Terraform项目将创建VPC/IGW、VPN和带有NATGW的私有子网-Connectivity Analyzer

Question

https://github.com/phillhocking/aws-network-vpn/tree/1000

我已经试图弄清楚这一点很长一段时间了，我真的很难理解为什么这些组件不能相互通信。VPC有一个IGW，这是NATGW的EIP所必需的，但是，这个子网上的任何东西都不能进入公共互联网。VPN链路上一切正常，但连接分析器指示NATGW和IGW之间没有连接，因为没有路由-如果没有已经分配给该子网的NATGW的0.0.0.0/0路由，我如何将NATGW流量路由到IGW？

连接分析器-路由表没有到IGW 的路由

我知道我只是错过了一些简单的东西。看看repo，了解整个事情是如何结合在一起的，但这里是VPC模块：

data "aws_availability_zones" "available" {
state = "available"
}
resource "aws_vpc" "main" {
cidr_block            = var.cidr_block
enable_dns_hostnames  = true
enable_dns_support    = true
tags = {
Name = var.vpc_name
}
}
resource "aws_subnet" "dev" {
count = var.subnet_count
# This line is necessary to ensure that we pick availabiltiy zones that can launch any size ec2 instance
availability_zone = data.aws_availability_zones.available.names[0]
vpc_id            = aws_vpc.main.id
cidr_block        = cidrsubnet(var.cidr_block, 6, count.index * 2 + 1)

tags = {
Name = "dev-subnet-${count.index}"
}
}
resource "aws_network_acl" "dev" {
vpc_id     = aws_vpc.main.id
subnet_ids = aws_subnet.dev[*].id
ingress {
protocol   = -1
rule_no    = 1000
action     = "allow"
#cidr_block = var.prem_network_address_space
cidr_block = "0.0.0.0/0"
from_port  = 0
to_port    = 0
}
egress {
protocol   = -1
rule_no    = 100
action     = "allow"
cidr_block = "0.0.0.0/0"
from_port  = 0
to_port    = 0
}
tags = {
Name = "dev-acl"
}
}
# Gateways
resource "aws_internet_gateway" "gw" {
vpc_id = aws_vpc.main.id
tags = {
Name = "${var.vpc_name}-internet-gateway"
}
}
resource "aws_eip" "nat-gw" {
vpc = true
tags = {
Name = "nat-elastic-ip"
}
depends_on = [aws_internet_gateway.gw]
}
resource "aws_nat_gateway" "gw" {
allocation_id = aws_eip.nat-gw.id
subnet_id     = aws_subnet.dev[0].id
tags = {
Name = "${var.vpc_name}-nat-gateway-dev"
}
depends_on = [aws_internet_gateway.gw]
}
# VPC Route Table
resource "aws_default_route_table" "default" {
default_route_table_id = aws_vpc.main.main_route_table_id
route {
cidr_block    = "0.0.0.0/0"
gateway_id    = aws_internet_gateway.gw.id
}
tags = {
Name = "${var.vpc_name}-public"
}
depends_on = [aws_internet_gateway.gw]
}
# dev Subnet Route Table
resource "aws_route_table" "dev" {
vpc_id = aws_vpc.main.id
tags = {
Name = "dev-route-table"
}
}
resource "aws_route_table_association" "dev_routes" {
subnet_id      = aws_subnet.dev[0].id
route_table_id = aws_route_table.dev.id
depends_on = [aws_nat_gateway.gw]
}
resource "aws_route" "dev_nat" {
route_table_id            = aws_route_table.dev.id
destination_cidr_block    = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.gw.id
depends_on = [aws_nat_gateway.gw]

Answer 1

您将NAT放置在aws_subnet.dev[0]中，然后创建连接到子网的aws_route_table.dev。此外，aws_route_table.dev具有指向NAT的路由aws_route.dev_nat

因此，基本上您正在执行一些循环路由-aws_subnet.dev[0]中的所有流量都直接指向同一子网中的NAT，而NAT又再次指向同一NAT。

正如您在评论中指出的，NAT应该在公共子网中，而将流量引导到NAT的子网应该是私有子网。