title: How to attach multiple security groups to RDS and Elasticache Redis with Terraform
body: <p>I want to attach multiple security groups to my RDS and Elasticache instances, I somehow didn't manage to do it and I didn't quite understand why,</p>
  <p>Basically, I'm trying to combine two security group id outputs from two different places and assign them to my RDS and Elasticache.</p>
  <p>But it keeps giving the error below,
  I tried to do it with concat(), flatten(),toset() and tolist() functions but it doesn't help. Terraform documentation says multiple security groups can be given as a list but I couldn't make it work.</p>
  <pre><code>Error: Incorrect attribute value type
  
    on modules/aws/elasticache-redis/main.tf line 26, in resource &quot;aws_elasticache_replication_group&quot; &quot;elasticache-redis&quot;:
    26:   security_group_ids   = [var.security_group_ids]
      |----------------
      | var.security_group_ids is tuple with 2 elements
  
  Inappropriate value for attribute &quot;security_group_ids&quot;: element 0: string
  required.
  
  
  Error: Incorrect attribute value type
  
    on modules/aws/rds-mysql/main.tf line 26, in resource &quot;aws_db_instance&quot; &quot;rds-mysql&quot;:
    26:   vpc_security_group_ids          = [var.security_group]
      |----------------
      | var.security_group is tuple with 2 elements
  
  Inappropriate value for attribute &quot;vpc_security_group_ids&quot;: element 0: string
  required.
  </code></pre>
  <p>Here my files,</p>
  <p>main.tf</p>
  <pre><code>module &quot;example-module&quot; {
    source = &quot;./modules/example-module&quot;
  
    environment                          = var.environment
    private_subnet_ids                   = module.vpc.private_subnet_ids
    rds_mysql_security_group             = [module.common-rds-mysql-security-group.security_group_id, module.security-group.rds-mysql-security-group]
    elasticache_redis_security_group_ids = [module.common-elasticache-redis-security-group.security_group_id, module.security-group.elasticache-redis-security-group]
    aws_sns_topic_arn                    = module.sns-system-notification-topic.topic_arn
   
  
    depends_on = [module.vpc, module.sns-system-notification-topic]
  }
  </code></pre>
  <p>my example-module module;</p>
  <pre><code>module &quot;rds-mysql&quot; {
    source = &quot;../../aws/rds-mysql&quot;
  
    identifier = &quot;${var.environment}-${var.svc_name}&quot;
  
    engine_version    = var.rds_mysql_engine_version
    instance_class    = var.rds_mysql_instance_class
    allocated_storage = var.rds_mysql_allocated_storage
    storage_type      = var.rds_mysql_storage_type
  
    name     = var.rds_mysql_name
    username = var.rds_mysql_username
    password = var.rds_mysql_password
    port     = var.rds_mysql_port
  
    parameter_group_name = var.rds_mysql_parameter_group_name
    security_group       = var.rds_mysql_security_group
  
    private_subnet_ids       = var.private_subnet_ids
    subnet_group_name        = &quot;${var.environment}-${var.svc_name}-rds-mysql-subnet-group&quot;
    subnet_group_description = &quot;${var.environment}-${var.svc_name}-rds-mysql-subnet-group&quot;
  
    auto_minor_version_upgrade      = var.rds_mysql_auto_minor_version_upgrade
    enabled_cloudwatch_logs_exports = var.rds_mysql_enabled_log_types
    publicly_accessible             = var.rds_mysql_publicly_accessible
    skip_final_snapshot             = var.rds_mysql_skip_final_snapshot
    maintenance_window              = var.rds_mysql_maintenance_window
    backup_retention_period         = var.rds_mysql_backup_retention_period
    backup_window                   = var.rds_mysql_backup_window
    copy_tags_to_snapshot           = var.rds_mysql_copy_tags_to_snapshot
    deletion_protection             = var.rds_mysql_deletion_protection
    multi_az                        = var.rds_mysql_multi_az
    enable_slave                    = var.rds_mysql_enable_slave
    slave_count                     = var.rds_mysql_slave_count
  
    tags = {
      Environment = &quot;${var.environment}-${var.svc_name}&quot;
      Name        = &quot;${var.environment}-${var.svc_name}-rds-mysql&quot;
    }
  }
  
  module &quot;elasticache-redis&quot; {
    source = &quot;../../aws/elasticache-redis&quot;
  
    replication_group_id          = &quot;${var.environment}-${var.svc_name}&quot;
    replication_group_description = &quot;${var.environment}-${var.svc_name}&quot;
  
    engine_version = var.elasticache_redis_engine_version
    port           = var.elasticache_redis_port
  
    number_cache_clusters = var.elasticache_redis_number_cache_clusters
    node_type             = var.elasticache_redis_node_type
  
    notification_topic_arn = var.elasticache_event_alerts_topic_arn
  
    parameter_group_name = var.elasticache_redis_parameter_group_name
    security_group_ids   = var.elasticache_redis_security_group_ids
    subnet_group_name    = &quot;${var.environment}-${var.svc_name}-redis-subnet-group&quot;
    private_subnet_ids   = var.private_subnet_ids
  
    auto_minor_version_upgrade = var.elasticache_redis_auto_minor_version_upgrade
    maintenance_window         = var.elasticache_redis_maintenance_window
    snapshot_window            = var.elasticache_redis_snapshot_window
    snapshot_retention_limit   = var.elasticache_redis_snapshot_retention_limit
  
    tags = {
      Environment = &quot;${var.environment}-${var.svc_name}&quot;
      Name        = &quot;${var.environment}-${var.svc_name}-redis&quot;
    }
  }
  </code></pre>
  <p>And finally,my RDS and Elasticache Modules,</p>
  <pre><code>resource &quot;aws_elasticache_replication_group&quot; &quot;elasticache-redis&quot; {
    automatic_failover_enabled    = var.automatic_failover_enabled
    availability_zones            = [data.aws_availability_zones.available.names[0]]
    replication_group_id          = var.replication_group_id
    replication_group_description = var.replication_group_description
  
    engine         = var.engine
    engine_version = var.engine_version
    port           = var.port
  
    number_cache_clusters = var.number_cache_clusters
    node_type             = var.node_type
  
    notification_topic_arn = var.notification_topic_arn
  
    parameter_group_name = var.parameter_group_name
    security_group_ids   = [var.security_group_ids]
    subnet_group_name    = aws_elasticache_subnet_group.elasticache-redis-subnet-group.id
  
    auto_minor_version_upgrade = var.auto_minor_version_upgrade
    maintenance_window         = var.maintenance_window
    snapshot_window            = var.snapshot_window
    snapshot_retention_limit   = var.snapshot_retention_limit
    tags                       = var.tags
  
    lifecycle {
      ignore_changes = [
        availability_zones
      ]
    }
  }
  </code></pre>
  <pre><code>resource &quot;aws_db_instance&quot; &quot;rds-mysql&quot; {
    identifier = var.identifier
  
    availability_zone = data.aws_availability_zones.available.names[0]
    engine            = var.engine
    engine_version    = var.engine_version
    instance_class    = var.instance_class
    allocated_storage = var.allocated_storage
    storage_type      = var.storage_type
  
    name     = var.name
    username = var.username
    password = var.password
    port     = var.port
  
    parameter_group_name            = var.parameter_group_name
    db_subnet_group_name            = aws_db_subnet_group.rds-mysql-subnet-group.id
    vpc_security_group_ids          = [var.security_group]
    enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports
  
    auto_minor_version_upgrade = var.auto_minor_version_upgrade
    publicly_accessible        = var.publicly_accessible
    skip_final_snapshot        = var.skip_final_snapshot
    maintenance_window         = var.maintenance_window
    backup_retention_period    = var.backup_retention_period
    backup_window              = var.backup_window
    copy_tags_to_snapshot      = var.copy_tags_to_snapshot
    deletion_protection        = var.deletion_protection
    multi_az                   = var.multi_az
  
    apply_immediately = true
  
    tags = var.tags
  
    lifecycle {
      ignore_changes = [
        availability_zone
      ]
    }
  }
  
  resource &quot;aws_db_instance&quot; &quot;rds-mysql-slave&quot; {
    count = var.enable_slave ? var.slave_count : 0
  
    identifier = &quot;${var.identifier}-${count.index + 1}&quot;
  
    engine            = var.engine
    engine_version    = var.engine_version
    instance_class    = var.instance_class
    allocated_storage = var.allocated_storage
    storage_type      = var.storage_type
  
    name     = var.name
    username = var.username
    password = var.password
    port     = var.port
  
    parameter_group_name   = var.parameter_group_name
    vpc_security_group_ids = [var.security_group]
  
    replicate_source_db = aws_db_instance.rds-mysql.identifier
  
    auto_minor_version_upgrade      = var.auto_minor_version_upgrade
    enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports
    publicly_accessible             = var.publicly_accessible
    skip_final_snapshot             = var.skip_final_snapshot
    maintenance_window              = var.maintenance_window
    backup_retention_period         = var.backup_retention_period
    backup_window                   = var.backup_window
    copy_tags_to_snapshot           = var.copy_tags_to_snapshot
    deletion_protection             = var.deletion_protection
    multi_az                        = var.multi_az
  
    tags = var.tags
  }
  </code></pre>
  <p>My security group outputs ;</p>
  <pre><code>RDS 1 :
  output &quot;rds-mysql-security-group&quot; {
      value = aws_security_group.rds-mysql-security-group.id
  }
  Elasticache 1 :
  output &quot;elasticache-redis-security-group&quot; {
      value = aws_security_group.elasticache-redis-security-group.id
  }
  RDS 2 :
  output &quot;security_group_id&quot; {
      value = module.rds-mysql-security-group.security_group_id
  }
  Elasticache 2 :
  output &quot;security_group_id&quot; {
      value = module.elasticache-redis-security-group.security_group_id
  }
  </code></pre>
  <p>The outputs above should combine as one list in the main.tf and be inherited by child module.</p>
  <p>Any help will be highly appreciated,
  Thank you very much.</p>