Terraform NACL块使用字符串列表类型CIDR变量报错如何解决

• aws_network_acl资源的egress/ingress规则块中，cidr_block参数仅接受单个字符串格式的CIDR地址，你直接传入了data.aws_ip_ranges.az_s3.cidr_blocks整个列表，触发了类型不匹配报错
• 你给aws_network_acl配置了count = length(var.wan_range)参数，会导致创建多个NACL实例，而非在同一个NACL下生成多条对应不同WAN CIDR的规则，不符合你批量配置规则、减少实例数量的需求

使用Terraform的dynamic动态块批量生成规则，同时自动错开规则编号避免冲突，修改后代码如下：

data "aws_ip_ranges" "az_s3" {
  regions  = ["region-1"]
  services = ["s3"]
}

variable "wan_range" {
  description = "WAN cidr ranges"
  type        = list(string)
  default     = ["10.0.0.0/8", "172.16.0.0/16", "192.168.0.0/24"]
}

resource "aws_network_acl" "NACL_1" {
  vpc_id     = aws_vpc.sec_vpc.id
  subnet_ids = [aws_subnet.private_subnet.id]

  # 批量生成S3 80端口放行规则
  dynamic "egress" {
    for_each = data.aws_ip_ranges.az_s3.cidr_blocks
    content {
      protocol   = "tcp"
      rule_no    = 100 + index(data.aws_ip_ranges.az_s3.cidr_blocks, egress.value)
      action     = "allow"
      cidr_block = egress.value
      from_port  = 80
      to_port    = 80
      icmp_code  = 0
      icmp_type  = 0
      ipv6_cidr_block = null
    }
  }

  # 批量生成WAN高端口放行规则
  dynamic "egress" {
    for_each = var.wan_range
    content {
      protocol   = "tcp"
      rule_no    = 200 + index(var.wan_range, egress.value)
      action     = "allow"
      cidr_block = egress.value
      from_port  = 32768
      to_port    = 65535
      icmp_code  = 0
      icmp_type  = 0
      ipv6_cidr_block = null
    }
  }
}

该方案仅会创建1个NACL实例，所有规则自动批量生成，无需手动拆分CIDR条目，同时兼容数据源输出的列表和自定义变量列表。

内容的提问来源于stack exchange，提问作者Fancy Schmancy