# Get private IPs from ENIs of NLB?

**URL:** <https://discuss.hashicorp.com/t/get-private-ips-from-enis-of-nlb/5392>\
**Category:** AWS\
**Created:** [January 24, 2020, 4:35pm UTC](https://discuss.hashicorp.com/t/get-private-ips-from-enis-of-nlb/5392 "2020-01-24T16:35:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![80kk](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/80kk/32/2089_2.png) [@80kk](https://discuss.hashicorp.com/u/80kk)\
**Post date:** [January 24, 2020, 4:35pm UTC](https://discuss.hashicorp.com/t/get-private-ips-from-enis-of-nlb/5392/1 "2020-01-24T16:35:39Z")

</div>

Hi,  
This is my issue opened on the Github:

> <https://github.com/hashicorp/terraform-provider-aws/issues/11676>
>
> I am trying to setup NLB for AWS Transfer Server, however I stuck on target regi…ster step as TF outputs IPs in eni-xyz format only. How can I get IPs from ENI ids to use them as a targets?
> 
> main.tf
> \`\`\`
> resource "aws\_transfer\_server" "transfer\_server" {
> identity\_provider\_type = "API\_GATEWAY"
> endpoint\_type = "VPC\_ENDPOINT"
> endpoint\_details {
> vpc\_endpoint\_id = aws\_vpc\_endpoint.transfer\_server.id
> }
> 
> logging\_role = aws\_iam\_role.transfer\_server-role.arn
> url = var.api\_url
> invocation\_role = aws\_iam\_role.transfer\_server\_invocation-role.arn
> tags = var.tags
> 
> depends\_on = \[aws\_vpc\_endpoint.transfer\_server\]
> }
> 
> resource "aws\_vpc\_endpoint" "transfer\_server" {
> vpc\_id = var.vpc\_id
> service\_name = "com.amazonaws.${var.region}.transfer.server"
> vpc\_endpoint\_type = "Interface"
> subnet\_ids = var.public\_subnet\_ids
> private\_dns\_enabled = true
> security\_group\_ids = \[aws\_security\_group.transfer\_server.id\]
> }
> 
> resource "aws\_security\_group" "transfer\_server" {
> name = join("", \[var.tags.Environment, "-transfer\_server"\])
> description = "allows access to SFTP"
> vpc\_id = var.vpc\_id
> 
> ingress {
> from\_port = 22
> to\_port = 22
> protocol = "tcp"
> description = "allows port 22 to be accessed from local VPC and the internet"
> cidr\_blocks = concat(var.allowed\_pub\_cidrs, var.allowed\_priv\_cidrs)
> self = true
> }
> egress {
> from\_port = 0
> to\_port = 0
> protocol = "-1"
> cidr\_blocks = \["0.0.0.0/0"\]
> }
> tags = var.tags
> }
> \`\`\`
> \## NLB
> \`\`\`
> resource "aws\_eip" "eip\_nlb" {
> count = length(var.public\_subnet\_ids)
> vpc = true
> }
> 
> resource "aws\_lb" "sftp-nlb" {
> name = join("", \[var.tags.Environment, "-sftp-nlb"\])
> internal = false
> load\_balancer\_type = "network"
> enable\_deletion\_protection = false
> idle\_timeout = 180
> tags = var.tags
> 
> dynamic "subnet\_mapping" {
> for\_each = var.subnet\_mapping
> 
> content {
> subnet\_id = subnet\_mapping.value.subnet\_id
> allocation\_id = lookup(subnet\_mapping.value, "allocation\_id", null)
> }
> }
> }
> 
> resource "aws\_lb\_target\_group" "sftp-nlb-target-group" {
> name = join("", \[var.tags.Environment, "-sftp"\])
> port = 22
> protocol = "TCP"
> target\_type = "ip"
> vpc\_id = var.vpc\_id
> tags = var.tags
> }
> 
> resource "aws\_lb\_listener" "sftp-nlb-listener" {
> load\_balancer\_arn = aws\_lb.sftp-nlb.arn
> port = 22
> protocol = "TCP"
> default\_action {
> target\_group\_arn = aws\_lb\_target\_group.sftp-nlb-target-group.arn
> type = "forward"
> }
> }
> \`\`\`
> 
> vars.tf
> \`\`\`
> output "transfer\_server\_id" {
> value = aws\_transfer\_server.transfer\_server.id
> }
> 
> output "transfer\_server\_endpoint" {
> value = aws\_transfer\_server.transfer\_server.endpoint
> }
> 
> output "vpc\_endpoint\_transferserver\_network\_interface\_ids" {
> description = "One or more network interfaces for the VPC Endpoint for transferserver"
> value = flatten(aws\_vpc\_endpoint.transfer\_server.\*.network\_interface\_ids)
> }
> \`\`\`

What I want to do is to create target group attachment. I have tried this:

```
data "aws_network_interface" "sftp-nlb" {
  for_each = var.private_subnet_ids

  filter {
    name = "description"
    values = ["ELB ${aws_lb.sftp-nlb.arn_suffix}"]
  }

  filter {
    name = "private_subnet_ids"
    values = [each.value]
  }
}

resource "aws_alb_target_group_attachment" "tg_attachment" {
  vpc_id = var.vpc_id
  target_group_arn = aws_lb_target_group.sftp-nlb-target-group.arn
  target_id = formatlist("%s/32", [for eni in data.aws_network_interface.sftp-nlb : eni.private_ip])  
  port = 22
}

```

but that gives me:

```
Error: Incorrect attribute value type

 on modules/sftp/main.tf line 135, in resource "aws_alb_target_group_attachment" "tg_attachment":
135: target_id = formatlist("%s/32", [for eni in data.aws_network_interface.sftp-nlb : eni.private_ip])

```

Inappropriate value for attribute “target\_id”: string required.

---

<div class="post-metadata">

**Author:** ![bentterp](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/bentterp/32/3450_2.png) [@bentterp](https://discuss.hashicorp.com/u/bentterp)\
**Post date:** [January 24, 2020, 5:45pm UTC](https://discuss.hashicorp.com/t/get-private-ips-from-enis-of-nlb/5392/2 "2020-01-24T17:45:45Z")

</div>

an ip-address is not an interface id  
try with `eni.id` instead of `eni.private_ip`

> **[AWS: aws\_network\_interface - Terraform by HashiCorp](https://www.terraform.io/docs/providers/aws/d/network_interface.html)**
>
> Get information on a Network Interface resource.

---

<div class="post-metadata">

**Author:** ![80kk](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/80kk/32/2089_2.png) [@80kk](https://discuss.hashicorp.com/u/80kk)\
**Post date:** [January 27, 2020, 9:33am UTC](https://discuss.hashicorp.com/t/get-private-ips-from-enis-of-nlb/5392/3 "2020-01-27T09:33:52Z")

</div>

same error:

```
Error: Incorrect attribute value type

  on modules/sftp/main.tf line 136, in resource "aws_alb_target_group_attachment" "tg_attachment":
 136: target_id = formatlist("%s/32", [for eni in data.aws_network_interface.sftp-nlb : eni.id])

Inappropriate value for attribute "target_id": string required.
```

---

<div class="post-metadata">

**Author:** ![bentterp](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/bentterp/32/3450_2.png) [@bentterp](https://discuss.hashicorp.com/u/bentterp)\
**Post date:** [January 27, 2020, 7:36pm UTC](https://discuss.hashicorp.com/t/get-private-ips-from-enis-of-nlb/5392/4 "2020-01-27T19:36:12Z")

</div>

Sorry, that was silly of me - I didn’t read up on the [aws\_lb\_target\_group\_attachment](https://www.terraform.io/docs/providers/aws/r/lb_target_group_attachment.html) resource

The resource only takes one id as target\_id, so we must attach them separately.

resource “aws\_alb\_target\_group\_attachment” “tg\_attachment” {  
for\_each = data.aws\_network\_interface.sftp-nlb  
vpc\_id = var.vpc\_id  
target\_group\_arn = aws\_lb\_target\_group.sftp-nlb-target-group.arn  
target\_id = each.private\_ip  
port = 22  
}

If this doesn’t work, can I please see the contents of data.aws\_network\_interface.sftp-nlb? just dump it as output to get hold of it.

---

<div class="post-metadata">

**Author:** ![A146874](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/a146874/32/21924_2.png) [@A146874](https://discuss.hashicorp.com/u/A146874)\
**Post date:** [August 27, 2021, 4:46pm UTC](https://discuss.hashicorp.com/t/get-private-ips-from-enis-of-nlb/5392/5 "2021-08-27T16:46:52Z")

</div>

This is working although it is slightly different from what your question asked. I think you can adapt it to your case.

```auto
data "aws_network_interface" "vpc_endpoint_eni" {
  for_each = toset(var.private_subnet_ids)
  
  filter {
    name = "description"
    values = ["ELB ${aws_lb.sftp-nlb.arn_suffix}"]
  }
  
  filter {
    name = "subnet-id"
    values = [each.value]
  }
}

resource "aws_lb_target_group_attachment" "custom_domain_lb_api_targets" {
  for_each = toset(var.private_subnet_ids)
  target_group_arn = aws_lb_target_group.custom_domain_lb_api_target_group.arn
  target_id = data.aws_network_interface.vpc_endpoint_eni[each.key].private_ip
  port = 443
}

```