Terraform：创建 SG 时属性“ingress”的值不合适

Question

我正在使用 terraform 创建一个安全组，当我运行 terraform 计划时。它给我一个错误，比如某些字段是必需的，而所有这些字段都是可选的。

\n

地形版本：v1.0.5

\n

AWS 提供商版本：v3.57.0

\n

\n

主.tf

\n

\n

resource "aws_security_group" "sg_oregon" {\n  name        = "tf-sg"\n  description = "Allow web traffics"\n  vpc_id      = aws_vpc.vpc_terraform.id\n\n  ingress = [\n    {\n      description      = "HTTP"\n      from_port        = 80\n      to_port          = 80\n      protocol         = "tcp"\n      cidr_blocks      = ["0.0.0.0/0"]  \n    },\n  {\n      description      = "HTTPS"\n      from_port        = 443\n      to_port          = 443\n      protocol         = "tcp"\n      cidr_blocks      = ["0.0.0.0/0"]  \n  },\n\n    {\n      description      = "SSH"\n      from_port        = 22\n      to_port          = 22\n      protocol         = "tcp"\n      cidr_blocks      = ["0.0.0.0/0"]  \n    }\n  ]\n\n\n  egress = [\n    {\n      description      = "for all outgoing traffics"\n      from_port        = 0\n      to_port          = 0\n      protocol         = "-1"\n      cidr_blocks      = ["0.0.0.0/0"]\n      ipv6_cidr_blocks = ["::/0"]\n      \n    }\n  ]\n\n  tags = {\n    Name = "sg-for-subnet"\n  }\n}\n

\n

\n

控制台错误

\n

\n

\xe2\x94\x82 Inappropriate value for attribute "ingress": element 0: attributes "ipv6_cidr_blocks", "prefix_list_ids", "security_groups", and "self" are required.\n\n\xe2\x94\x82 Inappropriate value for attribute "egress": element 0: attributes "prefix_list_ids", "security_groups", and "self" are required.\n

\n

我正在关注此文档：https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group

\n

任何帮助，将不胜感激。

\n

Answer 1

由于您使用属性作为块，因此您必须为所有选项提供值：

resource "aws_security_group" "sg_oregon" {
  name        = "tf-sg"
  description = "Allow web traffics"
  vpc_id      = aws_vpc.vpc_terraform.id

  ingress = [
    {
      description      = "HTTP"
      from_port        = 80
      to_port          = 80
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
      self = false
    },
  {
      description      = "HTTPS"
      from_port        = 443
      to_port          = 443
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
      self = false      
  },

    {
      description      = "SSH"
      from_port        = 22
      to_port          = 22
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]  
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
      self = false      
    }
  ]


  egress = [
    {
      description      = "for all outgoing traffics"
      from_port        = 0
      to_port          = 0
      protocol         = "-1"
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = ["::/0"]
      prefix_list_ids = []
      security_groups = []
      self = false
    }
  ]

  tags = {
    Name = "sg-for-subnet"
  }
}

Answer 2

您可以通过以替代格式声明规则来避免指定所谓的可选参数：

resource "aws_security_group" "sg_oregon" {
  name        = "tf-sg"
  description = "Allow web traffics"
  vpc_id      = aws_vpc.vpc_terraform.id

  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "HTTPS"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description      = "for all outgoing traffics"
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]

  }

  tags = {
    Name = "sg-for-subnet"
  }
}