feat: Remove prefix_list_ids attribute from _with_cidr_blocks & specific prefix list for each rules on _with_prefix_list_ids

titouan-joseph commented 4 months ago

Description

aws_security_group_rule with both resources with cidr blocks and non-empty prefix_list_ids generates multiple entry on the rules (cidr blocks + prefix lists)
*_with_prefix_list_ids variables don't take in count the prefix_list_ids in the list of rules see example bellow

module "prefix_list" {
  source = "../../"

  name        = "pl-sg"
  description = "Security group with prefix list"
  vpc_id      = data.aws_vpc.default.id

  ingress_with_prefix_list_ids = [
    {
      from_port       = 9100
      to_port         = 9100
      protocol        = 6 # "tcp"
      description     = "Arbitrary TCP port"
      prefix_list_ids = join(",", ["pl-a", "pl-b"])  # => empty list on the plan
    },
  ]
}

Motivation and Context

Able to create rules with specific prefix list for each rules

Breaking Changes

No more prefix list on the ressources *_with_cidr_blocks

How Has This Been Tested?

[x] I have updated at least one of the examples/* to demonstrate and validate my change(s)
[x] I have tested and validated these changes using one or more of the provided examples/* projects
[x] I have executed pre-commit run -a on my pull request

titouan-joseph commented 4 months ago

@bryantbiggs @antonbabenko One of you can watch this MR. Thank you

AtanasovMarin commented 3 months ago

@bryantbiggs @antonbabenko Is there any progress on this MR?

bryantbiggs commented 3 months ago

just at a glance, I don't think this is an appropriate change. I think we should follow the upstream provider and use the aws_vpc_security_group_ingress_rule/aws_vpc_security_group_egress_rule resources which would mitigate this issue. However, that would be a breaking change and quite a refactor.

In the short term - you can split out your rules to one CIDR blocker per rule entry which should resolve your diff issue