Terraform：创建 SG 时属性“入口”的值不合适答案

【问题标题】：Terraform: Inappropriate value for attribute "ingress" while creating SGTerraform：创建 SG 时属性“入口”的值不合适
【发布时间】：2021-11-03 20:42:07
【问题描述】：

我正在使用 terraform 创建一个安全组，并且在运行 terraform 计划时。它给了我一个错误，比如某些字段是必需的，而所有这些字段都是可选的。

Terraform 版本：v1.0.5

AWS 提供商版本：v3.57.0

main.tf

resource "aws_security_group" "sg_oregon" {
  name        = "tf-sg"
  description = "Allow web traffics"
  vpc_id      = aws_vpc.vpc_terraform.id

  ingress = [
    {
      description      = "HTTP"
      from_port        = 80
      to_port          = 80
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
    },
  {
      description      = "HTTPS"
      from_port        = 443
      to_port          = 443
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
  },

    {
      description      = "SSH"
      from_port        = 22
      to_port          = 22
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
    }
  ]


  egress = [
    {
      description      = "for all outgoing traffics"
      from_port        = 0
      to_port          = 0
      protocol         = "-1"
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = ["::/0"]
      
    }
  ]

  tags = {
    Name = "sg-for-subnet"
  }
}

控制台出错

│ Inappropriate value for attribute "ingress": element 0: attributes "ipv6_cidr_blocks", "prefix_list_ids", "security_groups", and "self" are required.

│ Inappropriate value for attribute "egress": element 0: attributes "prefix_list_ids", "security_groups", and "self" are required.

我正在关注这个文档：https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group

任何帮助将不胜感激。

【问题讨论】：

标签： amazon-web-services terraform terraform-provider-aws

【解决方案1】：

由于您使用的是Attributes as Blocks，因此您必须为所有选项提供值：

resource "aws_security_group" "sg_oregon" {
  name        = "tf-sg"
  description = "Allow web traffics"
  vpc_id      = aws_vpc.vpc_terraform.id

  ingress = [
    {
      description      = "HTTP"
      from_port        = 80
      to_port          = 80
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
      self = false
    },
  {
      description      = "HTTPS"
      from_port        = 443
      to_port          = 443
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
      self = false      
  },

    {
      description      = "SSH"
      from_port        = 22
      to_port          = 22
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
      self = false      
    }
  ]


  egress = [
    {
      description      = "for all outgoing traffics"
      from_port        = 0
      to_port          = 0
      protocol         = "-1"
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = ["::/0"]
      prefix_list_ids = []
      security_groups = []
      self = false
    }
  ]

  tags = {
    Name = "sg-for-subnet"
  }
}

【讨论】：

我最近才注意到这种行为，当时 Radek Simko 将这些添加到 AWS 提供商文档中。属性作为块样式与动态块有什么好处？他们都觉得有点笨拙，所以我很惊讶有两种不同的方式来做这样的事情。
@ydaetskcoR 您可以使用 for 循环创建规则，这有助于为带有映射的参数提供默认值。不过，在 OP 的情况下，使用块语法可能会更容易。我发现属性作为块的问题是有些块支持这种替代方式，有些不支持。所以它在 TF 中并不一致。
我刚看到github.com/hashicorp/terraform-plugin-framework/issues/85，所以我猜块可能会被杀死以支持属性作为块？
看起来它需要属性上的ConfigMode: schema.SchemaConfigModeAttr, 才能使属性作为块起作用。 github.com/hashicorp/terraform-provider-aws/commit/… 也写得很好。
@AbhishekKumar 文档已过时。并且好处可以用一行ingress = var.my_ingress_rules来表达。这将允许您使用输入变量一次设置所有规则，而不是遍历 var.my_ingress_rules 并使用动态块。更容易阅读、编写和调试。

【解决方案2】：

您可以通过以替代格式声明规则来避免指定所谓的可选参数：

resource "aws_security_group" "sg_oregon" {
  name        = "tf-sg"
  description = "Allow web traffics"
  vpc_id      = aws_vpc.vpc_terraform.id

  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "HTTPS"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description      = "for all outgoing traffics"
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]

  }

  tags = {
    Name = "sg-for-subnet"
  }
}

【讨论】：