1b_cidr,
    data.terraform_remote_state.vpc.outputs.p-1a_cidr,
  ]
  security_group_id = aws_security_group.sg_apps.id
}

将替换您的第一个入口块。

Terraform：添加单个规则时，所有安全组规则都将被销毁和替换

Terraform: All security group rules are destroyed and replaced when adding a single rule

terraform

terraform-provider-aws

我定义了一个安全组：

如果我再添加一条规则：

apply 想要删除所有规则并重新创建它们 -- 我不明白为什么它想要全部替换它们。