如何在动态块中传递多个值类型以在 Terraform 模块中创建自定义 azurerm NSG 规则？答案

【问题标题】：How do I pass multiple value types in a dynamic block to create custom azurerm NSG rules in a Terraform module?如何在动态块中传递多个值类型以在 Terraform 模块中创建自定义 azurerm NSG 规则？
【发布时间】：2021-06-15 06:00:45
【问题描述】：

我创建了一个网络模块，用于创建一个 vnet、一组 vnet 中的子网，然后为每个子网创建一个网络安全组。现在，我正在尝试使用每个映射子网下配置的 nsg_rules 列表上的动态块 for_each 循环传入自定义 nsg 安全规则。

这主要是有效的。但是，每当安全规则需要一个不是 string 的值时，例如我定义多个非连续端口的 destination_port_ranges（它采用 list 值），模块错误：“不能在字符串模板中包含给定值：需要字符串。”

resource "azurerm_network_security_group" "nsg" {
  for_each = var.subnets

  name                = "nsg-${each.value.subnet_name}"
  resource_group_name = azurerm_resource_group.network_rg.name
  location            = var.location
  dynamic "security_rule" {
    for_each = lookup(each.value, "nsg_rules", [])
    content {
      name                       = security_rule.value[0] == "" ? "Default_Rule" : security_rule.value[0]
      priority                   = security_rule.value[1]
      direction                  = security_rule.value[2] == "" ? "Inbound" : security_rule.value[2]
      access                     = security_rule.value[3] == "" ? "Allow" : security_rule.value[3]
      protocol                   = security_rule.value[4] == "" ? "Tcp" : security_rule.value[4]
      source_port_range          = "*"
      destination_port_ranges    = security_rule.value[5] == "" ? "*" : security_rule.value[5]
      source_address_prefix      = security_rule.value[6] == "" ? element(each.value.subnet_address_prefix, 0) : security_rule.value[6]
      destination_address_prefix = security_rule.value[7] == "" ? element(each.value.subnet_address_prefix, 0) : security_rule.value[7]
      description                = "${security_rule.value[2]}_Port_${security_rule.value[5]}"
    }
  }
}

以下是安全规则的根模块值：

module "network_us" {
source  = "app.terraform.io/some_workspace/network/azurerm"
version = "0.4.21"

zone_name      = var.zone_name
environment    = var.environment
location       = "eastus"
location_short = "eastus"
name_suffix    = "001"

address_space  = ["10.252.74.0/23"]
dns_servers    = []
subnets        = {
  bastion_subnet = {
    subnet_name           = "AzureBastionSubnet"
    subnet_address_prefix = ["10.252.75.64/27"]
    nsg_rules     = [
      # [name, priority, direction, access, protocol, destination_port_ranges, source_address_prefix, destination_address_prefix]
      ["AllowHttpsInbound", "120", "Inbound", "Allow", "Tcp", ["443"], "Internet", ""],
      ["AllowGatewayManagerInbound", "130", "Inbound", "Allow", "Tcp", ["443"], "GatewayManager", ""],
      ["AllowAzureLoadBalancerInbound", "140", "Inbound", "Allow", "Tcp", ["443"], "AzureLoadBalancer", ""],
      ["AllowBastionHostCommunication", "150", "Inbound", "Allow", "*", ["8080", "5701"], "VirtualNetwork", "VirtualNetwork"],
      ["AllowSshRdpOutbound", "100", "Outbound", "Allow", "*", ["22", "3389"], "*", "VirtualNetwork"],
      ["AllowAzureCloudOutbound", "110", "Outbound", "Allow", "Tcp", ["443"], "*", "AzureCloud"],
      ["AllowBastionCommunication", "120", "Outbound", "Allow", "*", ["8080", "5701"], "VirtualNetwork", "VirtualNetwork"],
      ["AllowGetSessionInformation", "130", "Outbound", "Allow", "*", ["80"], "*", "Internet"]
    ]
  }
}

}

这是我运行应用程序时遇到的错误：

The given value is not suitable for child module variable "subnets" defined at
.terraform/modules/network_apac/variables.tf:37,1-17: all map elements must
have the same type.

我该如何解决这个问题？

【问题讨论】：

第 37 行的variables.tf 是什么？
它引用了模块中的 var.subnets 映射变量，上面给出了有问题的值。

标签： terraform azure-rm

【解决方案1】：

原来问题只是在destination_port_ranges 值的条件表达式中。它期待一个字符串并获得一个列表。我并不真正需要这些“安全网”条件，所以我只是删除了它们，模块按预期工作。

【讨论】：