How Do I Use A Terraform Data Source To Reference A Managed Prefix List?

jh12298 0
Viewed 34

I'm trying to update a terraform module to add a new security group, which will have an inbound rule populated with two managed prefix lists. The prefix lists are shared to my AWS account from a different account using AWS Resource Access Manager, however I have tried referencing prefix lists created within my own AWS account and am seeing the same error.

Below is the terraform I am using:

resource "aws_security_group" "akamai_sg" {
  name                   = "akamai-pl-sg"
  description            = "Manage access from Akamai to ${var.environment} alb"
  vpc_id                 = var.vpc_id
  tags                   = merge(var.common_tags, tomap({ "Name" = "akamai-pl-sg" }))
  revoke_rules_on_delete = true
}

resource "aws_security_group_rule" "akamai_to_internal_alb" {
  for_each = toset(var.domains_inc_akamai)

  type                     = "ingress"
  description              = "Allow Akamai into ${var.environment}${var.domain_name_suffix}-alb"
  from_port                = var.alb_listener_port
  to_port                  = var.alb_listener_port
  protocol                 = "tcp"
  security_group_id        = aws_security_group.akamai_sg.id
  prefix_list_ids          = [data.aws_prefix_list.akamai-site-shield.id, data.aws_prefix_list.akamai-staging.id]
}

data "aws_prefix_list" "akamai-site-shield" {
  filter {
    name   = "prefix-list-id"
    values = ["pl-xxxxxxxxxx"]
  }
}

data "aws_prefix_list" "akamai-staging" {
  filter {
    name   = "prefix-list-id"
    values = ["pl-xxxxxxxxxx"]
  }
}

The terraform error I am revieving reads: "Error: no matching prefix list found; the prefix list ID or name may be invalid or not exist in the current region"

Is anyone able to help, or see where I am going wrong?

Thanks in advance.

terraform-provider-aws terraform amazon-web-services
1 Answers

Would not be the following possible?

data "aws_vpc_endpoint" "s3" {
  vpc_id       = aws_vpc.foo.id
  service_name = "com.amazonaws.us-west-2.s3"
}

data "aws_prefix_list" "s3" {
  prefix_list_id = aws_vpc_endpoint.s3.prefix_list_id
}

It seems the solution is to use:

data "aws_ec2_managed_prefix_list" "example" {
  filter {
    name   = "prefix-list-name"
    values = ["my-prefix-list"]
  }
}
Istvan0
Related