Terraform Optional Parameter for List of String

Viewed 374

Trying to implement Azure WAF policy and associate with http listener the code was working fine until I try to include a new optional parameter called http_listener_ids

enter image description here

Tf code:

variable "http_listener_ids"{
  type = "list"
  description = "A list of HTTP Listener IDs from an azurerm_application_gateway"
  default = []
}



locals {  
  http_listener_ids ="${var.http_listener_ids}" == [] ? null: "${var.http_listener_ids}"
}
resource "azurerm_web_application_firewall_policy" "example" {
  name                = "example-wafpolicy"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  http_listener_ids   =  "${local.http_listener_ids}"

  custom_rules {
    name      = "Rule1"
    priority  = 1
    rule_type = "MatchRule"

    match_conditions {
      match_variables {
        variable_name = "RemoteAddr"
      }

      operator           = "IPMatch"
      negation_condition = false
      match_values       = ["192.168.1.0/24", "10.0.0.0/24"]
    }

    action = "Block"
  }

  custom_rules {
    name      = "Rule2"
    priority  = 2
    rule_type = "MatchRule"

    match_conditions {
      match_variables {
        variable_name = "RemoteAddr"
      }

      operator           = "IPMatch"
      negation_condition = false
      match_values       = ["192.168.1.0/24"]
    }

    match_conditions {
      match_variables {
        variable_name = "RequestHeaders"
        selector      = "UserAgent"
      }

      operator           = "Contains"
      negation_condition = false
      match_values       = ["Windows"]
    }

    action = "Block"
  }

  policy_settings {
    enabled                     = true
    mode                        = "Prevention"
    request_body_check          = true
    file_upload_limit_in_mb     = 100
    max_request_body_size_in_kb = 128
  }

  managed_rules {
    exclusion {
      match_variable          = "RequestHeaderNames"
      selector                = "x-company-secret-header"
      selector_match_operator = "Equals"
    }
    exclusion {
      match_variable          = "RequestCookieNames"
      selector                = "too-tasty"
      selector_match_operator = "EndsWith"
    }

    managed_rule_set {
      type    = "OWASP"
      version = "3.1"
      rule_group_override {
        rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT"
        disabled_rules = [
          "920300",
          "920440"
        ]
      }
    }
  }

}

Error I got is

Error: "http_listener_ids": this field cannot be set

I thought http_listener_ids property is not skipping and try to assign the value of null instead. So i try to implement dynamic block. But the problem is since http_listener_ids a simple list of string and not a block as such . So not sure what to put inside the content

    dynamic "http_listener_ids"{
    for_each = "${var.http_listener_ids}"
     content{
        ??
     }
   }
2 Answers

According to a recent GitHub PR, http_listener_ids is read only, and can't be set. Maybe docs haven't been updated yet.

Related