Add CIDR validation to allowed_cidrs across all six core tier modules

[dmchaledev]

Problem

allowed_cidrs is a required input on every tier module, but it accepted any list(string). A one-character typo — "10.0.0/8" instead of "10.0.0.0/8" — passes terraform validate and tflint with no complaint, then fails at terraform apply with a cryptic AWS/Azure provider error deep in the resource graph. The operator has to read a provider stack trace to discover the input was malformed.

Fix

Add a validation block to allowed_cidrs in all six core tier modules using the standard can(cidrhost(c, 0)) idiom, which Terraform evaluates at plan time before any API calls:

validation {
  condition     = alltrue([for c in var.allowed_cidrs : can(cidrhost(c, 0))])
  error_message = "Each entry in allowed_cidrs must be a valid CIDR block (e.g. 10.0.0.0/8)."
}

can(cidrhost(c, 0)) validates both IPv4 and IPv6 CIDR notation. It accepts 0.0.0.0/0 (internet ingress opt-in) and rejects anything that isn't parseable as a network prefix.

Scope

Changed files — one per core tier module, both clouds:

Module	File
single-vm/aws	modules/single-vm/aws/variables.tf
single-vm/azure	modules/single-vm/azure/variables.tf
ha-hot-hot/aws	modules/ha-hot-hot/aws/variables.tf
ha-hot-hot/azure	modules/ha-hot-hot/azure/variables.tf
unlimited-scale/aws	modules/unlimited-scale/aws/variables.tf
unlimited-scale/azure	modules/unlimited-scale/azure/variables.tf

The twelve product-prefixed wrappers (asm-aws-single, sat-azure-ha, etc.) forward var.allowed_cidrs directly to the core module, so the validation fires for callers of the public API modules without any wrapper changes.

Impact

• No breaking change — all existing valid CIDR inputs continue to work.
• Earlier, clearer errors — malformed CIDRs now fail at terraform plan with "Each entry in allowed_cidrs must be a valid CIDR block (e.g. 10.0.0.0/8)." instead of at apply with a provider error.
• unlimited-scale/azure and ha-hot-hot/azure variables also received a missing description field to match the style of the other modules.

Test plan

• terraform validate passes on all six modules (CI gate)
• tflint passes (CI gate)
• Existing examples still validate (examples matrix in CI)
• Manual: terraform plan with allowed_cidrs = ["10.0.0/8"] produces the new validation error message before any provider calls

---

Generated by Claude Code