TF aws_security_group: Inappropriate value for attribute "ingress": attributes "prefix_list_ids", "security_groups", and "self" are required

user_6122975 0
Viewed 2066

I'm learning Terraform and AWS and I'm having trouble by creating an aws_security_group resource.

I copied from the Terraform Docs an example of this resource, then I configured with my data (I want to access my EC2 resources via SSH. I know that is not a good practice but I'm only learning and I'm going to destroy after the test)

resource "aws_security_group" "allow_tls_ssh" {
  name        = "allow_tls"
  description = "Allow TLS inbound traffic"
  vpc_id      = aws_vpc.vpc.id

  ingress = [
    {
      description      = "TLS from VPC"
      from_port        = 443
      to_port          = 443
      protocol         = "tcp"
      cidr_blocks      = [aws_vpc.vpc.cidr_block]
      ipv6_cidr_blocks = [aws_vpc.vpc.ipv6_cidr_block]
      prefix_list_ids  = []
      security_groups  = []
      self = false
    },
    {
      description      = "SSH from VPC"
      from_port        = 22
      to_port          = 22
      protocol         = "tcp"
      cidr_blocks      = [aws_vpc.vpc.cidr_block]
      ipv6_cidr_blocks = [aws_vpc.vpc.ipv6_cidr_block]
      prefix_list_ids  = []
      security_groups  = []
      self = false
    },
    {
      description      = "HTTP from VPC"
      from_port        = 80
      to_port          = 80
      protocol         = "tcp"
      cidr_blocks      = [aws_vpc.vpc.cidr_block]
      ipv6_cidr_blocks = [aws_vpc.vpc.ipv6_cidr_block]
      prefix_list_ids  = []
      security_groups  = []
      self = false
    }
  ]

  tags = {
    Name = "allow_tls_ssh"
  }
}

Then, when I terraform apply I get:


(...)

│   59:     }
│   60:   ]
│     ├────────────────
│     │ aws_vpc.vpc.cidr_block will be known only after apply
│     │ aws_vpc.vpc.ipv6_cidr_block will be known only after apply
│ 
│ Inappropriate value for attribute "ingress": element 0: attributes "prefix_list_ids", "security_groups", and "self" are required.
╵

This error confuses me. Why do I have to indicate security_groups when I'm creating one?

terraform0.12+ terraform-provider-aws terraform
2 Answers

The error corresponds to the attribute security_groups inside the ingress rules you are defining. A rule in a security group could be based on CIDR block, security groups or prefixed list. Since you want to use CIDR blocks just give null value to the others:

resource "aws_security_group" "allow_tls_ssh" {
  name        = "allow_tls"
  description = "Allow TLS inbound traffic"
  vpc_id      = aws_vpc.vpc.id

  ingress = [
    {
      description      = "TLS from VPC"
      from_port        = 443
      to_port          = 443
      protocol         = "tcp"
      cidr_blocks      = [aws_vpc.vpc.cidr_block]
      ipv6_cidr_blocks = [aws_vpc.vpc.ipv6_cidr_block]
      prefix_list_ids  = null
      security_groups  = null
      self = false
    },
    {
      description      = "SSH from VPC"
      from_port        = 22
      to_port          = 22
      protocol         = "tcp"
      cidr_blocks      = [aws_vpc.vpc.cidr_block]
      ipv6_cidr_blocks = [aws_vpc.vpc.ipv6_cidr_block]
      prefix_list_ids  = null
      security_groups  = null
      self = false
    },
    {
      description      = "HTTP from VPC"
      from_port        = 80
      to_port          = 80
      protocol         = "tcp"
      cidr_blocks      = [aws_vpc.vpc.cidr_block]
      ipv6_cidr_blocks = [aws_vpc.vpc.ipv6_cidr_block]
      prefix_list_ids  = null
      security_groups  = null
      self = false
    }
  ]

  tags = {
    Name = "allow_tls_ssh"
  }
}
user_113350720

I'm also getting same issue when trying to create a security group to open all traffic but, I have found solution by trying this "null" for the below. I have used it for all traffic,if you want to specify certain traffic feel free to modify it.

user_169915410
Related