Terraform:成功创建资源(Aws_security_group)，但它从所有给定的安全组中获取入口/出口规则

Question

当我们给出dev.tfvars文件中的安全组和规则列表时，我的代码将创建安全组和入口/出口，代码成功运行，但创建的安全组从所有给定的安全组获取入口/出口规则。

./security.tf

resource "aws_security_group" "sg" {
  count = length(var.vpc_config.security_groups)
  name = var.vpc_config.security_groups[count.index].name
  description = var.vpc_config.security_groups[count.index].description
  vpc_id = var.vpc_id


  dynamic "ingress" {
    for_each = var.vpc_config.security_groups
    content {
      from_port = ingress.value.ingress.from_port
      to_port   = ingress.value.ingress.to_port
      protocol  = ingress.value.ingress.protocol
      cidr_blocks = ingress.value.ingress.cidr_block
    }
  }

  dynamic "egress" {
    for_each = var.vpc_config.security_groups
    content {
      from_port = egress.value.egress.from_port
      to_port   = egress.value.egress.to_port
      protocol  = egress.value.egress.protocol
      cidr_blocks = egress.value.egress.cidr_block
    }
  }
 
  tags = {
    Name        = var.vpc_config.security_groups[count.index].name
    Environment = var.vpc_config.environment
  }
}

./dev.tfvars

vpc_config = {

    security_groups = [ {
          name        = "sg_1"
          description = "security group 1"
          ingress = {
            from_port   = 80
            to_port     = 80
            protocol    = "tcp"
            cidr_block  = ["0.0.0.0/0"]
          }
          egress = {
            from_port   = 0
            to_port     = 0
            protocol    = "-1"
            cidr_block  = ["0.0.0.0/0"]
          }
        },
        {
          name        = "sg_2"
          description = "security group 2"
          ingress = {
            from_port   = 21
            to_port     = 21
            protocol    = "tcp"
            cidr_block  = ["0.0.0.0/0"]
          }
          egress = {
            from_port   = 443
            to_port     = 443
            protocol    = "http"
            cidr_block  = ["0.0.0.0/0"]
          }
        }
        ]
}

它将创建两个安全组，每个有一个入口和一个出口，但是它创建两个安全组，每个安全组有两个入口和两个出口。

Answer 1

如果您的目标是创建一个2个安全组，每个组都具有明确定义的特定的入口和出口规则，那么您不希望有动态块。使用动态块，您将创建一个内部循环，这不是您想要的。

我建议在资源级别上只使用一个for_each，而不使用动态块：

resource "aws_security_group" "sg" {
  for_each = {
    for sg in var.vpc_config.security_groups : sg.name => sg
  }
  name        = each.value.name
  description = each.value.description
  vpc_id      = var.vpc_id


  ingress {
    from_port   = each.value.ingress.from_port
    to_port     = each.value.ingress.to_port
    protocol    = each.value.ingress.protocol
    cidr_blocks = each.value.ingress.cidr_block

  }

  egress {
    from_port   = each.value.egress.from_port
    to_port     = each.value.egress.to_port
    protocol    = each.value.egress.protocol
    cidr_blocks = each.value.egress.cidr_block

  }

  tags = {
    Name        = each.value.name
    Environment = var.vpc_config.environment
  }
}

如果您想使用count，您可以这样做：

resource "aws_security_group" "sg" {
  count       = length(var.vpc_config.security_groups)
  name        = var.vpc_config.security_groups[count.index].name
  description = var.vpc_config.security_groups[count.index].description
  vpc_id      = var.vpc_id


  ingress {
    from_port   = var.vpc_config.security_groups[count.index].ingress.from_port
    to_port     = var.vpc_config.security_groups[count.index].ingress.to_port
    protocol    = var.vpc_config.security_groups[count.index].ingress.protocol
    cidr_blocks = var.vpc_config.security_groups[count.index].ingress.cidr_block

  }

  egress {
    from_port   = var.vpc_config.security_groups[count.index].egress.from_port
    to_port     = var.vpc_config.security_groups[count.index].egress.to_port
    protocol    = var.vpc_config.security_groups[count.index].egress.protocol
    cidr_blocks = var.vpc_config.security_groups[count.index].egress.cidr_block

  }

  tags = {
    Name        = var.vpc_config.security_groups[count.index].name
    Environment = var.vpc_config.environment
  }
}