Terraform：成功创建资源（aws_security_group），但它采用来自所有给定安全组的入口/出口规则

Question

My code will create security groups as well as ingress/egress as we give the list of security groups and rules in the dev.tfvars file The code ran successfully but created security groups takes ingress/egress rules from all given security groups.

./security.tf

resource "aws_security_group" "sg" {
  count = length(var.vpc_config.security_groups)
  name = var.vpc_config.security_groups[count.index].name
  description = var.vpc_config.security_groups[count.index].description
  vpc_id = var.vpc_id


  dynamic "ingress" {
    for_each = var.vpc_config.security_groups
    content {
      from_port = ingress.value.ingress.from_port
      to_port   = ingress.value.ingress.to_port
      protocol  = ingress.value.ingress.protocol
      cidr_blocks = ingress.value.ingress.cidr_block
    }
  }

  dynamic "egress" {
    for_each = var.vpc_config.security_groups
    content {
      from_port = egress.value.egress.from_port
      to_port   = egress.value.egress.to_port
      protocol  = egress.value.egress.protocol
      cidr_blocks = egress.value.egress.cidr_block
    }
  }
 
  tags = {
    Name        = var.vpc_config.security_groups[count.index].name
    Environment = var.vpc_config.environment
  }
}

./dev.tfvars

vpc_config = {

    security_groups = [ {
          name        = "sg_1"
          description = "security group 1"
          ingress = {
            from_port   = 80
            to_port     = 80
            protocol    = "tcp"
            cidr_block  = ["0.0.0.0/0"]
          }
          egress = {
            from_port   = 0
            to_port     = 0
            protocol    = "-1"
            cidr_block  = ["0.0.0.0/0"]
          }
        },
        {
          name        = "sg_2"
          description = "security group 2"
          ingress = {
            from_port   = 21
            to_port     = 21
            protocol    = "tcp"
            cidr_block  = ["0.0.0.0/0"]
          }
          egress = {
            from_port   = 443
            to_port     = 443
            protocol    = "http"
            cidr_block  = ["0.0.0.0/0"]
          }
        }
        ]
}

It will create two security groups with one ingress and one egress each but it creates two security groups with two ingress and two egress each.

Answer 1

If your goal is to create a 2 security groups, each having a certain ingress and egress rules explicitly defined, you do not want to have dynamic blocks. With dynamic blocks, you will create an inner loop, which is not what you would want.

I recommend using only one for_each at the resource level and no dynamic blocks:

resource "aws_security_group" "sg" {
  for_each = {
    for sg in var.vpc_config.security_groups : sg.name => sg
  }
  name        = each.value.name
  description = each.value.description
  vpc_id      = var.vpc_id


  ingress {
    from_port   = each.value.ingress.from_port
    to_port     = each.value.ingress.to_port
    protocol    = each.value.ingress.protocol
    cidr_blocks = each.value.ingress.cidr_block

  }

  egress {
    from_port   = each.value.egress.from_port
    to_port     = each.value.egress.to_port
    protocol    = each.value.egress.protocol
    cidr_blocks = each.value.egress.cidr_block

  }

  tags = {
    Name        = each.value.name
    Environment = var.vpc_config.environment
  }
}

If you want to use count , you can do it as follows:

resource "aws_security_group" "sg" {
  count       = length(var.vpc_config.security_groups)
  name        = var.vpc_config.security_groups[count.index].name
  description = var.vpc_config.security_groups[count.index].description
  vpc_id      = var.vpc_id


  ingress {
    from_port   = var.vpc_config.security_groups[count.index].ingress.from_port
    to_port     = var.vpc_config.security_groups[count.index].ingress.to_port
    protocol    = var.vpc_config.security_groups[count.index].ingress.protocol
    cidr_blocks = var.vpc_config.security_groups[count.index].ingress.cidr_block

  }

  egress {
    from_port   = var.vpc_config.security_groups[count.index].egress.from_port
    to_port     = var.vpc_config.security_groups[count.index].egress.to_port
    protocol    = var.vpc_config.security_groups[count.index].egress.protocol
    cidr_blocks = var.vpc_config.security_groups[count.index].egress.cidr_block

  }

  tags = {
    Name        = var.vpc_config.security_groups[count.index].name
    Environment = var.vpc_config.environment
  }
}