Question

我想允许来自所有本地子网（不包括对等子网）的NSG流量。由于我只有一个地址空间，因此似乎最直接的方法是使用VNET的address_space作为安全规则的source_address_prefix。

resource "azurerm_resource_group" "west01-rg" {
  name     = "west01-rg"
  location = "West US"
}

resource "azurerm_virtual_network" "virtual-network" {
  name                = "west01-vnet"
  location            = "${azurerm_resource_group.west01-rg.location}"
  resource_group_name = "${azurerm_resource_group.west01-rg.name}"
  address_space       = ["10.10.20.0/21"]
}

resource "azurerm_subnet" "servers-subnet" {
  name                 = "ServersNet"
  resource_group_name  = "${azurerm_resource_group.west01-rg.name}"
  virtual_network_name = "${azurerm_virtual_network.virtual-network.name}"
  address_prefix       = "10.10.20.0/24"
}

resource "azurerm_network_security_group" "dc-nsg" {
  name                = "dc-nsg"
  location            = "${azurerm_resource_group.west01-rg.location}"
  resource_group_name = "${azurerm_resource_group.west01-rg.name}"

  security_rule {
    name                       = "AllowCidrSubnet"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "${azurerm_virtual_network.virtual-network.address_space}"
    destination_address_prefix = "*"
  }

  tags {
    environment = "Testing"
  }
}

根据文档，此值可以采用CIDR表示法。但是，上面的示例导致错误

Error: azurerm_network_security_group.dc: security_rule.0.source_address_prefix must be a single value, not a list

如果我切换到应该接受列表的source_address_prefixes，则会出现此错误

Error: azurerm_network_security_group.dcx: security_rule.0.source_address_prefixes: should be a list

因此，似乎值既是列表，也不是列表。应该行吗？还是我应该以不同的方式去做？

Terraform v0.11.11
provider.azurerm v1.21.0

Answer 1

在Terraform 0.12之前的版本中，每个变量默认情况下都是字符串类型，如果要使用列表或地图类型，则在传递变量时必须始终使用该类型。这应在Terraform 0.12中更改，因为HCL2对类型的支持更好，包括更多complex type handling。

要解决您的问题，您需要为列表建立索引以返回单个元素，然后该元素将成为字符串，或者您需要与列表类型保持一致。

所以这两个都应该起作用：

resource "azurerm_network_security_group" "dc-nsg" {
  name                = "dc-nsg"
  location            = "${azurerm_resource_group.west01-rg.location}"
  resource_group_name = "${azurerm_resource_group.west01-rg.name}"

  security_rule {
    name                       = "AllowCidrSubnet"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "${azurerm_virtual_network.virtual-network.address_space[0]}"
    destination_address_prefix = "*"
  }

  tags {
    environment = "Testing"
  }
}

或直接使用列表：

resource "azurerm_network_security_group" "dc-nsg" {
  name                = "dc-nsg"
  location            = "${azurerm_resource_group.west01-rg.location}"
  resource_group_name = "${azurerm_resource_group.west01-rg.name}"

  security_rule {
    name                       = "AllowCidrSubnet"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefixes    = ["${azurerm_virtual_network.virtual-network.address_space}"]
    destination_address_prefix = "*"
  }

  tags {
    environment = "Testing"
  }
}

VNET地址空间可以用于NSG源地址前缀吗？

1 个答案: