Getting the CIDR block of a set of subnets - terraform

Question

I am trying to get the CIDR block of a set of subnets IDs provided a parameter.
data "aws_subnet" "target" {
for_each = "${toset(var.subnet_ids)}"
id = "${each.value}"
}
resource "aws_security_group" "registry" {
vpc_id = "${var.vpc_id}"
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["${data.aws_subnet.target.*.cidr_block}"]
}
tags = {
Name = "${var.name}"
}
}
The error I am getting is:
cidr_blocks = "${data.aws_subnet.target.*.cidr_block}"
This object does not have an attribute named "cidr_block".
Terraform configuration:
Terraform v0.12.24
+ provider.aws v2.55.0
+ provider.template v2.1.2
Thanks to whoever can help!

Answer 1

You should use a splat expression to the values of the map.
resource "aws_security_group" "registry" {
vpc_id = "${var.vpc_id}"
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = values(data.aws_subnet.target).*.cidr_block
}
tags = {
Name = "${var.name}"
}
}

Answer 2

I think the problem here is that the for_each argument makes data.aws_subnet.target appear as a map value, and the splat operator .* is defined to behave as a no-op if it's applied to anything other than a list or set. Therefore expression evaluation here is taking the following steps:
First evaluate data.aws_subnet.target, producing a map of objects whose keys are the strings from var.subnet_ids, which presumably look like subnet-12345.
Then apply .* to that map. Because it's a map, that produces the same result again.
Then apply .cidr_block to that map, which fails because its keys are the subnet ids, not the attributes of the subnet objects.
To get the desired result here, we can use values to disregard the keys and take the values from the map as a list:
cidr_blocks = values(data.aws_subnet.target).*.cidr_block
Because the result of values(...) is a list, the .* operator will behave as expected and try to find the cidr_block attribute in each of the elements of the list.
Another option is to use a for expression, which is a generalization of the splat syntax that works for any collection-typed value:
cidr_blocks = [for s in data.aws_subnet.target : s.cidr_block]