How to add multiple IPs to azure service bus firewall dynamically using terraform.

I was able to add those IPs to the service bus instance while hard-coding those IPs in tf code. But terraform is trying to create multiple network_ruleset resources with this terraform code.

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_servicebus_namespace" "example" {
  name                = "example-sb-namespace"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "Premium"

  capacity = 1
}

resource "azurerm_virtual_network" "example" {
  name                = "example-vnet"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["172.17.0.0/16"]
  dns_servers         = ["10.0.0.4", "10.0.0.5"]
}

resource "azurerm_subnet" "example" {
  name                 = "default"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["172.17.0.0/24"]

  service_endpoints = ["Microsoft.ServiceBus"]
}


locals {

   ip_rules = [
     "1.1.1.1",
     "2.2.2.2",
     "123.145.168.143",
     "1.23.54.67",
     "145.36.142.127",
     "192.168.0.0/24",
     "194.145.123.0/26"
   ]

  
}

resource "azurerm_servicebus_namespace_network_rule_set" "example" {
  namespace_name      = azurerm_servicebus_namespace.example.name
  resource_group_name = azurerm_resource_group.example.name

  default_action = "Deny"

  trusted_services_allowed = true

  network_rules {
    subnet_id                            = azurerm_subnet.example.id
    ignore_missing_vnet_service_endpoint = false
  }


  for_each = toset(local.ip_rules1)
  ip_rules = [each.value]
  
# ip_rules = [
  #   "1.1.1.1",
  #   "2.2.2.2",
  #   "123.145.168.143",
  #   "1.23.54.67",
  #   "45.36.142.127",
  #   "192.168.0.0/24",
  #   "194.145.123.0/26"
  # ]
}

How to achieve this scenario with respect to the azure service bus instance.

CodePudding user response：

If I understand your issue correctly, the following should be enough:

resource "azurerm_servicebus_namespace_network_rule_set" "example" {
  namespace_name      = azurerm_servicebus_namespace.example.name
  resource_group_name = azurerm_resource_group.example.name

  default_action = "Deny"

  trusted_services_allowed = true

  network_rules {
    subnet_id                            = azurerm_subnet.example.id
    ignore_missing_vnet_service_endpoint = false
  }

  ip_rules = local.ip_rules 
}