Question

在使用terraform-aws-modules / security-group / aws模块时，我可以使用字符串“ 10.211.103.254/32”指定CIDR_BLOCK，但无法引用本质上包含与已验证值相同的值的变量。 terraform输出：

Apply complete! Resources: 1 added, 4 changed, 1 destroyed.

Outputs:

blah_private_ip = 10.211.103.254/32

例如，以下代码有效

output "blah_private_ip" {
   value = "${aws_instance.SERVER-NAME-01.private_ip}/32"
}

module "blahsvr-sg" {
source = "terraform-aws-modules/security-group/aws"

name        = "blahsvr-sg"
description = "Security group for blah server"
vpc_id      = "${module.vpc.vpc_id}"

ingress_with_cidr_blocks = [
{
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    description = "HTTPS from server- managed by terraform"

    cidr_blocks = "10.211.103.254/32"  # works
    #cidr_blocks = "${var.blah_private_ip}"  # gives error
  },
]

egress_with_cidr_blocks = [
{
    from_port   = "0"
    to_port     = "65535"
    protocol    = "-1"
    description = "ALL"
    cidr_blocks = "0.0.0.0/0"
  },
  ]
}

但是，相同的代码但替换了cidr_blocks行以引用“ $ {var.blah_private_ip}”变量，却产生了以下地形应用错误：

 Error: module.gxesvr-sg.aws_security_group_rule.ingress_with_cidr_blocks[0]: "cidr_blocks.0" must contain a valid CIDR, got error parsing: invalid CIDR address:

我也尝试将其包装在CIDR块定义中，但我不知道/ 32（单个IP地址）应具有什么值。

   cidr_blocks = "${cidrsubnet("${var.blah_private_ip}", 8, 0)}"
   cidr_blocks = "${cidrsubnet("${var.blah_private_ip}", 16, 0 )}"

希望有人可以帮助我进行调试。

Answer 1

我看不到您在哪里定义blah_private_ip变量。它似乎与

不同

output "blah_private_ip" {
   value = "${aws_instance.SERVER-NAME-01.private_ip}/32"
}

您应该能够做到...

module "blahsvr-sg" {
  source = "terraform-aws-modules/security-group/aws"
  ...
  ingress_with_cidr_blocks = [
    {
    ...
    cidr_blocks = "${aws_instance.SERVER-NAME-01.private_ip}/32"
    ...
    }
  ]
}

而不是将ip输出插值到变量中（您不能这样做）。

如果您要使用与ingress_with_cidr_blocks ->cidr输入相同的值进行输出，则可以这样定义本地变量

locals {
  cidr = "${aws_instance.SERVER-NAME-01.private_ip}/32"
}


module "blahsvr-sg" {
  source = "terraform-aws-modules/security-group/aws"
  ...
  ingress_with_cidr_blocks = [
    {
    ...
    cidr_blocks = "${local.cidr}"
    ...
    }
  ]
}

output "my_cidr" {
  value = "${local.cidr}"
}

使用terraform安全组模块在cidr_block中指定private_ip地址

1 个答案: