CODEWITHSUNDEEP
azureterraform
Mario Jacobo
Mario Jacobo

Reputation: 117

azurerm_network_security_rule with variable source_address_prefix

I'm deploying some firewall rules on Azure with Terraform and would like to keep the "source_address_prefix" in a variable, given that the list contains more than 20 IPs and they can change. Since I have around 5 rules, it's not ideal to add the IPs in each block and would rather use a variable

Tried the following variations of variable: 

source_address_prefix       = ["${var.whitelist_ips}"]

source_address_prefix       = "${var.whitelist_ips}"

variables.tf

variable "whitelist_ips" {

    type = "list"
    default = ["199.83.128.0/21","198.143.32.0/19", "149.126.72.0/21","103.28.248.0/22", "45.64.64.0/22", "185.11.124.0/22", "192.230.64.0/18", "107.154.0.0/16", "45.60.0.0/16", "45.223.0.0/16", "2a02:e980::/29"]
}

main.tf

resource "azurerm_network_security_rule" "https" {
  name                        = "Whitelist-HTTPS"
  priority                    = 101
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "443"
  destination_port_range      = "*"
  source_address_prefix       = ["${var.whitelist_ips}"]
  destination_address_prefix  = "${azurerm_public_ip.ingress.ip_address}"
  resource_group_name         = "test"
  network_security_group_name = "test"

  depends_on = [azurerm_resource_group.aks]
}

Getting the following errors: 

Error: Incorrect attribute value type

  on main.tf line 35, in resource "azurerm_network_security_rule" "http":
  35:   source_address_prefix       = ["${var.whitelist_ips}"]

Inappropriate value for attribute "source_address_prefix": string required.

Upvotes: 0

Views: 3204

Answers (2)

kubanczyk
kubanczyk

Reputation: 5941

Begone with that weird 0.11 syntax, with explicit depends_on, also the source port seemed wrong:

resource azurerm_network_security_rule this {
  name                        = "Whitelist-HTTPS"
  resource_group_name         = azurerm_resource_group.this.name
  network_security_group_name = azurerm_network_security_group.this.name
  priority                    = 101
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "443"
  source_address_prefixes     = var.whitelist_ips
  destination_address_prefix  = azurerm_public_ip.ingress.ip_address
}

variable whitelist_ips {
  description = "A list of IP CIDR ranges to allow as clients. Do not use Azure tags like `Internet`."
  default     = ["199.83.128.0/21", "198.143.32.0/19", "2a02:e980::/29"]
  type        = list(string)
}

Upvotes: 1

Mario Jacobo
Mario Jacobo

Reputation: 117

Should have paid attention to the docs. The actual block is "source_address_prefixes" and not "source_address_prefix".

Upvotes: 0

Related Questions