Terraform

Question

我想使用 Terraform 将列表和地图组合成 AWS 安全组的一组资源参数。对于端口列表中的每个端口，以及人员图中的每个键，我希望在安全组中有一个入口规则。因此，例如我有一个（简化的）.tf 像这样（我不知道的问号）：

variable "IP_Mapping" {
  type = "map"
  default = {
    "bob"          = "1.1.1.1/32"
    "alice"        = "2.2.2.2/32"
  }
}

variable "ingress_ports" {
  type        = list(number)
  description = "list of ingress ports"
  default     = [80, 443]
}

resource "aws_security_group" "sg-vpc" {
  name        = "sd-ocp-vpc_sg"
  description = "Default security group"
  vpc_id      = "${aws_vpc.vpc.id}"

    ingress {
      from_port   = ?
      to_port     = ?
      protocol    = "tcp"
      cidr_blocks = ?
      description = ?
    }
}

我想要这样的静态资源：

resource "aws_security_group" "sg-vpc" {
  name        = "sd-ocp-vpc_sg"
  description = "Default security group"
  vpc_id      = "${aws_vpc.vpc.id}"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["1.1.1.1/32"]
    description = "bob"
  }
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["1.1.1.1/32"]
    description = "bob"
  }
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["2.2.2.2/32"]
    description = "alice"
  }
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["2.2.2.2/32"]
    description = "alice"
  }
}

我意识到入口块的顺序并不重要。如果我没有看到更好的方法，我也不会过度依赖 map/list 数据结构，只要我不必为每个用户列出每个端口（可能有很多端口，但它们对所有用户都是一样的）。

我已经知道如何使用动态块作为入口规则，并且可以弄清楚如何在动态块中迭代地图，但我终生无法弄清楚如何获得嵌套for 循环在动态资源参数中起作用。

Answer 1

您可以先使用 setproduct 并创建一个 helper_list，然后再构建动态块。


locals {

  helper_list = setproduct(
                  var.ingress_ports,
                  [for name, cidr in var.IP_Mapping: [name, cidr]])           
}

local.helper_list 应为以下形式：

[
  [
    80,
    [
      "alice",
      "2.2.2.2/32",
    ],
  ],
  [
    80,
    [
      "bob",
      "1.1.1.1/32",
    ],
  ],
  [
    443,
    [
      "alice",
      "2.2.2.2/32",
    ],
  ],
  [
    443,
    [
      "bob",
      "1.1.1.1/32",
    ],
  ],
]

那么对于你的动态块：

resource "aws_security_group" "sg-vpc" {
  name        = "sd-ocp-vpc_sg"
  description = "Default security group"
  vpc_id      = "${aws_vpc.vpc.id}"

  dynamic "ingress" {

      for_each = {for idx, item in local.helper_list: idx=>item}

      content {
        from_port   = ingress.value[0]
        to_port     = ingress.value[0]
        protocol    = "tcp"
        cidr_blocks = [ingress.value[1][1]]
        description = ingress.value[1][0]
      }    
   }
}

Terraform - 迭代组合地图和列表

Terraform - iterate over combined map and list

amazon-web-services

terraform-provider-aws