Terraform从1.0.11升级至1.4.0：变量类型兼容问题求助

Terraform 1.x版本对类型约束的校验逐步严格，你的变量rules存在两个核心问题：

1. 默认值中大部分元素是4元素数组，但_项是3元素数组，结构不统一；
2. 数组内元素类型混合（比如端口是数字80，但all-all里的协议是字符串"-1"），旧版本松散的"map"类型允许这种混合，但新版本严格校验时会触发类型不兼容报错。

根据你的需求，有两种符合Terraform 1.4.0规范的写法：

方案1：统一结构，使用精确类型约束 #

如果希望严格规范规则结构，将所有数组统一为4元素，并统一元素类型（全部转为字符串，避免数字/字符串混合）：

variable "rules" {
  description = "Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description'])"
  type = map(tuple([string, string, string, string]))

  default = {
    # HTTP
    http-80-tcp   = ["80", "80", "tcp", "HTTP"]
    https-443-tcp = ["443", "443", "tcp", "HTTPS"]
    ssh-tcp       = ["22", "22", "tcp", "SSH"]
    rdp-tcp       = ["3389", "3389", "tcp", "RDP TCP"]
    oracle-db-tcp = ["1521", "1521", "tcp", "Oracle"]
    all-all       = ["0", "0", "-1", "All protocols"]
    
    # 统一为4元素数组，和其他规则结构一致
    _ = ["", "", "", ""]
  }
}

• 用tuple([string, string, string, string])精确限定每个规则的结构：4个字符串元素，分别对应起始端口、结束端口、协议、描述；
• 把所有数字类型的端口转为字符串（比如"80"），确保类型完全统一，通过严格校验。

方案2：保留灵活结构，使用宽松类型约束 #

如果需要保留不同长度的数组（比如_项的3元素），可以使用map(list(any))作为类型约束，同时确保所有值都是数组类型：

variable "rules" {
  description = "Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description'])"
  type = map(list(any))

  default = {
    # HTTP
    http-80-tcp   = [80, 80, "tcp", "HTTP"]
    https-443-tcp = [443, 443, "tcp", "HTTPS"]
    ssh-tcp       = [22, 22, "tcp", "SSH"]
    rdp-tcp       = [3389, 3389, "tcp", "RDP TCP"]
    oracle-db-tcp = [1521, 1521, "tcp", "Oracle"]
    all-all       = [0, 0, "-1", "All protocols"]
    
    _ = ["", "", ""]
  }
}

• list(any)允许数组内元素类型混合，同时支持不同数组有不同长度；
• 这种写法兼容性更强，但类型约束的严谨性会降低。

额外优化建议 #

既然_项是lookup()的 fallback 默认值，其实可以不用放在变量的default里，而是在调用lookup()时直接指定默认值，这样变量结构更干净：

# 变量定义（去掉_项）
variable "rules" {
  description = "Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description'])"
  type = map(tuple([string, string, string, string]))

  default = {
    http-80-tcp   = ["80", "80", "tcp", "HTTP"]
    https-443-tcp = ["443", "443", "tcp", "HTTPS"]
    ssh-tcp       = ["22", "22", "tcp", "SSH"]
    rdp-tcp       = ["3389", "3389", "tcp", "RDP TCP"]
    oracle-db-tcp = ["1521", "1521", "tcp", "Oracle"]
    all-all       = ["0", "0", "-1", "All protocols"]
  }
}

# 调用lookup时直接指定默认值
lookup(var.rules, "some-rule", ["", "", "", ""])

内容的提问来源于stack exchange，提问作者Ocean7