Unable to create multiple endpoint_resource_id for storage account network rule using Terraform

loczek09 0
Viewed 23

My goal is to create multiple endpoint_resource_id so they will have network access to storage account using terraform: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#network_rules

But when I'am trying to use for loop in order to create more endpoint_resource_id from variable I get an error:

ā”‚ An argument named "private_link_access" is not expected here. Did you mean to define a block of type "private_link_access"

Exactly the same approach but with different attributes works for eventhub network_rulesets.

#Working code  when using private_link_access block separately:
   network_rules {
  
  default_action ="Deny"
  private_link_access {
    endpoint_resource_id = "endpoint_resource_id1"
  }
 private_link_access {
    endpoint_resource_id = "endpoint_resource_id2"
  }
 }

#Working code for eventhub network rulesets:
  dynamic "network_rulesets" {
    for_each = var.sku != "Basic" ? [{}] : []

    content {
      default_action = "Deny"
      trusted_service_access_enabled = true

      ip_rule = [
        for ip in var.allow_ip_range : {
          action  = "Allow"
          ip_mask     = ip
        }
      ]
    }
  }

#Not working for storage account network_rules
  dynamic "network_rules" {
    for_each = var.sku != "Basic" ? [{}] : []

    content {
      default_action = "Deny"

      private_link_access = [
        for endpoint_id in var.allow_endpoint_id  : {
          endpoint_resource_id     = endpoint_id 
        }
      ]
    }
  }
azure-storage-account terraform
1 Answers

I think this is due to not being able to have nested dynamic blocks and private_link_access needs to be a dynamic block. You can solve it by doing something like

variable "private_link_access" {
  type        = list(string)
  default     = null
  description = "Define a list of endpoint id's to whitelist on network rules"
}

network_rules {
   
    default_action =  var.private_link_access == null ? "Allow" : "Deny"

    dynamic "private_link_access" {
      for_each = var.private_link_access
      content {
        endpoint_resource_id = private_link_access.value
      }
    }

    }
QAlexk0
Related