1

I'm looking a solution for changing the priority on a dynamic "ip_restriction" the code that I use is

variable "ip_address_list" { 
  type = list 
  default = ["20.20.20.3/32" , "10.10.10.2/32"] 
}

site_config {
  dynamic "ip_restriction" {
for_each = var.ip_address_list
  content {
    ip_address  = cidrhost(ip_restriction.value, 0)
    action                    = "Allow"
    priority                  = 100
  }
}

When using this code I got the following output

  • ip_restriction= [
  • {
  • action= "Allow"
  • headers= (known after apply)
  • ip_address= "20.20.20.3"
  • name= (known after apply)
  • priority= 100
  • service_tag= null
  • virtual_network_subnet_id = null },
  • {
  • action= "Allow"
  • headers= (known after apply)
  • ip_address= "10.10.10.2"
  • name= (known after apply)
  • priority= 100
  • service_tag= null
  • virtual_network_subnet_id = null }, ]
Alex
  • 7,901
  • 1
  • 41
  • 56
Igor
  • 55
  • 10
  • 1
    Could you please add your variables.tf or how var.ip_address_list is defined? – Alex Sep 21 '21 at 12:39
  • Variable is defined as following: variable "ip_address_list" { type = list default = ["20.20.20.3/32" , "10.10.10.2/32"] } – Igor Sep 21 '21 at 14:01

1 Answers1

1

You can use something like this:

locals {
 ip_address_list = [
           {     
                  ip_add : "20.20.20.3/32",
                  prior : "100"
            },
            {     
                 ip_add : "10.10.10.2/32",
                 prior : "101"
            }
     ]
}

and then

  site_config {
  dynamic "ip_restriction" {
for_each = local.ip_address_list
  content {
    ip_address  = ip_restriction.value["ip_add"]
    action                    = "Allow"
    priority                  = ip_restriction.value["prior"]
  }
}

Output:

enter image description here

Note: Instead of declaring the variables you can declare the locals as given above and then use the site config block provided above.

Update: As per this Github issue @martinjt commented that it expects ipadd/32 as the subnet mask is not included in new versions . So, changed the above code by removing the cidrhost and did a apply it got deployed successfully.

Error: with cidrhost

enter image description here

After removing the cidrhost

enter image description here

Ansuman Bal
  • 9,705
  • 2
  • 10
  • 27
  • This looks good but when I try to deploy I have error: Error: creating App Service "hook-service" (Resource Group "RG-DEV-TEST"): web.AppsClient#CreateOrUpdate: Failure sending request: StatusCode=0 -- Original Error: Code="BadRequest" Message="IpSecurityRestriction.IpAddress is invalid. '20.20.20.3' is an invalid CIDR!"} – Igor Sep 22 '21 at 10:02
  • also @Igor, can you Please try with `ip_restriction.value["ip_add"]` only instead of `cidrhost(ip_restriction.value["ip_add"], 0)` and let me know if it resolves the above `'20.20.20.3' is an invalid CIDR!"}` – Ansuman Bal Sep 22 '21 at 10:30
  • Thank you. I tested and it is deploying successfully. – Igor Sep 22 '21 at 12:05