努力实现 terraform WAF 的自动化

Question

I'm trying to terraform WAF ACL and associated rules. The terraform stack I'm working on is identical in DEV, QA , and PROD, differences are all handled using different variables. So my idea is to store a list of CIDRs in a variable, and automatically create ALLOW rules for each. My limited knowledge is slowing me down though. It creates the ipsets perfectly, but the rules and ACL complain,

variable cloud_allowed_cidr_list = {type="list" default=["1.2.3.4/32","4.3.2.1/32"]}

resource "aws_waf_ipset" "ipset" {
  count = "${length(var.cloud_allowed_cidr_list)}"
  name = "ipset-${count.index}"

  ip_set_descriptors {
    type  = "IPV4"
    value = "${element(var.cloud_allowed_cidr_list, count.index)}"
  }
}


resource "aws_waf_rule" "matchIPrule" {
  count = "${length(var.cloud_allowed_cidr_list)}"
  depends_on  = ["aws_waf_ipset.ipset"]
  name        = "matchMancIPrule${count.index}"
  metric_name = "matchMancIPrule${count.index}"

  predicates {
    data_id = "${aws_waf_ipset.ipset.*.id}"
    negated = false
    type    = "IPMatch"
  }
}


resource "aws_waf_web_acl" "waf_acl" {
  depends_on  = ["aws_waf_ipset.ipset", "aws_waf_rule.matchIPrule"]
  name        = "mancACL${count.index}"
  metric_name = "mancACL${count.index}"

  default_action {
    type = "BLOCK"
  }

  rules {
    action {
      type = "ALLOW"
    }

    priority = "${count.index}"
    rule_id  = "${aws_waf_rule.matchIPrule.id}"
    type     = "REGULAR"
  }
}

It fell apart when I realised that rules have multiple predicates, and the ACL has multiple rules .....how do you create that dynamically ? If anyone has any examples of doing something similar I'd be very grateful.

Answer 1

Since the release of 0.12 you can now do this using dynamic blocks.

No need to use count to iterate over your array.

resource "aws_waf_ipset" "ipset" {
  name = "youripset"

  dynamic "ip_set_descriptors" {
    iterator = ip
    for_each = var.cloud_allowed_cidr_list

    content {
      type  = "IPV4"
      value = ip.value
    }
  }
}