Terraform for Digital Ocean Managed Database Firewall

user_15069461 0
Viewed 133

I have been trying to dynamically create the Terraform code for a managed Digital Ocean database I have. I am trying to achieve that I have some lists of FW entries like:

locals {
  ####################################################################################
  ## DO object ids (the different ID's for the Postgres databases in Digital Ocean
  ####################################################################################
  id_postgres_application_dev = "12345"
  id_postgres_application_stg = "23456"
  id_postgres_application_prd = "34567"

  # Map to fw for Postgres
  pg-application_id = {
    "dev" = id_postgres_application_dev
    "stg" = id_postgres_application_stg
    "prd" = id_postgres_application_prd
  }

  ####################################################################################
  ## Outside IP addresses
  ####################################################################################
  fw_ip_peter = "4.100.123.140"
  fw_ip_sunshine = "152.120.106.102"

 ####################################################################################
  ## Postgres Application
  ####################################################################################
  # Map to fw for Postgres
  pg-application_fw_rules_ip = {
    "dev" = [
      local.fw_ip_peter,
      local.fw_ip_sunshine]
    "stg" = [
      local.fw_ip_peter]
    "prd" = [
      local.fw_ip_peter]
  }

  long_key = {
    type = "string"
    default = <<EOF
    rule = {
      type = "KEY"
      value = "VALUE"
    }
    EOF
  }

  fw_rules = toset(lookup(local.pg-application_fw_rules_ip, var.environment))
}

Now what I want to achieve is to dynamically generate the FW rule entries (these are described in the Digital Ocean documentation here: https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/database_firewall

So the result would be something like for the dev environment:


id_postgres_application = lookup(local.pg-application_id, var.environment)

resource "digitalocean_database_firewall" "example-fw" {
  cluster_id = id_postgres_application

  rule {
    type  = "ip_addr"
    value = "4.100.123.140" // Peter
  }

  rule {
    type  = "ip_addr"
    value = "152.120.106.102" // Sunshine (for dev only)
  }
}

So the problem lies in the rule sections - to repeat these per entry in the fw_rules variable.

Does anyone have specific advice on how to do this? I have tried many different solutions, and I think my basic problem is to understand which method to apply?

digital-ocean terraform firewall database
1 Answers

Generally, you would use dynamic blocks for that. Thus, your code could look like the following:

resource "digitalocean_database_firewall" "example-fw" {

  cluster_id = id_postgres_application

  dynamic "rule" {

    for_each = local.application_fw_rules_ip[var.environment]

    content {
        type  = "ip_addr"
        value = rule.key
    }

  }
}

Treat the code as an example, as probably some further adjustments specific to your setup may be required.

user_2488230
Related