无法从 terraform 数据源解析 cidr_block

Question

我正在尝试创建一个安全组，该组将根据数据源过滤结果自动附加来自 2 个子网的 cidr 块。但是，使用 terraform v12 变体

进行部署时出现错误

data "aws_vpc" "my-vpc" {
  filter {
    name   = "tag:MY_VPC"
    values = ["TRUE"]
  }
}

data "aws_subnet_ids" "my-subnets" {
 vpc_id = data.aws_vpc.my-vpc.id

 filter {
   name   = "tag:NAME"
   values = ["MY_SUBNET"]
 }
}


resource "aws_security_group" "my-sg" {
 name   = "my-sg"
 description   = "my-sg"
 vpc_id = data.aws_vpc.my-vpc.id

 ingress {
  from_port   = 443
  protocol    = "tcp"
  to_port     = 443
  cidr_blocks = ["${data.aws_subnet_ids.my-subnets.*.cidr_block}"]
 }

 ingress {
  from_port   = 22
  protocol    = "tcp"
  to_port     = 22
  cidr_blocks = ["${data.aws_subnet_ids.my-subnets.*.cidr_block}"]
 }

 ingress {
  from_port   = 80
  protocol    = "tcp"
  to_port     = 80
  cidr_blocks = ["${data.aws_subnet_ids.my-subnets.*.cidr_block}"]
 }

 egress {
  from_port   = 0
  protocol    = "-1"
  to_port     = 0
  cidr_blocks = ["${data.aws_subnet_ids.my-subnets.*.cidr_block}"]
 }
}

我收到错误

on terraform/my-sg.tf line 27, in resource "aws_security_group" "my-sg":
  31:     cidr_blocks = ["${data.aws_subnet_ids.my-subnets.*.cidr_block}"]

This object does not have an attribute named "cidr_block".

Answer 1

数据源aws_subnet_ids 只返回子网ID，不返回苹果酒范围。要获得 cidr，您必须使用 aws_subnet:

data "aws_subnet_ids" "my-subnets" {
 vpc_id = data.aws_vpc.my-vpc.id

 filter {
   name   = "tag:NAME"
   values = ["MY_SUBNET"]
 }
}


data "aws_subnet" "selected" {
  for_each = data.aws_subnet_ids.my-subnets.ids
  id = each.value
}

然后你会使用数据：

cidr_blocks = "${values(data.aws_subnet.selected).*.cidr_block}"