Terraform azurerm_linux_web_app 动态 ip_restriction

Question

我正在尝试一次性创建多个应用程序，我可以使用 count = length(var.webapp_name) 成功完成，但我面临的问题是某些应用程序需要相互通信，我需要将每个应用程序的 outbound_ip_addresses 列入白名单

我使用的导致问题的代码如下：

resource "azurerm_linux_web_app" "API" {
      depends_on = [azurerm_subnet.subnet]
  count = length(var.webapp_name)

  name                  = lower("${var.customer4letter}-${var.env3letter}-${var.locationid3letter}-${var.servicetype}-${element(var.webapp_name, count.index)}")
  location              = var.location //West US 2
  resource_group_name   = azurerm_resource_group.rg.name
  service_plan_id       = azurerm_service_plan.api-farm.id
  https_only            = "true"

  app_settings = {
        "WEBSITE_USE_DIAGNOSTIC_SERVER" = "True"
    }

  identity {
    type         = "SystemAssigned"
  }
  site_config {
    ftps_state  = "FtpsOnly"
    websockets_enabled = "false"
    use_32_bit_worker = "false"  
    always_on = "true"

    application_stack {
      dotnet_version   = "6.0"
    }
dynamic "ip_restriction"  {
      for_each = local.ip_address_list3
      content{
      action                    = "Allow"
      name = ip_restriction.value["name"]
      service_tag = ip_restriction.value["service_tag"]
      priority = ip_restriction.value["prior"]
  } }
  dynamic "ip_restriction" {
    for_each = azurerm_linux_web_app.API[0].outbound_ip_addresses
      content {
        ip_address  = cidrhost(ip_restriction.value,0)
      }  }  }   }

本地和变量集是

variable "webapp_name" {
    default = [ "app1", "app2", "app3" ]
}


locals {
ip_address_list3 = [
            {
                 service_tag               = "AppService"
                 prior : "102",
                 name = "VirtualNetwork"
            }
            ]
}

我的错误如下：

Answer 1

我尝试使用 Terraform 在我的环境中将相同的内容复制到具有出站 IP 的 azure web 应用程序：

地形代码：

provider  "azurerm"  {
features  {}
}
locals  {
resource_group_name = "test-rg"
location = "East US"
app_name_prefix = "venkatdemoapp"
}
resource  "azurerm_resource_group"  "test-rg"  {
name = local.resource_group_name
location = local.location
}

# Create multiple web apps

resource  "azurerm_app_service_plan"  "test_plan"  {
count = 2
name = "${local.app_name_prefix}-plan-${count.index}"
location = local.location
resource_group_name = azurerm_resource_group.test-rg.name
sku  {
tier = "Basic"
size = "B1"
}
}
resource  "azurerm_app_service"  "thejawebapp"  {
count = 2
name = "${local.app_name_prefix}-${count.index}"
location = local.location
resource_group_name = azurerm_resource_group.test-rg.name
app_service_plan_id = azurerm_app_service_plan.test_plan[count.index].id
}

# Restrict access to each web app
resource  "azurerm_network_security_group"  "test_nsg"  {
count = 2
name = "${local.app_name_prefix}-nsg-${count.index}"
location = local.location
resource_group_name = azurerm_resource_group.test-rg.name
security_rule  {
name = "Allow_HTTP_Traffic"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "80"

source_address_prefix = "*"
destination_address_prefix = "*"
}
  security_rule  {
name = "Deny_All_Traffic"
priority = 200
direction = "Inbound"
access = "Deny"
protocol = "*"
source_port_range = "*"
destination_port_range = "*"
source_address_prefix = "*"
destination_address_prefix = "*"
}
}

# Associate each web app with its NSG.

resource  "azurerm_network_interface"  "test_nic"  {
count = 2
name = "${local.app_name_prefix}-nic-${count.index}"
location = local.location
resource_group_name = azurerm_resource_group.test-rg.name
ip_configuration  {
name = "${local.app_name_prefix}-ipconfig-${count.index}"
    subnet_id = azurerm_subnet.test_subnet.id
private_ip_address_allocation = "Dynamic"
    }
    }
resource  "azurerm_subnet"  "test_subnet"  {
    name = "${local.app_name_prefix}-subnet"
resource_group_name = azurerm_resource_group.test-rg.name
virtual_network_name = azurerm_virtual_network.test_vnet.name
address_prefixes = ["10.0.1.0/24"]
    }
  resource  "azurerm_virtual_network"  "test_vnet"  {

name = "${local.app_name_prefix}-vnet"

location = local.location
resource_group_name = azurerm_resource_group.test-rg.name    address_space = ["10.0.0.0/16"]

}

地形应用：

一旦运行，上面的代码资源将自动创建，但有限制。

NSG 规则：