title: Struggling to automate terraform WAF
body: <p>I'm trying to terraform WAF ACL and associated rules. The terraform stack I'm working on is identical in DEV, QA , and PROD, differences are all handled using different variables. So my idea is to store a list of CIDRs in a variable, and automatically create ALLOW rules for each. My limited knowledge is slowing me down though. It creates the ipsets perfectly, but the rules and ACL complain, </p>
  
  <pre><code>variable cloud_allowed_cidr_list = {type="list" default=["1.2.3.4/32","4.3.2.1/32"]}
  
  resource "aws_waf_ipset" "ipset" {
    count = "${length(var.cloud_allowed_cidr_list)}"
    name = "ipset-${count.index}"
  
    ip_set_descriptors {
      type  = "IPV4"
      value = "${element(var.cloud_allowed_cidr_list, count.index)}"
    }
  }
  
  
  resource "aws_waf_rule" "matchIPrule" {
    count = "${length(var.cloud_allowed_cidr_list)}"
    depends_on  = ["aws_waf_ipset.ipset"]
    name        = "matchMancIPrule${count.index}"
    metric_name = "matchMancIPrule${count.index}"
  
    predicates {
      data_id = "${aws_waf_ipset.ipset.*.id}"
      negated = false
      type    = "IPMatch"
    }
  }
  
  
  resource "aws_waf_web_acl" "waf_acl" {
    depends_on  = ["aws_waf_ipset.ipset", "aws_waf_rule.matchIPrule"]
    name        = "mancACL${count.index}"
    metric_name = "mancACL${count.index}"
  
    default_action {
      type = "BLOCK"
    }
  
    rules {
      action {
        type = "ALLOW"
      }
  
      priority = "${count.index}"
      rule_id  = "${aws_waf_rule.matchIPrule.id}"
      type     = "REGULAR"
    }
  }
  </code></pre>
  
  <p>It fell apart when I realised that rules have multiple predicates, and the ACL has multiple rules .....how do you create that dynamically ? If anyone has any examples of doing something similar I'd be very grateful.</p>