Terraform：添加单个规则时，所有安全组规则都将被销毁和替换

地形信息：

• 地形v0.12.18
• provider.aws v2.43.0
• provider.template v2.1.2

我定义了一个安全组： 如果我对现有堆栈运行

terraform plan

或

terraform apply

，则没有挂起的更改，状态是完全最新的

resource "aws_security_group" "sg_apps" {
  name        = "Custom apps ${var.env}"
  description = "Custom apps ${var.env}"
  vpc_id      = data.terraform_remote_state.vpc.outputs.vpc_east_id
  tags = {
    Name = "Custom apps ${var.env} - TF"
  }

  ingress {
    from_port = 3306
    to_port   = 3306
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8800
    to_port   = 8808
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8503
    to_port   = 8503
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }

  ingress {
    from_port = 8889
    to_port   = 8889
    protocol  = "tcp"
    cidr_blocks = [
      data.terraform_remote_state.vpc.outputs.m-1a_cidr,
      data.terraform_remote_state.vpc.outputs.m-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1b_cidr,
      data.terraform_remote_state.vpc.outputs.p-1a_cidr,
    ]
  }
}

如果我再添加一条规则： 应用程序想要删除所有规则并重新创建它们——我不明白为什么它想要全部替换它们。 这对于非生产环境很好，但我真的不想在prod中破坏我的防火墙规则，以防任务中途失败。我只是想在sg中添加一条规则

  # aws_security_group.sg_apps will be updated in-place
  ~ resource "aws_security_group" "sg_apps" {
        arn                    = "arn:aws:ec2:us-east-1:xxxxx:security-group/sg-xxxxxxxx"
        description            = "Custom apps prod"
        egress                 = []
        id                     = "sg-xxxxxxxxx"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "10.10.100.0/24",
                  - "10.10.200.0/24",
                  - "10.10.1.0/24",
                  - "10.10.0.0/24",
                ]
              - description      = ""
              - from_port        = 3306
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 3306
            },
          - {
              - cidr_blocks      = [
                  - "10.10.100.0/24",
                  - "10.10.200.0/24",
                  - "10.10.1.0/24",
                  - "10.10.0.0/24",
                ]
              - description      = ""
              - from_port        = 8503
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 8503
            },
          - {
              - cidr_blocks      = [
                  - "10.10.100.0/24",
                  - "10.10.200.0/24",
                  - "10.10.1.0/24",
                  - "10.10.0.0/24",
                ]
              - description      = ""
              - from_port        = 8800
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 8808
            },
          - {
              - cidr_blocks      = [
                  - "10.10.100.0/24",
                  - "10.10.200.0/24",
                  - "10.10.1.0/24",
                  - "10.10.0.0/24",
                ]
              - description      = ""
              - from_port        = 8889
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 8889
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = ""
              + from_port        = 9200
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 9200
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = null
              + from_port        = 3306
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 3306
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = null
              + from_port        = 8503
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 8503
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = null
              + from_port        = 8800
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 8808
            },
          + {
              + cidr_blocks      = [
                  + "10.10.100.0/24",
                  + "10.10.200.0/24",
                  + "10.10.1.0/24",
                  + "10.10.0.0/24",
                ]
              + description      = null
              + from_port        = 8889
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 8889
            },
        ]
        name                   = "Custom apps prod"
        owner_id               = "xxxxxxxxxx"
        revoke_rules_on_delete = false
        tags                   = {
            "Name" = "Custom apps ${var.env} - TF"
        }
        vpc_id                 = "vpc-xxxxxxxxxxxxxxx"

        timeouts {}
    }

---

如果将

aws_security_组

资源中的

入口

和

出口

块转换为单个资源，则在修改任何一个或多个其他规则时不会重新创建规则。例如：

resource "aws_security_group_rule" "mysql" {
  type              = "ingress"
  from_port         = 3306
  to_port           = 3306
  protocol          = "tcp"
  cidr_blocks       = [
    data.terraform_remote_state.vpc.outputs.m-1a_cidr,
    data.terraform_remote_state.vpc.outputs.m-1b_cidr,
    data.terraform_remote_state.vpc.outputs.p-1b_cidr,
    data.terraform_remote_state.vpc.outputs.p-1a_cidr,
  ]
  security_group_id = aws_security_group.sg_apps.id
}

---

将替换第一个入口块。

最好通过资源与API交互。这将允许在更改时保留规则。这似乎是正确的答案。如果你回答这个问题，我会记下来。

resource "aws_security_group_rule" "mysql" {
  type              = "ingress"
  from_port         = 3306
  to_port           = 3306
  protocol          = "tcp"
  cidr_blocks       = [
    data.terraform_remote_state.vpc.outputs.m-1a_cidr,
    data.terraform_remote_state.vpc.outputs.m-1b_cidr,
    data.terraform_remote_state.vpc.outputs.p-1b_cidr,
    data.terraform_remote_state.vpc.outputs.p-1a_cidr,
  ]
  security_group_id = aws_security_group.sg_apps.id
}