从数据块中拉出多个子网并创建本地列表失败

Question

我正在尝试创建一个具有 vnet 访问限制的 Web 应用程序。 为此，我需要传递一个名称（我希望它是子网、子网 ID 和优先级）。我有一个使用以下内容从数据块收集的子网列表：

data "azurerm_virtual_network" "vnet" {
  name                = var.np_vnet1
  resource_group_name = var.np_vnet_rg
}

data "azurerm_subnet" "np-vnet1-subnets" {
  for_each             = toset(data.azurerm_virtual_network.vnet.subnets)
  name                 = each.value
  virtual_network_name = data.azurerm_virtual_network.vnet.name
  resource_group_name  = data.azurerm_virtual_network.vnet.resource_group_name
}

从 data.azurerm_subnet.np-vnet1-subnets 中，我尝试在本地文件中构建格式，以动态传递到 azurerm_windows_web_app 资源。

locals {
subnet_restrictions = [
    for idx, subnet in [data.azurerm_subnet.np-vnet1-subnets] : {
      name                      = subnet.name
      virtual_network_subnet_id = subnet.id
      priority                  = idx + 100
    }
  ]
}

此 locals 块将动态传递给 Web 应用程序中的 ip_restrictions

dynamic "ip_restriction" {
      for_each = local.subnet_restrictions
      content {
        name                      = ip_restriction.value["name"]
        virtual_network_subnet_id = ip_restriction.value["virtual_network_subnet_id"]
        priority                  = ip_restriction.value["priority"]
        action                    = "Allow"
      }
    }

但是，我在本地块上的名称和 ID 上不断收到错误。 说明该对象没有 name 或 id 属性

│ Error: Unsupported attribute
│
│   on locals.tf line 29, in locals:
│   29:       name                      = subnet.name
│
│ This object does not have an attribute named "name".
╵
╷
│ Error: Unsupported attribute
│
│   on locals.tf line 30, in locals:
│   30:       virtual_network_subnet_id = subnet.id
│
│ This object does not have an attribute named "id".

在尝试构建子网列表时，我不确定我可能做错了什么。

Answer 1

循环子网列表时 locals 块发生错误。如下所示修改它以修复代码，也感谢 @Marko E 指出类似的方向。

locals {
subnet_restrictions = [
    for idx, subnet in data.azurerm_subnet.np_vnetsubnet : {
      name                      = subnet.name
      virtual_network_subnet_id = subnet.id
      priority                  = tonumber(idx) + 100 //Or directlt set it to a constant
    }
  ]
}

修改后的 Terraform 代码：

provider "azurerm" {
  features {}
  subscription_id = "xxxx"
}
data "azurerm_virtual_network" "vnet" {
  name                = "azurecloudservice3VNet"
  resource_group_name = "Jahnavi"
}

data "azurerm_subnet" "np_vnetsubnet" {
  for_each             = toset(data.azurerm_virtual_network.vnet.subnets)
  name                 = each.value
  virtual_network_name = data.azurerm_virtual_network.vnet.name
  resource_group_name  = data.azurerm_virtual_network.vnet.resource_group_name
}
locals {
subnet_restrictions = [
    for idx, subnet in data.azurerm_subnet.np_vnetsubnet : {
      name                      = subnet.name
      virtual_network_subnet_id = subnet.id
      priority                  = tonumber(idx) + 100 //Or directlt set it to a constant
    }
  ]
}
resource "azurerm_resource_group" "example" {
  name     = "ipresources"
  location = "West Europe"
}

resource "azurerm_service_plan" "example" {
  name                = "ipexample"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  sku_name            = "P1v2"
  os_type             = "Windows"
}

resource "azurerm_windows_web_app" "example" {
  name                = "ipappjah"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_service_plan.example.location
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
  dynamic "ip_restriction" {
      for_each = local.subnet_restrictions
      content {
        name                      = ip_restriction.value["name"]
        virtual_network_subnet_id = ip_restriction.value["virtual_network_subnet_id"]
        priority                  = ip_restriction.value["priority"]
        action                    = "Allow"
      }
    }
  }
}

部署成功：

参考 terraformregistry 模板。