如何将 ssl 证书列表添加到我使用 Terraform for 循环结构之一创建的 alb 侦听器列表？

Question

在 AWS 上，使用 Terraform 可以将多个 ssl 证书添加到 ALB listerners。我可以通过创建侦听器资源和创建多个 aws_lb_listener_certificate 资源来做到这一点。

所以这样的东西很好用：

 resource "aws_alb_listener" "alb_listener" {  
      load_balancer_arn = aws_alb.alb.arn  
      port              = 443  
      protocol          = "HTTPS"
      default_action {    
          target_group_arn = aws_alb_target_group.alb_target_group.arn
          type = lookup(var.alb_listener, "action")  
       }
  } 

resource "aws_lb_listener_certificate" "testme_ssl_cert" {
  listener_arn    = "${aws_alb_listener.alb_listener.arn}"
  certificate_arn = "${data.aws_acm_certificate.testme.arn}" 
}

但是我试图通过从配置构建我的侦听器来减少我用来执行此操作的代码量。所以我可以像这样从地图变量构建我的监听器。这很好用。

    resource "aws_lb_listener" "encrypted_listener" {
      load_balancer_arn       = aws_alb.alb.arn
      for_each = var.ssl_forwarding
          port                = each.key
          protocol            = each.value
          certificate_arn = lookup(var.default_certificate,each.key)
          default_action {
            target_group_arn = aws_alb_target_group.alb_target_group.arn
            type             = "forward"
          }   
    }

    variable "ssl_forwarding" {
        default = { 
            443 =   "HTTPS"
            8081 =   "HTTPS"         
      }

现在我想将其余的证书添加到我刚刚创建的侦听器中。

So I need something that looks like this (I think):

    variable "additional_certificates" {
        default=[
            "arn:aws:acm:eu-west-1:blah_blach_ect-3ba688bab27a", #cert 1
            "arn:aws:acm:eu-west-1:blah_blach_ect-4fa688deb27a", #cert 2
        ]
    }

    resource "aws_lb_listener_certificate" "ssl_certs" 
            listener_arn    = //for every listener that I just created
            certificate_arn = //add every certificate in additional_certificates
    }

我不明白如何处理听众的多样性。证书的多样性。最后，证书的多样性与听众的多样性有关。

**感谢所有关于如何解决此问题的建议。解决方法的建议也很受欢迎。谢谢.....

更新：感谢 Marcin 的回答...但这只允许我添加一个额外的 SSL cer。我认为 var 看起来像这样...所以我可以将 n 个证书添加到 n 个负载平衡器。

variable "additional_certificates" {
     default = { 
       443 = ["arn:aws:acm:eu-west-1:blah_blah_ect1",
              "arn:aws:acm:eu-west-1:blah_blah_ect2"
              ""arn:aws:acm:eu-west-1:blah_blah_ect....n" //could be any number of certs here                                                                                                                      
             ]
       8081 = "arn:aws:acm:eu-west-1:blah_blach_ect-4fa688deb27a"
    }

Answer 1

我认为您的 aws_lb_listener.encrypted_listener 是有效的并且有效，因为它在问题中没有另外指定。另外，如果 additional_certificates 是一张地图会更好，因为您正在为 ssl_forwarding 使用地图。因此，您的 ssl_certs 可能是：


variable "additional_certificates" {
     default = {
       443 = "arn:aws:acm:eu-west-1:blah_blach_ect-3ba688bab27a",
       8081 = "arn:aws:acm:eu-west-1:blah_blach_ect-4fa688deb27a"
    }
}

resource "aws_lb_listener_certificate" "ssl_certs" {
    
    for_each =  aws_lb_listener.encrypted_listener

    listener_arn    = each.value.arn
    certificate_arn = var.additional_certificates[each.key]
}

更新

如果您可以拥有随机数量的端口和随机数量的证书，我可以提出以下建议：

variable "additional_certificates" {

   default = { 
     443 = ["arn:aws:acm:eu-west-1:blah_blah_ect1",
            "arn:aws:acm:eu-west-1:blah_blah_ect2",
            "arn:aws:acm:eu-west-1:blah_blah_ect....n"
           ]
     8081 = ["arn:aws:acm:eu-west-1:blah_blach_ect-4fa688deb27a"]
     
     9999 = ["arn:aws:acm:eu-west-1:blah_blach_ect-223332",
             "arn:aws:acm:eu-west-1:blah_blach_ect-22222"]
  }
}


locals {
  # flatten the additional_certificates
  additional_certificates_flat = merge([
      for port, certs in var.additional_certificates:
        {for cert in certs: 
          "${port}-${cert}" => {"port" = port, "cert" = cert}
        }
  ]...)

}

将 var.additional_certificates 压扁为 local.additional_certificates_flat 将是：

{
  "443-arn:aws:acm:eu-west-1:blah_blah_ect....n" = {
    "cert" = "arn:aws:acm:eu-west-1:blah_blah_ect....n"
    "port" = "443"
  }
  "443-arn:aws:acm:eu-west-1:blah_blah_ect1" = {
    "cert" = "arn:aws:acm:eu-west-1:blah_blah_ect1"
    "port" = "443"
  }
  "443-arn:aws:acm:eu-west-1:blah_blah_ect2" = {
    "cert" = "arn:aws:acm:eu-west-1:blah_blah_ect2"
    "port" = "443"
  }
  "8081-arn:aws:acm:eu-west-1:blah_blach_ect-4fa688deb27a" = {
    "cert" = "arn:aws:acm:eu-west-1:blah_blach_ect-4fa688deb27a"
    "port" = "8081"
  }
  "9999-arn:aws:acm:eu-west-1:blah_blach_ect-22222" = {
    "cert" = "arn:aws:acm:eu-west-1:blah_blach_ect-22222"
    "port" = "9999"
  }
  "9999-arn:aws:acm:eu-west-1:blah_blach_ect-223332" = {
    "cert" = "arn:aws:acm:eu-west-1:blah_blach_ect-223332"
    "port" = "9999"
  }
}

然后，

resource "aws_lb_listener_certificate" "ssl_certs" {
    
    for_each =  local.additional_certificates_flat

    listener_arn    = aws_lb_listener.encrypted_listener[each.value.port].arn
    certificate_arn = each.value.cert
}

如何将 ssl 证书列表添加到我使用 Terraform for 循环结构之一创建的 alb 侦听器列表？

How do I add a list of ssl certificates to a list of of alb listeners I have created using one of the Terraform for loop contstructs?

amazon-web-services

terraform

terraform-provider-aws