在azurerm_app_service.ip_restriction中的terraform azurerm_app_service.outbound_ip_addresses中使用

Question

我有两个azurerm_app_service。第一个

resource "azurerm_app_service" "first" {
  name = "${local.webAppFirstCloudName}"
  location = "${azurerm_resource_group.rg.location}"

  resource_group_name = "${azurerm_resource_group.rg.name}"
  app_service_plan_id = "${azurerm_app_service_plan.plan.id}"
  ...

上述web应用程序可通过internet使用公网ip访问。

第二个也可以通过公共ip在互联网上访问。但是在这里我想设置第一个webapp的ip地址。所以第二个只能到达第一个webapp的堡垒。

下面是描述：

resource "azurerm_app_service" "second" {
  name = "${local.webAppSecondCloudName}"
  location = "${azurerm_resource_group.rg.location}"

  resource_group_name = "${azurerm_resource_group.rg.name}"
  app_service_plan_id = "${azurerm_app_service_plan.plan.id}"

  tags = {
    ApplicationName = "${var.applicationName}"
    BU-CostCenter = "${var.buCostCenter}"
    CostCenter = "${var.costCenter}"
    ProjectNumber = "${var.projectNumber}"
    Requester = "${var.requester}"
    Environment = "${var.environment}"
    Owner = "${var.owner}"
  }

  site_config {
    scm_type = "LocalGit"
    linux_fx_version = "JAVA|8-jre8"

    ip_restriction = "${split(",", azurerm_app_service.webAppLsgCloud.outbound_ip_addresses)}"

  }

  app_settings = {
    JAVA_OPTS = "-Xmx2G -Dspring.profiles.active=${var.stage} -Djava.net.preferIPOv4Stack=true -Dserver.port=80 -Dazure.cosmosdb.key=${azurerm_cosmosdb_account.db.primary_master_key} -Dazure.cosmosdb.uri=${azurerm_cosmosdb_account.db.endpoint} -Dazure.storage.account-name=${azurerm_storage_account.storage.name} -Dazure.storage.account-key=${azurerm_storage_account.storage.primary_access_key}"
    WEBSITE_HTTPLOGGING_RETENTION_DAYS = "7"
  }
}

回车后

PS C:\workspaces\intellij\terraform> terraform plan -var-file="cloud.dev.tfvars" -out=execution-plan
Acquiring state lock. This may take a few moments...

Error: azurerm_app_service.second: site_config.0.ip_restriction: should be a list

有谁知道如何将列表转换为适当的限制格式？

Answer 1

ip_restriction本身就是一个子块，请参阅https://www.terraform.io/docs/providers/azurerm/r/app_service.html#ip_restriction

要在terraform中正确使用它，您需要如下所示

site_config {
  scm_type = "LocalGit"
  linux_fx_version = "JAVA|8-jre8"
   ip_restriction {
    ip_address  = azurerm_app_service.webAppLsgCloud.outbound_ip_addresses
  }
}

然而，由于webAppLsgCloud.outbound_ip_addresses是一个地址列表，必须使用一组块，或者从terraform v0.12.0开始使用dynamic块，如下所示：

site_config {
  scm_type = "LocalGit"
  linux_fx_version = "JAVA|8-jre8"

  dynamic "ip_restriction" {
    for_each = azurerm_app_service.webAppLsgCloud.outbound_ip_addresses
      content {
        ip_address  = cidrhost(ip_restriction.value,0)
        subnet_mask = cidrmask(ip_restriction.value)
      }
  }
}