0

I am trying to setup three NSGs with the same rules, so to tackle this I have made a for each loop. Yet on one of the rules I need to pass two ip addresses, and I keep getting errors that basically the foreach loop wont accept two values passed through. I have tried following this anwser: Terraform for-each with list of objects

Without any luck. I keep getting the following Error even though I believe I have set this up the right way. Error: Error: Unsupported block type │ │ on nsgrules.tf line 40, in resource "azurerm_network_security_rule" "GW01SEC01rules": │ 40: dynamic "source_address_prefix"{ │ │ Blocks of type "source_address_prefix" are not expected here.

Please can you help.

Here is my Code:

main.tf

resource "azurerm_network_security_group" "nsg" {
  name                = "nsg"
  location            = azurerm_resource_group.Terraform.location 
  resource_group_name = azurerm_resource_group.Terraform.name

}

resource "azurerm_network_security_rule" "nsg1rules" {
  for_each                    = local.nsgrules
  name                        = each.key
  direction                   = each.value.direction
  access                      = each.value.access
  priority                    = each.value.priority
  protocol                    = each.value.protocol
  source_port_range           = each.value.source_port_range
  destination_port_range      = each.value.destination_port_range
  dynamic "source_address_prefix"{
    for_each = each.value.source_address_prefix
    content {
       source_address_prefix = source_address_prefix.value
    }
  }
  destination_address_prefix  = each.value.destination_address_prefix
  resource_group_name         = azurerm_resource_group.Terraform.name
  network_security_group_name = azurerm_network_security_group.nsg.name
}

resource "azurerm_network_interface_security_group_association" "nsg" {
  network_interface_id      = azurerm_network_interface.nic.id
  network_security_group_id = azurerm_network_security_group.nsg.id
}

locals.tf

locals {
 nsgrules = {

    rdp = {
      name                       = "RDP"
      priority                   = 330
      direction                  = "Inbound"
      access                     = "Deny"
      protocol                   = "Tcp"
      source_port_range          = "*"
      destination_port_range     = "3389"
      source_address_prefix      = "0.0.0.0"
      destination_address_prefix = "*"
    }

    rdp2 = {
      name                       = "RDP2"
      priority                   = 340
      direction                  = "Inbound"
      access                     = "Deny"
      protocol                   = "Tcp"
      source_port_range          = "*"
      destination_port_range     = "3389"
      source_address_prefix      = ["1.1.1.1", "2.2.2.2"]
      destination_address_prefix = "*"
    }

      rdp3 = {
      name                       = "RDP3"
      priority                   = 310
      direction                  = "Inbound"
      access                     = "Allow"
      protocol                   = "Tcp"
      source_port_range          = "*"
      destination_port_range     = "3389"
      source_address_prefix      = "3.3.3.3"
      destination_address_prefix = "*"
    }


    https = {
      name                       = "HTTPS"
      priority                   = 320
      direction                  = "Inbound"
      access                     = "Allow"
      protocol                   = "Tcp"
      source_port_range          = "*"
      destination_port_range     = "443"
      source_address_prefix      = "*"
      destination_address_prefix = "*"
    }
 }
Daniel Mann
  • 57,011
  • 13
  • 100
  • 120
Jason
  • 510
  • 5
  • 27
  • The documentation says it is an argument and not a block. `source_address_prefixes` on the other hand is an argument that is a list. – Marko E Jun 17 '22 at 12:06
  • But even if I change `source_address_prefixes` in the dynamic block to something else like `source_address` I still get the same error. – Jason Jun 17 '22 at 12:23
  • So you can't use `dynamic`, the only way I could see this work is with a ternary operator and compare values and set it to `null` if the value is empty. – Marko E Jun 17 '22 at 12:26
  • But the question I linked too they have managed to do it. – Jason Jun 17 '22 at 12:36
  • But it isn't a same type of resource, isn't it? You are trying to create a block where it's only an argument. – Marko E Jun 17 '22 at 12:37

0 Answers0