如果环境为非rule，则创建waf规则

Question

我试图在nonprod中为负载测试创建一个IP白名单，WAF是基于envname/envtype在prod和nonprod中动态创建的：

resource "aws_waf_ipset" "pwa_cloudfront_ip_restricted" {
  name = "${var.envname}-pwa-cloudfront-whitelist"
  dynamic "ip_set_descriptors" {
    for_each = var.cloudfront_ip_restricted_waf_cidr_whitelist
    content {
      type  = ip_set_descriptors.value.type
      value = ip_set_descriptors.value.value
    }
  }
}

resource "aws_waf_rule" "pwa_cloudfront_ip_restricted" {
  depends_on  = [aws_waf_ipset.pwa_cloudfront_ip_restricted]
  name        = "${var.envname}-pwa-cloudfront-whitelist"
  metric_name = "${var.envname}PWACloudfrontWhitelist"

  predicates {
    data_id = aws_waf_ipset.pwa_cloudfront_ip_restricted.id
    negated = false
    type    = "IPMatch"
  }
}

resource "aws_waf_ipset" "pwa_cloudfront_ip_restricted_load_testing" {
  name  = "${var.envname}-pwa-cloudfront-whitelist_load_testing"
  count = var.envtype == "nonprod" ? 1 : 0
  dynamic "ip_set_descriptors" {
    for_each = var.cloudfront_ip_restricted_waf_cidr_whitelist_load_testing
    content {
      type  = ip_set_descriptors.value.type
      value = ip_set_descriptors.value.value
    }
  }
}

resource "aws_waf_rule" "pwa_cloudfront_ip_restricted_load_testing" {
  depends_on  = [aws_waf_ipset.pwa_cloudfront_ip_restricted_load_testing]
  count = var.envtype == "nonprod" ? 1 : 0
  name        = "${var.envname}-pwa-cloudfront-whitelist-load_testing"
  metric_name = "${var.envname}PWACloudfrontWhitelistload_testing"

  predicates {
    data_id = aws_waf_ipset.pwa_cloudfront_ip_restricted_load_testing[count.index].id
    negated = false
    type    = "IPMatch"
  }
}

resource "aws_waf_web_acl" "pwa_cloudfront_ip_restricted" {
  name        = "${var.envname}-pwa-cloudfront-whitelist"
  metric_name = "${var.envname}PWACloudfrontWhitelist"

  default_action {
    type = "BLOCK"
  }

  rules {
    action {
      type = "ALLOW"
    }

    priority = 1
    rule_id  = aws_waf_rule.pwa_cloudfront_ip_restricted.id
    type     = "REGULAR"
  }

    rules {
    action {
      type = "ALLOW"
    }

    priority = 2
    rule_id  = aws_waf_rule.pwa_cloudfront_ip_restricted_load_testing.id
    type     = "REGULAR"
  }
}

第二个规则块在terraform计划中抛出并出错：

Error: Missing resource instance key

  on waf.tf line 73, in resource "aws_waf_web_acl" "pwa_cloudfront_ip_restricted":
  73:     rule_id  = aws_waf_rule.pwa_cloudfront_ip_restricted_load_testing.id

Because aws_waf_rule.pwa_cloudfront_ip_restricted_load_testing has "count" set,
its attributes must be accessed on specific instances.

For example, to correlate with indices of a referring resource, use:
    aws_waf_rule.pwa_cloudfront_ip_restricted_load_testing[count.index]

但是，如果我添加count.index：

Error: Reference to "count" in non-counted context

  on waf.tf line 73, in resource "aws_waf_web_acl" "pwa_cloudfront_ip_restricted":
  73:     rule_id  = aws_waf_rule.pwa_cloudfront_ip_restricted_load_testing[count.index].id

The "count" object can only be used in "module", "resource", and "data"
blocks, and only when the "count" argument is set.

有什么方法不使用计数参数吗？还是我在用它的时候遗漏了什么东西？

Answer 1

由于prod环境和非prod环境之间存在差异，因此应该通过使用dynamic 1和for_each元参数2来解决这个问题。

resource "aws_waf_web_acl" "pwa_cloudfront_ip_restricted" {
  name        = "${var.envname}-pwa-cloudfront-whitelist"
  metric_name = "${var.envname}PWACloudfrontWhitelist"

  default_action {
    type = "BLOCK"
  }

  dynamic "rules" {
    for_each = var.envtype == "nonprod" ? [1] : []
    content {
      action {
        type = "ALLOW"
     }
      priority = 1
      rule_id  = aws_waf_rule.pwa_cloudfront_ip_restricted[0].id
      type     = "REGULAR"
    }
  }

  dynamic "rules" {
    for_each = var.envtype == "nonprod" ? [1] : []
    content {
      action {
        type = "ALLOW"
      }
      priority = 2
      rule_id  = aws_waf_rule.pwa_cloudfront_ip_restricted_load_testing[0].id
      type     = "REGULAR"
    }
  }
}

1

2