Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provider returns both IPv4 and IPv6 IPs as an array causing terraform security group resource to fail #883

Closed
davidg-sainsbury opened this issue Aug 18, 2021 · 3 comments · Fixed by #884
Labels
d/ip_ranges Type: Bug Something isn't working as documented

Comments

@davidg-sainsbury
Copy link

Terraform Version

Terraform v0.15.4

Affected Resource(s)

terraform resource "aws_security_group"

Terraform Configuration Files

module..

data "github_ip_ranges" "gha_runner_scaling_api" {}

resource "aws_security_group" "gha_runner_scaling_api" {
  name                   = "gha-runners_api"
  description            = "Allow traffic to GHA Scaling runner API Gateway"
  vpc_id                 = var.vpc_id
  revoke_rules_on_delete = true

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = data.github_ip_ranges.gha_runner_scaling_api.hooks
    description = "HTTPS access from Github API"
  }

plan...
resource "aws_security_group" "gha_runner_scaling_api" {
        id                     = "sg-0415fc1dd10896cd0"
      ~ ingress                = [
          + {
              + cidr_blocks      = [
                  + "192.30.252.0/22",
                  + "140.82.112.0/20",
                  + "143.55.64.0/20",
                  + "185.199.108.0/22",
                  + "2a0a:a440::/29",
                  + "2606:50c0::/32",
                ]
              + description      = "HTTPS access from Github API"
              + from_port        = 443
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 443
            }

error..

Error authorizing security group ingress rules: InvalidParameterValue: CIDR block 2a0a:a440::/29 is malformed

Expected Behavior

The provider to handle separately both IPV4 and IPV6 addresses.

Actual Behavior

Error authorizing security group ingress rules: InvalidParameterValue: CIDR block 2a0a:a440::/29 is malformed

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

  1. terraform apply
@davidg-sainsbury davidg-sainsbury changed the title Provider returns both IPv4 and IPv6 as an array causing terraform security group resource to fail Provider returns both IPv4 and IPv6 IPs as an array causing terraform security group resource to fail Aug 18, 2021
rymir added a commit to rymir/terraform-provider-github that referenced this issue Aug 18, 2021
rymir added a commit to rymir/terraform-provider-github that referenced this issue Aug 18, 2021
rymir added a commit to rymir/terraform-provider-github that referenced this issue Aug 18, 2021
rymir added a commit to rymir/terraform-provider-github that referenced this issue Aug 18, 2021
@mattes-mms
Copy link

H, when there will be a fix for this pls.? Thx...

@martinmosegaard
Copy link

martinmosegaard commented Aug 20, 2021

Perhaps you can do something like this as a workaround:

cidr_blocks      = [for block in data.github_ip_ranges.gha_runner_scaling_api.hooks : block if length(regexall("::", block)) == 0]
ipv6_cidr_blocks = [for block in data.github_ip_ranges.gha_runner_scaling_api.hooks : block if length(regexall("::", block)) > 0]

@jiba21
Copy link

jiba21 commented Aug 23, 2021

This issue is also in other versions. I'm using terraform 0.13

@jcudit jcudit added Type: Bug Something isn't working as documented d/ip_ranges labels Aug 31, 2021
fredericfran-gds added a commit to alphagov/govuk-aws that referenced this issue Sep 20, 2021
The GitHub provider is returning IPv6 IPs in addition to IPv4
IPs for the hooks. This is not compatible with AWS security
rules which require IPv4 and IPv6 IPs to be seperate.

This is a [fixed bug](integrations/terraform-provider-github#883)
in 4.14 version of the provider.
fredericfran-gds added a commit to alphagov/govuk-aws that referenced this issue Sep 20, 2021
The GitHub provider is returning IPv6 IPs in addition to IPv4
IPs for the hooks. This is not compatible with AWS security
rules which require IPv4 and IPv6 IPs to be seperate.

This is a [fixed bug](integrations/terraform-provider-github#883)
in 4.14 version of the provider.
kfcampbell pushed a commit to kfcampbell/terraform-provider-github that referenced this issue Jul 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
d/ip_ranges Type: Bug Something isn't working as documented
Projects
None yet
5 participants