Rule_nos in dynamic ingress in Terraform - terraform

Question

I have a dynamic nested block to create a list of ingress rules in a Network ACL:
resource "aws_network_acl" "network_acl" {
vpc_id = aws_vpc.vpc.id
dynamic "ingress" {
for_each = var.ssh_cidr_blocks
iterator = cidr
content {
rule_no = 100
protocol = "tcp"
action = "allow"
cidr_block = cidr.value
from_port = 22
to_port = 22
}
}
}
As can be seen, I am generating an ingress for each CIDR in var.ssh_cidr_blocks.
This does not work however, and AWS sends back a message that the rule_no needs to be unique:
Error: Error creating ingress entry: NetworkAclEntryAlreadyExists: The network acl entry identified by 100 already exists.
status code: 400, request id: c9b4b5ad-c1a9-4a85-a4e0-b0559e14ea53
I am a bit confused because Network ACLs in dynamic ingress rules are a class use-case for the dynamic nested blocks. Yet this doesn't even seem possible!
Is there any way to do this?

Answer 1

Here is an option using range to avoid the duplicates on rule_no:
locals {
ssh_cidr_blocks = [
"10.0.208.0/20",
"10.0.192.0/20",
"10.0.224.0/20"
]
}
resource "aws_network_acl" "network_acl" {
vpc_id = aws_vpc.myvpc.id
dynamic "ingress" {
for_each = range(length(local.ssh_cidr_blocks))
iterator = i
content {
rule_no = i.value
protocol = "tcp"
action = "allow"
cidr_block = local.ssh_cidr_blocks[i.value]
from_port = 22
to_port = 22
}
}
}
Since all the acl rules are allow the order does not matter much and we can get away with that ...
But as you create more complex rules I'm not sure this will be acceptable since you will be mixing allow and deny and the order is important. You could follow #Kyle comment and use a map instead, in that case, the key is the rule_no, and the code will be something like:
locals {
ssh_cidr_blocks = {
100 = "10.0.208.0/20",
200 = "10.0.192.0/20",
500 = "10.0.224.0/20"
}
}
resource "aws_network_acl" "network_acl" {
vpc_id = aws_vpc.myvpc.id
dynamic "ingress" {
for_each = local.ssh_cidr_blocks
content {
rule_no = ingress.key
protocol = "tcp"
action = "allow"
cidr_block = ingress.value
from_port = 22
to_port = 22
}
}
}