feat: validate CIDR format on allowed_cidrs in all tier modules

modules/ha-hot-hot/aws/variables.tf

@@ -35,6 +35,10 @@ variable "private_subnet_ids" {
 variable "allowed_cidrs" {
   description = "CIDR blocks permitted to reach the ALB on port 443."
   type        = list(string)
+  validation {
+    condition     = alltrue([for cidr in var.allowed_cidrs : can(cidrhost(cidr, 0))])
+    error_message = "Every entry in allowed_cidrs must be a valid CIDR notation (e.g. 10.0.0.0/8)."
+  }
 }
 
 variable "acm_certificate_arn" {

modules/ha-hot-hot/azure/variables.tf

@@ -38,6 +38,10 @@ variable "lb_subnet_id" {
 
 variable "allowed_cidrs" {
   type = list(string)
+  validation {
+    condition     = alltrue([for cidr in var.allowed_cidrs : can(cidrhost(cidr, 0))])
+    error_message = "Every entry in allowed_cidrs must be a valid CIDR notation (e.g. 10.0.0.0/8)."
+  }
 }
 
 variable "admin_username" {

modules/single-vm/aws/variables.tf

@@ -22,6 +22,10 @@ variable "subnet_id" {
 variable "allowed_cidrs" {
   description = "CIDR blocks permitted to reach the VM on port 443. Use private CIDRs unless you also set allow_internet_ingress = true."
   type        = list(string)
+  validation {
+    condition     = alltrue([for cidr in var.allowed_cidrs : can(cidrhost(cidr, 0))])
+    error_message = "Every entry in allowed_cidrs must be a valid CIDR notation (e.g. 10.0.0.0/8)."
+  }
 }
 
 # ----- Optional -----

modules/single-vm/azure/variables.tf

@@ -27,6 +27,10 @@ variable "subnet_id" {
 variable "allowed_cidrs" {
   description = "CIDR blocks permitted to reach the VM on port 443."
   type        = list(string)
+  validation {
+    condition     = alltrue([for cidr in var.allowed_cidrs : can(cidrhost(cidr, 0))])
+    error_message = "Every entry in allowed_cidrs must be a valid CIDR notation (e.g. 10.0.0.0/8)."
+  }
 }
 
 variable "admin_username" {

modules/unlimited-scale/aws/variables.tf

@@ -30,6 +30,10 @@ variable "private_subnet_ids" {
 
 variable "allowed_cidrs" {
   type = list(string)
+  validation {
+    condition     = alltrue([for cidr in var.allowed_cidrs : can(cidrhost(cidr, 0))])
+    error_message = "Every entry in allowed_cidrs must be a valid CIDR notation (e.g. 10.0.0.0/8)."
+  }
 }
 
 variable "acm_certificate_arn" {

modules/unlimited-scale/azure/variables.tf

@@ -13,7 +13,13 @@ variable "location" { type = string }
 variable "vm_subnet_id" { type = string }
 variable "db_delegated_subnet_id" { type = string }
 variable "private_dns_zone_id" { type = string }
-variable "allowed_cidrs" { type = list(string) }
+variable "allowed_cidrs" {
+  type = list(string)
+  validation {
+    condition     = alltrue([for cidr in var.allowed_cidrs : can(cidrhost(cidr, 0))])
+    error_message = "Every entry in allowed_cidrs must be a valid CIDR notation (e.g. 10.0.0.0/8)."
+  }
+}
 variable "admin_username" { type = string }
 variable "ssh_public_key" { type = string }