7

我编写了一个简单的模块来预置一个变量 AZ 编号的 AWS VPC。它创建路由表、网关、路由等，但我在保持安全组部分干燥时遇到了麻烦，即在指定安全组时保持模块可重用。

这是我能得到的最接近的：

变量.tf：

variable "staging_security_groups" {
  type = "list"
  default = [ {
      "name" = "staging_ssh"
      "from port" = "22"
      "to port" = "22"
      "protocol" = "tcp"
      "cidrs" = "10.0.0.5/32,10.0.0.50/32,10.0.0.200/32"
      "description" = "Port 22"
  } ]
}

主文件：

resource "aws_security_group" "this_security_group" {
  count = "${length(var.security_groups)}"

  name        = "${lookup(var.security_groups[count.index], "name")}"
  description = "${lookup(var.security_groups[count.index], "description")}"
  vpc_id      = "${aws_vpc.this_vpc.id}"

  ingress {
    from_port   = "${lookup(var.security_groups[count.index], "from port")}"
    to_port     = "${lookup(var.security_groups[count.index], "to port")}"
    protocol    = "${lookup(var.security_groups[count.index], "protocol")}"
    cidr_blocks = ["${split(",", lookup(var.security_groups[count.index], "cidrs"))}"]
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }

  tags {
    Name = "${lookup(var.security_groups[count.index], "name")}"
    environment = "${var.name}"
    terraform = "true"
  }
}

现在这很好，只要您想要为每个端口创建一个安全组 :) 我真正需要的是某种方式来调用ingress变量中有值的次数staging_security_groups[THE SECURITY GROUP].from_port（请原谅虚构的符号）。

4

3 回答 3

8

你可以看看使用aws_security_group_rule而不是让你的规则内联。然后，您可以像这样创建一个模块：

模块/sg/sg.tf

resource "aws_security_group" "default" {
  name        = "${var.security_group_name}"
  description = "${var.security_group_name} group managed by Terraform"

  vpc_id = "${var.vpc_id}"
}

resource "aws_security_group_rule" "egress" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  description       = "All egress traffic"
  security_group_id = "${aws_security_group.default.id}"
}

resource "aws_security_group_rule" "tcp" {
  count             = "${var.tcp_ports == "default_null" ? 0 : length(split(",", var.tcp_ports))}"
  type              = "ingress"
  from_port         = "${element(split(",", var.tcp_ports), count.index)}"
  to_port           = "${element(split(",", var.tcp_ports), count.index)}"
  protocol          = "tcp"
  cidr_blocks       = ["${var.cidrs}"]
  description       = ""
  security_group_id = "${aws_security_group.default.id}"
}

resource "aws_security_group_rule" "udp" {
  count             = "${var.udp_ports == "default_null" ? 0 : length(split(",", var.udp_ports))}"
  type              = "ingress"
  from_port         = "${element(split(",", var.udp_ports), count.index)}"
  to_port           = "${element(split(",", var.udp_ports), count.index)}"
  protocol          = "udp"
  cidr_blocks       = ["${var.cidrs}"]
  description       = ""
  security_group_id = "${aws_security_group.default.id}"
}

模块/sg/variables.tf

variable "tcp_ports" {
  default = "default_null"
}

variable "udp_ports" {
  default = "default_null"
}

variable "cidrs" {
  type = "list"
}

variable "security_group_name" {}

variable "vpc_id" {}

使用 main.tf 中的模块

module "sg1" {
  source              = "modules/sg"
  tcp_ports           = "22,80,443"
  cidrs               = ["10.0.0.5/32", "10.0.0.50/32", "10.0.0.200/32"]
  security_group_name = "SomeGroup"
  vpc_id              = "${aws_vpc.this_vpc.id}"
}

module "sg2" {
  source              = "modules/sg"
  tcp_ports           = "22,80,443"
  cidrs               = ["10.0.0.5/32", "10.0.0.50/32", "10.0.0.200/32"]
  security_group_name = "SomeOtherGroup"
  vpc_id              = "${aws_vpc.this_vpc.id}"
}

参考：

为什么可选地排除具有计数的资源看起来像这样（来源）：

count             = "${var.udp_ports == "default_null" ? 0 : length(split(",", var.udp_ports))}"

并且变量设置为：

variable "udp_ports" {
  default = "default_null"
}
于 2018-06-01T13:14:20.143 回答
1

我设法创建了您可以使用的非常简单但动态的安全组模块。这里的想法是能够添加您想要的任何端口，并向该端口添加您喜欢的任何 IP 范围。你甚至可以从模块中删除出口，因为它是默认创建的，或者按照我在入口中使用的想法，这样你就有了细粒度的出口规则（如果你愿意的话）。

模块/sg/sg.tf 

  data "aws_subnet_ids" "selected" {
  vpc_id = "${var.data_vpc_id}"
}

resource "aws_security_group" "main" {
  name        = "${var.sg_name}-sg"
  vpc_id      = "${var.data_vpc_id}"
  description = "Managed by Terraform"
  ingress     = ["${var.ingress}"]

  lifecycle {
    create_before_destroy = true
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

模块/sg/vars.tf

variable "sg_name" {}

variable "data_vpc_id" {}

variable "ingress" {
  type    = "list"
  default = []
}

ingress var 需要是类型list。如果您手动调用 vpc id，则不需要模块中的数据位，我会从存储在 s3 中的 terraform 状态调用我的 vpc_id。

主文件 

module "aws_security_group" {
  source = "module/sg/"

  sg_name     = "name_of_sg"
  data_vpc_id = "${data.terraform_remote_state.vpc.vpc_id}"

  ingress = [
    {
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "Managed by Terraform"
    },
    {
      from_port   = 0
      to_port     = 100
      protocol    = "tcp"
      cidr_blocks = ["10.10.10.10/32"]
      description = "Managed by Terraform"
    },
    {
      from_port   = 2222
      to_port     = 2222
      protocol    = "tcp"
      cidr_blocks = ["100.100.100.0/24"]
      description = "Managed by Terraform"
    },
  ]
}

您可以添加任意数量的入口块，我只有 3 个用于测试目的。希望这可以帮助。
注意：对于 RDS 等许多资源，您可以遵循此想法，您需要在参数组甚至标签中指定参数。干杯

于 2019-03-25T12:30:10.697 回答
1

不确定在编写Brandon Miller 的答案时它是否可用，但要避免按顺序计数循环。因此，如果您添加或删除一个端口，它将导致重新构建它之后的所有规则，因为它们依赖于计数索引，而计数索引会发生变化。使用 for_each 循环要好得多。确保为此使用设置而不是列表，例如

variable "tcp_ports" {
  default = [ ]
  # or maybe default = [ "22", "443" ]
  type = set(string)
}

resource "aws_security_group_rule" "tcp" {
  for_each                 = var.tcp_ports
  description              = "Allow ${var.cdir} to connect to TCP port ${each.key}"
  type                     = "ingress"
  from_port                = each.key
  to_port                  = each.key
  protocol                 = "tcp"
  cidr_blocks              = var.cdir
  security_group_id = aws_security_group.default.id
}

现在您可以添加和删除端口，而不会产生不必要的创建和销毁

您不能出于任何原因将数据从列表更改为集合，只需将其包装即可

toset(var.tcp_ports)

或使用本地来相应地调整您的数据。您也可以使用地图

于 2021-02-03T10:07:31.213 回答