Dynamic IP Restriction to add ip addresses, vnet and service tag terraform azure

Question

So far with a help on previous topics I was able to deploy App service with IP Restriction with the following code:

Variable

locals {
ip_address_list2 = [            {     
                  ip_add : "20.20.20.3/32",
                  subnet_id = null,
                  service_tag               = null,
                  prior : "140",
                  name = "test1"
            },
           {     
                  ip_add : "10.10.10.2/32",
                  subnet_id = null,
                  service_tag               = null,
                  prior : "141",
                  name = "test2"
            },
            {
                 ip_add : "0.0.0.0/0",
                 subnet_id = null,
                 service_tag               = "AppService"
                 prior : "142",
                 name = "Service_Tag"
            }]}

App Service:

  site_config {
  dynamic "ip_restriction" {
for_each = local.ip_address_list2
  content {
    ip_address  = ip_restriction.value["ip_add"]
    action                    = "Allow"
    priority                  = ip_restriction.value["prior"]
    virtual_network_subnet_id = ip_restriction.value["subnet_id"]
    service_tag = ip_restriction.value["service_tag"]
    name = ip_restriction.value["name"]
  }}}

But if I add the following variable for the subnet I receive error:

        {
             ip_add : "0.0.0.0/0",
             subnet_id = azurerm_subnet.subnet.id,
             service_tag               = null
             prior : "143",
             name = "VirtualNetwork"
        }

Screenshot Error

Error: creating App Service "hook-service" (Resource Group "RG-DEV-TEST"): web.AppsClient#CreateOrUpdate: Failure sending request: StatusCode=0 -- Original Error: Code="BadRequest" Message="IpSecurityRestriction is invalid. Only IpAddress or VnetSubnetResourceId property must be specified." Details=[{"Message":"IpSecurityRestriction is invalid. Only IpAddress or VnetSubnetResourceId property must be specified."},{"Code":"BadRequest"},{"ErrorEntity":{"Code":"BadRequest","ExtendedCode":"51021","Message":"IpSecurityRestriction is invalid. Only IpAddress or VnetSubnetResourceId property must be specified.","MessageTemplate":"{0} is invalid. {1}","Parameters":["IpSecurityRestriction","Only IpAddress or VnetSubnetResourceId property must be specified."]}}] │ │ with azurerm_app_service.hook-service, │ on main.tf line 474, in resource "azurerm_app_service" "hook-service": │ 474: resource "azurerm_app_service" "hook-service" {

NOTE: validation with only terraform plan can be completed without error. The error is observed only after terraform apply

Thank you

Answer 1

You should use something like below:

locals {
 ip_address_list = [            {     
                  ip_add : "20.20.20.3/32",
                  prior : "140",
                  name = "test1"
            },
           {     
                  ip_add : "10.10.10.2/32",
                  prior : "141",
                  name = "test2"
            }
 ]
ip_address_list2=[            {
                 subnet = "${data.azurerm_subnet.name.id}" ,
                 name = "test3"
                 prior ="143"
            }]
            }

Then you can use :

  site_config {
    dynamic "ip_restriction"{
      for_each=local.ip_address_list
      content{
        ip_address  = ip_restriction.value["ip_add"]
    action                    = "Allow"
    priority                  = ip_restriction.value["prior"]
    name = ip_restriction.value["name"]
      }
    }
dynamic "ip_restriction"  {
  for_each = local.ip_address_list2
  content{
    name = ip_restriction.value["name"]
    virtual_network_subnet_id = ip_restriction.value["subnet"]
    priority = ip_restriction.value["prior"]
  }
}
}

Output:

Note: For IP_address restriction you have to provide ip_add , Prior and name. But for subnet restriction you have to give only subnet_id, prior and name. With providing service_tag it will error out with same error.