如何保持地形aws_security_group的干燥使用
如何保持地形aws_security_group的干燥使用
提问于 2018-06-01 11:40:49
我编写了一个简单的模块来提供一个变量AZ编号的AWS。它创建路由表、网关、路由等，但我很难将安全组部分保持干燥，即在指定安全组时保持模块可重用。
这是我所能得到的最接近的：
varibles.tf：
variable "staging_security_groups" {
type = "list"
default = [ {
"name" = "staging_ssh"
"from port" = "22"
"to port" = "22"
"protocol" = "tcp"
"cidrs" = "10.0.0.5/32,10.0.0.50/32,10.0.0.200/32"
"description" = "Port 22"
} ]
}main.tf：
resource "aws_security_group" "this_security_group" {
count = "${length(var.security_groups)}"
name = "${lookup(var.security_groups[count.index], "name")}"
description = "${lookup(var.security_groups[count.index], "description")}"
vpc_id = "${aws_vpc.this_vpc.id}"
ingress {
from_port = "${lookup(var.security_groups[count.index], "from port")}"
to_port = "${lookup(var.security_groups[count.index], "to port")}"
protocol = "${lookup(var.security_groups[count.index], "protocol")}"
cidr_blocks = ["${split(",", lookup(var.security_groups[count.index], "cidrs"))}"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags {
Name = "${lookup(var.security_groups[count.index], "name")}"
environment = "${var.name}"
terraform = "true"
}
}现在这很好，只要您想要的是在每个端口创建一个安全组:)我真正需要的是某种方法来调用ingress --变量staging_security_groups[THE SECURITY GROUP].from_port中有值的次数(请原谅合成符号)。
回答 3
Stack Overflow用户
回答已采纳
发布于 2018-06-01 13:14:20
您可以考虑使用aws_security_group_rule，而不是将规则内联。然后，您可以创建这样一个模块：
模块/sg/sg.tf
resource "aws_security_group" "default" {
name = "${var.security_group_name}"
description = "${var.security_group_name} group managed by Terraform"
vpc_id = "${var.vpc_id}"
}
resource "aws_security_group_rule" "egress" {
type = "egress"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
description = "All egress traffic"
security_group_id = "${aws_security_group.default.id}"
}
resource "aws_security_group_rule" "tcp" {
count = "${var.tcp_ports == "default_null" ? 0 : length(split(",", var.tcp_ports))}"
type = "ingress"
from_port = "${element(split(",", var.tcp_ports), count.index)}"
to_port = "${element(split(",", var.tcp_ports), count.index)}"
protocol = "tcp"
cidr_blocks = ["${var.cidrs}"]
description = ""
security_group_id = "${aws_security_group.default.id}"
}
resource "aws_security_group_rule" "udp" {
count = "${var.udp_ports == "default_null" ? 0 : length(split(",", var.udp_ports))}"
type = "ingress"
from_port = "${element(split(",", var.udp_ports), count.index)}"
to_port = "${element(split(",", var.udp_ports), count.index)}"
protocol = "udp"
cidr_blocks = ["${var.cidrs}"]
description = ""
security_group_id = "${aws_security_group.default.id}"
}模块/sg/variables.tf
variable "tcp_ports" {
default = "default_null"
}
variable "udp_ports" {
default = "default_null"
}
variable "cidrs" {
type = "list"
}
variable "security_group_name" {}
variable "vpc_id" {}使用main.tf中的模块
module "sg1" {
source = "modules/sg"
tcp_ports = "22,80,443"
cidrs = ["10.0.0.5/32", "10.0.0.50/32", "10.0.0.200/32"]
security_group_name = "SomeGroup"
vpc_id = "${aws_vpc.this_vpc.id}"
}
module "sg2" {
source = "modules/sg"
tcp_ports = "22,80,443"
cidrs = ["10.0.0.5/32", "10.0.0.50/32", "10.0.0.200/32"]
security_group_name = "SomeOtherGroup"
vpc_id = "${aws_vpc.this_vpc.id}"
}参考文献：
关于为什么可选地排除带有count的资源的情况如下(来源)：
count = "${var.udp_ports == "default_null" ? 0 : length(split(",", var.udp_ports))}"变量设置为：
variable "udp_ports" {
default = "default_null"
}Stack Overflow用户
发布于 2019-03-25 12:30:10
我成功地创建了您可以使用的非常简单但动态的安全组模块。这里的想法是能够添加任何您想要的端口，并向该端口添加任何您喜欢的ips。您甚至可以从模块中删除出口，因为它将在默认情况下创建，或者遵循我在入口中使用的想法，这样您就有了粒度出口规则(如果您愿意的话)。
module/sg/sg.tf
data "aws_subnet_ids" "selected" {
vpc_id = "${var.data_vpc_id}"
}
resource "aws_security_group" "main" {
name = "${var.sg_name}-sg"
vpc_id = "${var.data_vpc_id}"
description = "Managed by Terraform"
ingress = ["${var.ingress}"]
lifecycle {
create_before_destroy = true
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}module/sg/vars.tf
variable "sg_name" {}
variable "data_vpc_id" {}
variable "ingress" {
type = "list"
default = []
}入口变量需要类型为list。如果手动调用vpc id，则不需要模块中的数据位，而是从存储在vpc_id中的terraform状态调用我的s3。
main.tf
module "aws_security_group" {
source = "module/sg/"
sg_name = "name_of_sg"
data_vpc_id = "${data.terraform_remote_state.vpc.vpc_id}"
ingress = [
{
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
description = "Managed by Terraform"
},
{
from_port = 0
to_port = 100
protocol = "tcp"
cidr_blocks = ["10.10.10.10/32"]
description = "Managed by Terraform"
},
{
from_port = 2222
to_port = 2222
protocol = "tcp"
cidr_blocks = ["100.100.100.0/24"]
description = "Managed by Terraform"
},
]
}您可以添加多少您喜欢的入口块，我只有3为测试目的。希望这能有所帮助。
备注：您可以在许多资源(如RDS )中遵循这种思想，在这些资源中需要在参数组或甚至标记中指定参数。干杯
Stack Overflow用户
发布于 2021-02-03 10:07:31
不确定在编写布兰登·米勒答案时它是否可用，但请按顺序避免计数循环。因此，如果您添加或删除一个端口，它将导致重建之后的所有规则，因为它们依赖计数索引，而计数索引会发生更改。使用for_each循环要好得多。确保在这方面使用set而不是lists。
variable "tcp_ports" {
default = [ ]
# or maybe default = [ "22", "443" ]
type = set(string)
}
resource "aws_security_group_rule" "tcp" {
for_each = var.tcp_ports
description = "Allow ${var.cdir} to connect to TCP port ${each.key}"
type = "ingress"
from_port = each.key
to_port = each.key
protocol = "tcp"
cidr_blocks = var.cdir
security_group_id = aws_security_group.default.id
}现在，您可以添加和删除端口，而无需不必要的创建和销毁。
你不能改变你的数据从列表到集合，无论什么原因，只是包装它。
toset(var.tcp_ports)或者使用本地来相应地咀嚼你的数据。你也可以使用地图。
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/50642635
复制相关文章
相似问题
腾讯云开发者
