Terraform-provider-digitalocean: Error creating firewall: POST https://api.digitalocean.com/v2/firewalls: 422 invalid address

[Tekchanddagar]

Hello Team,
We create our droplets using terraform 0.12.20. Now we want to setup firewall rules and we try below method:

resource "digitalocean_firewall" "appserver-nyc" {
  name = "hp-app-server"

  droplet_ids = digitalocean_droplet.appnyc.*.id

  inbound_rule {
    protocol         = "tcp"
    port_range       = "911"
    source_droplet_ids = concat(["digitalocean_droplet.pfsense-sfo.id"], ["digitalocean_droplet.pfsense-sfo.id"])
  }

But getting below error:

Inappropriate value for attribute "source_droplet_ids": a number is required.

Then we provide the droplet id:

resource "digitalocean_firewall" "appserver-nyc" {
  name = "hp-app-server"

  droplet_ids = ["123456"]

  inbound_rule {
    protocol         = "tcp"
    port_range       = "911"
    source_droplet_ids = concat(["1234566"], ["123465"])
  }

Now getting below error:

Error: Error creating firewall: POST https://api.digitalocean.com/v2/firewalls: 422 (request "5d55ea94-dbd8-46dd-860a-41913479e31c") invalid address

I changes the droplet id with random numbers. Can you please help me.

We will prefer to use droplet_resource in firewall instead of specify droplet ID.

Please help me.

Thanks.

[andrewsomething]

Hi @Tekchanddagar, sorry to hear you are running into issues. I think I can see what the problem is here. In the first example, you are passing the literal strings:

source_droplet_ids = concat(["digitalocean_droplet.pfsense-sfo.id"], ["digitalocean_droplet.pfsense-sfo.id"])

Removing the quotes should resolve the issue:

source_droplet_ids = concat([digitalocean_droplet.pfsense-sfo.id], [digitalocean_droplet.pfsense-sfo.id])

In fact, you can remove the use of concat there as you are passing two individual Droplets rather than lists. concat is used to combine lists. So:

source_droplet_ids = [digitalocean_droplet.pfsense-sfo.id, digitalocean_droplet.pfsense-sfo.id]

Putting it all together, this works as expected for me:

resource "digitalocean_firewall" "appserver-nyc" {
  name = "hp-app-server"

  droplet_ids = digitalocean_droplet.appnyc.*.id

  inbound_rule {
    protocol         = "tcp"
    port_range       = "911"
    source_droplet_ids = [digitalocean_droplet.pfsense-sfo.id, digitalocean_droplet.pfsense-sfo.id]
  }
}

Hope that helps!

[Tekchanddagar]

@andrewsomething, Thank you for your helping hands.

[Tekchanddagar]

@andrewsomething,I have one more question and hope so it will be last. Earlier i passing only individual droplet. But now we need to pass the resource where we have multiple droplet.

resource "digitalocean_firewall" "etcd" {
  name = "hp-etcd"

  droplet_ids = [digitalocean_droplet.etcdnyc.*.id, digitalocean_droplet.etcdsfo.*.id]

 inbound_rule {
    protocol         = "tcp"
    port_range       = "911"
    source_droplet_ids = [digitalocean_droplet.pfsense-nyc.id, digitalocean_droplet.pfsense-sfo.id]
  }
 inbound_rule {
    protocol         = "tcp"
    port_range       = "9100"
    source_droplet_ids = [digitalocean_droplet.pfsense-nyc.id]
}
}

Now i am getting below error:

Error: Incorrect attribute value type

  on hp-code.tf line 337, in resource "digitalocean_firewall" "etcd":
 337:   droplet_ids = concat([digitalocean_droplet.etcdnyc.*.id], [digitalocean_droplet.etcdsfo.*.id])
    |----------------
    | digitalocean_droplet.etcdnyc is tuple with 2 elements
    | digitalocean_droplet.etcdsfo is tuple with 1 element

Inappropriate value for attribute "droplet_ids": element 0: number required.

Can you please help me.

Thanks.

[Tekchanddagar]

Hello Team,

I am able to fix this issue using below method:

inbound_rule {
    protocol         = "tcp"
    port_range       = "8008"
    source_droplet_ids = [digitalocean_droplet.eva-db-nyc[0].id, digitalocean_droplet.eva-db-nyc[1].id, digitalocean_droplet.evadb-sfo[0].id, digitalocean_droplet.eva-app-nyc[0].id, digitalocean_droplet.db-ha-nyc[0].id]
}

But the problem is that we need to define index for each droplet. Currently infra is very small but it will create issue when infra will grow.

Because it will be difficult to define each droplet with index value like i defined.

Can you please suggest me some other way to do this?

Any help will be appriciated.

Thanks.

[Tekchanddagar]

Hello Team,

Can you please help me on above issue?

Thanks.

[andrewsomething]

@Tekchanddagar, this is an instance where using concat will do what you want it to.

digitalocean_droplet.eva-db-nyc.*.id outputs a list of Droplet IDs. Using concat, you can join multiple lists. For example:

source_droplet_ids = concat(digitalocean_droplet.eva-db-nyc.*.id, digitalocean_droplet.evadb-sfo.*.id)

See the main Terraform docs for info on how to use concat and other built-in functions:

https://www.terraform.io/docs/configuration/functions/concat.html

Here's a fuller example:

resource "digitalocean_droplet" "eva-db-nyc" {
   name   = "eva-db-nyc-${count.index}"
   size   = "s-1vcpu-1gb"
   image  = "ubuntu-18-04-x64"
   region = "nyc3"
   count  = 2
}

resource "digitalocean_droplet" "evadb-sfo" {
   name   = "evadb-sfo-${count.index}"
   size   = "s-1vcpu-1gb"
   image  = "ubuntu-18-04-x64"
   region = "sfo2"
   count  = 2
}

resource "digitalocean_droplet" "etcdnyc" {
   name   = "evadb-sfo-${count.index}"
   size   = "s-1vcpu-1gb"
   image  = "ubuntu-18-04-x64"
   region = "nyc3"
   count  = 2
}

resource "digitalocean_firewall" "etcd" {
  name = "hp-etcd"

  droplet_ids = digitalocean_droplet.etcdnyc.*.id

  inbound_rule {
    protocol         = "tcp"
    port_range       = "8008"
    source_droplet_ids = concat(digitalocean_droplet.eva-db-nyc.*.id, digitalocean_droplet.evadb-sfo.*.id)
  }
}