将多个私有子网附加到每个地形的路由表中

Question

我在VPC中建立了公用和专用子网，分别用创建。我现在正试图为子网和nat网关创建路由表，专门用于访问私有实例。我的子网、路由表和公用子网关联工作正常。我在将我的私有子网连接到将其连接到NAT网关的路由表时遇到问题。我相信我的逻辑是正确的。我的NAT网关位于我的公共子网中。唯一的问题是专用子网连接到连接到NAT网关的路由表。以下是我的代码，任何建议都将不胜感激。

resource "aws_route_table" "public" {
for_each = var.pub_subnet
vpc_id   = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.main.id
}
tags = {
Name = var.rt_tags
}
}
resource "aws_route_table_association" "public" {
for_each       = aws_subnet.public
route_table_id = aws_route_table.public[each.key].id
subnet_id      = each.value.id
}
resource "aws_route_table_association" "nat" {
for_each       = aws_subnet.private
route_table_id = aws_route_table.nat[each.key].id
subnet_id      = each.value.id
}
resource "aws_route_table" "nat" {
for_each = var.pub_subnet
vpc_id   = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_nat_gateway.main[each.key].id
}
tags = {
Name = var.rt_tags_private
}
}
resource "aws_subnet" "public" {
for_each                = var.pub_subnet
vpc_id                  = aws_vpc.main.id
cidr_block              = each.value.cidr_block
availability_zone       = each.value.availability_zone
map_public_ip_on_launch = true
tags = {
Name = each.key
}
}
resource "aws_subnet" "private" {
for_each                = var.priv_subnet
vpc_id                  = aws_vpc.main.id
cidr_block              = each.value.cidr_block
availability_zone       = each.value.availability_zone
map_public_ip_on_launch = false
tags = {
Name = each.key
}
}

变量

variable "pub_subnet" {
type = map(object({
cidr_block        = string
availability_zone = string
}))
default = {
"PubSub1" = {
cidr_block        = "10.0.1.0/24"
availability_zone = "us-west-1a"
}
}
}
variable "priv_subnet" {
type = map(object({
cidr_block        = string
availability_zone = string
}))
default = {
"PrivSub1" = {
cidr_block        = "10.0.2.0/24"
availability_zone = "us-west-1c"
}
}
}

错误

Error: Invalid index
on vpc.tf line 61, in resource "aws_route_table_association" "nat":
61:   route_table_id = aws_route_table.nat[each.key].id
|----------------
| aws_route_table.nat is object with 1 attribute "PubSub1"
| each.key is "PrivSub1"
The given key does not identify an element in this collection value.

NAT网关

resource "aws_nat_gateway" "main" {
for_each      = aws_subnet.public
subnet_id     = each.value.id
allocation_id = aws_eip.main[each.key].id
}

EIP

resource "aws_eip" "main" {
for_each = aws_subnet.public
vpc      = true
lifecycle {
create_before_destroy = true
}
}

Answer 1

您正在使用var.pub_subnet为nat定义路由表，其形式为：

"PubSub1" = {
cidr_block        = "10.0.1.0/24"
availability_zone = "us-west-1a"
}

因此，要引用aws_route_table，必须使用PubSub1密钥。

然而，在您的aws_route_table_association中，您正在对具有PrivSub1密钥的aws_subnet.private进行迭代。

更新

该问题可以通过为private=>公用子网名称，例如：

locals {
private_public_mapping = zipmap(keys(var.priv_subnet), keys(var.pub_subnet))
}
resource "aws_route_table_association" "nat" {
for_each       = aws_subnet.private
route_table_id = aws_route_table.nat[local.private_public_mapping[each.key]].id
subnet_id      = each.value.id
}