Terraform/HCL in Azure issues

Question

I am new to HCL and Terraform and have having issues with associating a security group and a backend address pool to the network interface. I am creating 2 network interfaces in a single network interface block:

#Create network interface for 2 VMs
resource "azurerm_network_interface" "FrontNetworkInterface" {
    count = 2
    name = "niFront${count.index}"
    location = azurerm_resource_group.PWSDevResourceGroup.location
    resource_group_name = azurerm_resource_group.PWSDevResourceGroup.name

    ip_configuration {
        name = "ipconfFrontVM"
        subnet_id = azurerm_subnet.PWSDevSubnet.id
        private_ip_address_allocation = "dynamic"
    }
}

I have tried associating in various ways that have produced different errors:

ATTEMPT 1:

#Connect security group to the network interface
resource "azurerm_network_interface_security_group_association" "PWSDevSecurityGroupAssoc" {
    network_interface_id = azurerm_network_interface.FrontNetworkInterface.id
    network_security_group_id = azurerm_network_security_group.PWSDevSecurityGroup.id
}

#Connect 2 backend ips to the load balancer
resource "azurerm_network_interface_backend_address_pool_association" "BackendIPAssoc" {
    network_interface_id = azurerm_network_interface.FrontNetworkInterface.id
    ip_configuration_name = "bipa"
    backend_address_pool_id = azurerm_lb_backend_address_pool.BackendIpPool.id
}

ERRORS:

Error: Missing resource instance key on front.tf line 85, in resource "azurerm_network_interface_security_group_association" "PWSDevSecurityGroupAssoc": 85: network_interface_id = azurerm_network_interface.FrontNetworkInterface.id Because azurerm_network_interface.FrontNetworkInterface has "count" set, its attributes must be accessed on specific instances. For example, to correlate with indices of a referring resource, use: azurerm_network_interface.FrontNetworkInterface[count.index]

Error: Missing resource instance key on front.tf line 91, in resource "azurerm_network_interface_backend_address_pool_association" "BackendIPAssoc": 91: network_interface_id = azurerm_network_interface.FrontNetworkInterface.id Because azurerm_network_interface.FrontNetworkInterface has "count" set, its attributes must be accessed on specific instances. For example, to correlate with indices of a referring resource, use: azurerm_network_interface.FrontNetworkInterface[count.index]

ATTEMPT 2/3/4 (Using "[count.index]", "[count.index].id", or "[element(azurerm_network_interface.FrontNetworkInterface.*.id, count.index)]" as described in the previous error):

#Connect security group to the network interface
resource "azurerm_network_interface_security_group_association" "PWSDevSecurityGroupAssoc" {
    network_interface_id = azurerm_network_interface.FrontNetworkInterface[count.index]
    network_security_group_id = azurerm_network_security_group.PWSDevSecurityGroup.id
}

#Connect 2 backend ips to the load balancer
resource "azurerm_network_interface_backend_address_pool_association" "BackendIPAssoc" {
    network_interface_id = azurerm_network_interface.FrontNetworkInterface[count.index]
    ip_configuration_name = "bipa"
    backend_address_pool_id = azurerm_lb_backend_address_pool.BackendIpPool.id
}

ERROR (Same result for [count.index].id and [element(azurerm_network_interface.FrontNetworkInterface.*.id, count.index)]):

Error: Reference to "count" in non-counted context on front.tf line 85, in resource "azurerm_network_interface_security_group_association" "PWSDevSecurityGroupAssoc": 85: network_interface_id = azurerm_network_interface.FrontNetworkInterface[count.index] The "count" object can only be used in "module", "resource", and "data" blocks, and only when the "count" argument is set.

Error: Reference to "count" in non-counted context front.tf line 91, in resource "azurerm_network_interface_backend_address_pool_association" "BackendIPAssoc": network_interface_id = azurerm_network_interface.FrontNetworkInterface[count.index] The "count" object can only be used in "module", "resource", and "data" blocks, and only when the "count" argument is set.

Also, I am receiving this error on my azurerm_virtual_machine block:

line 162, in resource "azurerm_virtual_machine" "FrontEndVirtualMachines": 162: admin_ssh_key { Blocks of type "admin_ssh_key" are not expected here.

I am following what is shown here:

https://docs.microsoft.com/en-us/azure/developer/terraform/create-linux-virtual-machine-with-infrastructure

As you can see, the admin_ssh_key block is provided. I tried using version 2.0 as used in the scripts; however, I experienced the same result.

Thanks for your help!! :)

Answer 1

I will admit that I haven't read the whole story, but it looks like your attempt #2/3/4 was pretty close. Where you use [count.index], you need to specify a count, otherwise there's no count to index. So if you just add count = 2 to those two resource blocks, it should work.

Better yet, either have the 2 as a variable, or use

count = len(azurerm_network_interface.FrontNetworkInterface)

to ensure you don't end up with mismatched numbers when you change the 2 later on.

Answer 2

When referencing a resource created with count you still need to add the .id. See the following example. For more information see this link.

provider "azurerm" {
  version = "~>2.23.0"
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "East US"
}

resource "azurerm_virtual_network" "example" {
  name                = "vnet"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["10.0.0.0/16"]
  dns_servers         = ["10.0.0.4", "10.0.0.5"]
}

resource "azurerm_subnet" "example" {
  name                 = "example"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_network_interface" "example" {
  count               = 2
  name                = format("int%s", count.index)
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  ip_configuration {
    name                          = "ip"
    subnet_id                     = azurerm_subnet.example.id
    private_ip_address_allocation = "dynamic"
  }
}

resource "azurerm_network_security_group" "example" {
  name                = "acceptanceTestSecurityGroup1"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  security_rule {
    name                       = "test123"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

resource "azurerm_network_interface_security_group_association" "secgroup" {
  count                     = length(azurerm_network_interface.example)
  network_interface_id      = azurerm_network_interface.example[count.index].id
  network_security_group_id = azurerm_network_security_group.example.id
}