Terraform 独立argumnet的单一地形模块

在这里，我一直在为现有的terraform脚本实现terraform模块。我在与安全组规则的参数交互时遇到了一个问题

问题是，在aws安全组规则中，我们有两个参数，即源安全组id和cidr块，它们彼此不兼容。我的意思是当我们使用其中一个时，我们不能使用另一个

这是我的模块

main.tf

resource "aws_security_group_rule" "arvn" {
  count = length(var.security_group_rules)

  type              = var.security_group_rules[count.index].type
  from_port         = var.security_group_rules[count.index].from_port
  to_port           = var.security_group_rules[count.index].to_port
  protocol          = var.security_group_rules[count.index].protocol
  cidr_blocks       = var.security_group_rules[count.index].cidr_block
  description       = var.security_group_rules[count.index].description
  security_group_id = var.security_group_id
}

变量.tf

variable "security_group_id" {
  type = string
}

variable "security_group_rules" {
  type = list(object({
    type        = string
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_block  = list(string)
    description = string
  }))
}

用法

sg.tf

在这种情况下，将创建前两个规则，而最后一个规则由于无效的cidr块而失败

---

但是我知道这里的问题，如果有人能帮助我创建更灵活的模块，可以同时处理源安全组id和cidr\u块，这样如果一个模块被使用，另一个模块应该是盲的，那就太好了。

您可以通过将资源参数设置为

null

来表示资源参数的动态缺失。这意味着您可以定义一个接受两个参数的变量，只要其中一个参数为null。例如：

variable "security_group_rules" {
  type = list(object({
    type                     = string
    from_port                = number
    to_port                  = number
    protocol                 = string
    cidr_blocks              = list(string)
    source_security_group_id = string
    description              = string
  }))
}

resource "aws_security_group_rule" "arvn" {
  count = length(var.security_group_rules)

  type                     = var.security_group_rules[count.index].type
  from_port                = var.security_group_rules[count.index].from_port
  to_port                  = var.security_group_rules[count.index].to_port
  protocol                 = var.security_group_rules[count.index].protocol
  cidr_blocks              = var.security_group_rules[count.index].cidr_blocks
  description              = var.security_group_rules[count.index].description
  source_security_group_id = var.security_group_rules[count.index].source_security_group_id
  security_group_id        = var.security_group_id
}

调用模块时，调用方必须将

cidr\u block

或

source\u security\u group\u id

设置为空，以避免冲突错误：

module "sg_rules_instance" {
  source = "./modules/security_group_rules"

  security_group_id = module.security_group_instance.id
  security_group_rules = [
    {
      type                     = "ingress"
      from_port                = 22
      to_port                  = 22
      protocol                 = "tcp"
      cidr_blocks              = [var.vpc_cidr]
      source_security_group_id = null
      description              = "ssh"
    },
    {
      type                     = "egress"
      from_port                = 0
      to_port                  = 65535
      protocol                 = "-1"
      cidr_blocks              = ["0.0.0.0/0"]
      source_security_group_id = null
      description              = ""
    },
    {
      type                     = "ingress"
      from_port                = 0
      to_port                  = 65535
      protocol                 = "tcp"
      cidr_blocks              = null
      source_security_group_id = module.security_group_alb.id
      description              = "alb"
    },
  ]
}

---

这在精神上有帮助，但我需要技术帮助：-）

module "sg_rules_instance" {
  source = "./modules/security_group_rules"

  security_group_id = module.security_group_instance.id
  security_group_rules = [
    {
      type                     = "ingress"
      from_port                = 22
      to_port                  = 22
      protocol                 = "tcp"
      cidr_blocks              = [var.vpc_cidr]
      source_security_group_id = null
      description              = "ssh"
    },
    {
      type                     = "egress"
      from_port                = 0
      to_port                  = 65535
      protocol                 = "-1"
      cidr_blocks              = ["0.0.0.0/0"]
      source_security_group_id = null
      description              = ""
    },
    {
      type                     = "ingress"
      from_port                = 0
      to_port                  = 65535
      protocol                 = "tcp"
      cidr_blocks              = null
      source_security_group_id = module.security_group_alb.id
      description              = "alb"
    },
  ]
}