Conditionally setting security_groups on aws_lb

Terraform Providers AWS
1

Hi there,
I’ve built a module to create a fargate cluster with service and task behind an aws_lb, I need to have (at least) two clusters, one for TCP traffic, and one for HTTP(S) traffic.

I’d like to reuse the code for both, the code works pretty well for everything but I’ve got stuck at the security_groups attribute, which is not allowed for a Network Load Balancer.

I’d like to set the security_groups in here:

resource "aws_lb" "main" { 
  load_balancer_type                  = "${var.load_balancer_type}"
  security_groups                     = ["${aws_security_group.lb.id}"]
  #...
}

Only if

"${var.load_balancer_type == "application"

Is there any way to achieve it?
I searched for a while and nobody seems to be doing it this way.

The alternative would be to duplicate quite some code and I’d like to avoid.

The security groups are already created with a count only if the load balancer type is ‘application’:

resource "aws_security_group" "lb" {
  count = "${var.load_balancer_type == "application" ? 1 : 0}"
  #...
}

Thanks in advance

2

Hi @aterreno,

If you are using Terraform 0.12, have you tried:

resource "aws_elb" "main" { 
  load_balancer_type                  = "${var.load_balancer_type}"
  security_groups                     = var.load_balancer_type == "application" ? ["${aws_security_group.lb.id}"] : null
  #...
}

The null will indicate that the resource should use its default behavior.

Hope it helps!

3

Thanks not on 0.12 but I hope this will help other users landing on this.

I ended up changing completely my infra definitions so I am good now!

1 Like
4

Hi @joatmon08 I have a similar problem with conditionals. Is your code scrap valid? On my machine the conditional portion is invalid. How to write this correctly in TF 0.12?

resource "aws_route53_record" "external-dns-record" {
  zone_id = "XXXXXXXXXX"
  # In PROD we just want hostname, not prod-hostname
  environment_name  = "${var.environment_name}"
  name              =  var.environment_name == "prod" ? ["${var.hostname}"] : ["${var.environment_name}-${var.hostname}"]
  type = "A"
  ttl = "300"
  records = ["${aws_instance.ec2machine.public_ip}"]
}

btw how do you get the code highlighting to work in this forum?

5

Hi @jasedragon!

The code snippet I created is for the AWS ELB, which means that it actually has an attribute called application_type. I don’t see an environment_name attribute for aws_route53_record, so that might be where the invalid portion is being flagged. I updated the snippet you included, the following works for me on Terraform 0.12:

variable "environment_name" {
  default = "qa"
}

variable "hostname" {
  default = "myhost"
}

resource "aws_route53_record" "test" {
  zone_id = "XXXXXXXXXX"
  name    = var.environment_name == "prod" ? var.hostname : "${var.environment_name}-${var.hostname}"
  type    = "A"
  ttl     = "300"
  records = ["${aws_instance.foo.public_ip}"]
}

For code highlighting, you can use the Markdown capability where you insert the backticks, followed by hcl, as such:

```hcl

Hope this helps!

6

Hi Rosemary, this certainly has helped!
I’ve been struggling with variable interpolation and it was only after testing your snippet that I realised my code-highlighting plugin was buggy - it doesn’t yet understand terraform 0.12 so has been misleading me about what code is/isn’t valid. https://github.com/mauve/vscode-terraform/issues/157