Terraform嵌套count/dynamic创建aws_security_group_rule报错如何解决

算力阿峰

2026-10-8

Terraform AWS安全组规则配置错误修正方案

错误原因

aws_security_group_rule 资源没有名为sg的支持块，自定义动态块名不符合Terraform资源规范，直接触发不支持块类型报错
from_port、to_port属于aws_security_group_rule的根级别必填参数，写入自定义动态块内会导致Terraform无法识别到资源必填配置
原计数判断逻辑中，列表类型的ingress_cidr_tcp与空字符串对比无实际意义，存在逻辑隐患

修正后代码

保持你原有变量定义不变的前提下，我们先通过local处理端口与CIDR的配对关系，再生成安全组规则：

# 原有变量定义保持不变即可
variable "ingress_ports_tcp" {
  type    = list(list(number))
  default = [[22], [443, 80]]
}

variable "ingress_cidr_tcp" {
  type    = list(list(string))
  default = [["1", "2", "3"], ["4", "5"]]
}

# 结构预处理+资源定义
locals {
  # 先校验端口列表和CIDR列表长度一致，避免索引越界
  ingress_tcp_pairs = length(var.ingress_ports_tcp) == length(var.ingress_cidr_tcp) ? [
    for idx in range(length(var.ingress_ports_tcp)) : {
      ports = var.ingress_ports_tcp[idx]
      cidrs = var.ingress_cidr_tcp[idx]
    }
  ] : []

  # 展平为单端口对应对应CIDR组的结构，方便生成独立规则
  flattened_tcp_rules = flatten([
    for pair in local.ingress_tcp_pairs : [
      for port in pair.ports : {
        port  = port
        cidrs = pair.cidrs
      }
    ]
  ])
}

resource "aws_security_group_rule" "tcp_ingress" {
  for_each          = { for k, v in local.flattened_tcp_rules : "${v.port}-${k}" => v }
  type              = "ingress"
  protocol          = "tcp"
  from_port         = each.value.port
  to_port           = each.value.port
  cidr_blocks       = each.value.cidrs
  security_group_id = aws_security_group.default-sg[0].id
}