Filtering a list of strings for a module argument

Terraform
,
1

Hello,

I am trying to populate my network_acls.ip_rules for my azurerm_key_vault based on the GitHub runners IP Address from the Github /meta API. I have managed to grab the data I need by using a http data resource but I need to filter it based on the IPV4 addresses since the API calls comes with IPV6 addresses as well and terraform throws a fit if I attempt to pass those in…

Here is what I attempted:

network_acls {
    default_action             = "Deny"
    bypass                     = "AzureServices"
    ip_rules                   = jsondecode( data.http.github_metadata.body ).actions 
  }

I get this error: network_acls.0.ip_rules.793 must start with IPV4 address and/or slash, number of bits (0-32) as prefix. Example: 127.0.0.1/8. Got "2a01:111:f403:f90c::/62".

I have attempted to use a for loop and a regexall on the list but I am not getting any changes when I attempt a terraform plan or terraform plan…

    network_acls {
        default_action             = "Deny"
        bypass                     = "AzureServices"
        ip_rules                   = [ for ipaddress in jsondecode( data.http.github_metadata.body ).actions : ipaddress if regexall("^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(3[0-2]|[1-2][0-9]|[0-9]))$", ipaddress) == 0 ]
      }

If anyone has solved this problem before, I would greatly appreciate the help :slight_smile:

2

Hi @erphun.ranjbar,

From your description of the underlying problem it seemed like you wanted to keep all of the IPv4 addresses and discard any IPv6 addresses, but the if clause you wrote there seems to do the opposite of that:

regexall("^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(3[0-2]|[1-2][0-9]|[0-9]))$", ipaddress) == 0

An IPv4 address would match this regular expression once, while an IPv6 address would not match it at all. So I think perhaps you intended to write != 0 here rather than == 0, to keep the IPv4 addresses?