Maintainable Terraform CIDR lists


Your Terraform config requires managing many CIDRs that control firewall ingress rules. You’ve been storing these in a CSV string:

variable "client_cidrs" {

which is fed to a aws_security_group somewhere in your configuration.

The CIDRs change frequently and maintaining this variable is difficult as it’s hard to track where each individual CIDR came from.


Use a HCL list variable which allows each entry to have an associated comment explaining what the CIDR corresponds to:

variable "client_cidrs" {
        "", # London office
        "", # Sydney office

If you need to pass these values around as a CSV string, use locals to join the list entries:

locals {
    ingress_cidrs = "${join(",", var.client_cidrs)}"

but prefer to pass list-type variables around instead.


Something wrong? Suggest an improvement or add a comment (see article history)
Tagged with: terraform
Filed in: tips

Previous: Easy Github URLs from Vim
Next: Conditional nested blocks in Terraform

Copyright © 2005-2020 David Winterbottom
Content licensed under CC BY-NC-SA 4.0.