长话短说，使用Terraform，我想
- 在 AWS 中创建虚拟机
- 将 VM 放在允许端口 80、443 和 22 的安全组中。
完成第 1 项很简单。 为了完成第 2 项，我理解：
- 我需要先创建一个 VPC。这奏效了。
- 然后，我需要在 VPC 内有一个子网。这奏效了。
- 然后，我需要创建与 VPC 关联的安全组。这奏效了。
- 然后，我需要将 VPC 安全组 ID 添加到我的aws_instance。此行会导致它失败。
vpc_security_group_ids = ["${aws_security_group.allow_ssh.id},${aws_security_group.allow_web.id}"]
我有以下地形计划：
# Provider Details
provider "aws" {
region = "us-east-1"
shared_credentials_file = "/Users/default/.aws/credentials"
profile = "my-profile"
}
# Main VPC
resource "aws_vpc" "vpc_main" {
cidr_block = "10.0.0.0/16"
enable_dns_support = true
enable_dns_hostnames = true
tags {
Name = "Main VPC"
}
}
resource "aws_subnet" "public" {
vpc_id = "${aws_vpc.vpc_main.id}"
cidr_block = "10.0.0.1/16"
map_public_ip_on_launch = true
tags {
Name = "Public Subnet"
}
}
resource "aws_security_group" "allow_web" {
name = "allow-web-traffic"
description = "Allow all inbound/outbound traffic on 80 443"
vpc_id = "${aws_vpc.vpc_main.id}"
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_security_group" "allow_ssh" {
name = "allow-ssh-traffic"
description = "Allow ssh traffic on 22"
vpc_id = "${aws_vpc.vpc_main.id}"
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_instance" "proxy_server" {
ami = "ami-6871a115" # RHEL 7.5 HVM SSD
instance_type = "t2.micro"
key_name = "cwood_sa"
vpc_security_group_ids = ["${aws_security_group.allow_ssh.id},${aws_security_group.allow_web.id}"] # this breaks it
subnet_id = "${aws_subnet.public.id}"
}
生成的错误。
* aws_instance.proxy_server: Error launching source instance: InvalidGroup.NotFound: The security group 'sg-063c2b4b4836f18aa,sg-07e562845b70bf125' does not exist in VPC 'vpc-0397460a8f633574c'
status code: 400, request id: dae8b8e8-8259-4ef1-b9c2-a8b782f96235
但是，如果我查看 AWS 控制台，这些安全组与VPC 相关联。
我假设我在某处犯了一个根本性错误，需要一些帮助。
每个安全组都需要用引号括起来。 您当前有以下行：
vpc_security_group_ids = ["${aws_security_groups.allow_ssh.id},${aws_security_group.allow_web.id}"]
这不是有效的 HCL 列表语法 。将您的安全组行更新为：
vpc_security_group_ids = ["${aws_security_groups.allow_ssh.id}","${aws_security_group.allow_web.id}"]
有类似的问题。我遇到了这个错误：
aws_instance.mac: Creating...
╷
│ Error: creating EC2 Instance: InvalidGroup.NotFound: The security group '["sg-0762f148621bc8649"]' does not exist in VPC 'vpc-0cgh1e611ae423ccf'
│ status code: 400, request id: 153ea6fb-5467-41f5-ba75-1a6f60tg8279
│
│ with aws_instance.mac,
│ on main.tf line 1, in resource "aws_instance" "mac":
│ 1: resource "aws_instance" "mac" {
│
╵
Releasing state lock. This may take a few moments...
ERRO[0049] 1 error occurred:
* exit status 1
我的设置中有以下内容：
模块文件
resource "aws_instance" "mac" {
ami = var.custom_ami
instance_type = "mac1.metal"
key_name = var.key_name
availability_zone = var.availability_zone
host_id = var.dedicated_host_id
subnet_id = var.subnet_id
vpc_security_group_ids = [var.vpc_security_group_ids]
root_block_device {
volume_size = 512
volume_type = "gp3"
}
tags = {
Name = var.name
}
}
变量文件
variable "custom_ami" {}
variable "name" {}
variable "availability_zone" {}
variable "dedicated_host_id" {}
variable "key_name" {}
variable "subnet_id" {}
variable "vpc_security_group_ids" {}
资源文件
include {
path = find_in_parent_folders()
}
locals {
common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
environment = local.common_vars.locals.environment_name
tags = local.common_vars.locals.common_tags
}
dependency "vpc" {
config_path = "../../vpc/"
}
dependency "key_pair" {
config_path = "../../key_pair/"
}
dependency "security_group" {
config_path = "../../security-groups/macos/"
}
dependency "ec2_host" {
config_path = "../ec2-host/"
}
terraform {
source = "../../../../../../modules/aws/m1-macos///"
}
inputs = {
name = "${local.environment}-macos-m1-01"
custom_ami = "ami-0db9238c33c33525b"
key_name = dependency.key_pair.outputs.key_pair_key_name
availability_zone = "eu-central-1a"
dedicated_host_id = dependency.ec2_host.outputs.ec2_host_id
vpc_security_group_ids = [dependency.security_group.outputs.security_group_id]
subnet_id = dependency.vpc.outputs.private_subnets[0]
tags = local.tags
}
我是如何修复的：
我所要做的就是删除模块文件中vpc_security_group_ids = [var.vpc_security_group_ids]周围的[]，然后在变量文件中的变量vpc_security_group_ids中添加一个type = list(string)。
模块文件
resource "aws_instance" "mac" {
ami = var.custom_ami
instance_type = "mac1.metal"
key_name = var.key_name
availability_zone = var.availability_zone
host_id = var.dedicated_host_id
subnet_id = var.subnet_id
vpc_security_group_ids = var.vpc_security_group_ids
root_block_device {
volume_size = 512
volume_type = "gp3"
}
tags = {
Name = var.name
}
}
变量文件
variable "custom_ami" {}
variable "name" {}
variable "availability_zone" {}
variable "dedicated_host_id" {}
variable "key_name" {}
variable "subnet_id" {}
variable "vpc_security_group_ids" {
description = "A list of security group IDs to associate with"
type = list(string)
default = null
}
资源文件
include {
路径 = find_in_parent_folders((
}
locals {
common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
environment = local.common_vars.locals.environment_name
tags = local.common_vars.locals.common_tags
}
dependency "vpc" {
config_path = "../../vpc/"
}
dependency "key_pair" {
config_path = "../../key_pair/"
}
dependency "security_group" {
config_path = "../../security-groups/macos/"
}
dependency "ec2_host" {
config_path = "../ec2-host/"
}
terraform {
source = "../../../../../../modules/aws/m1-macos///"
}
inputs = {
name = "${local.environment}-macos-m1-01"
custom_ami = "ami-0db9238c33c33525b"
key_name = dependency.key_pair.outputs.key_pair_key_name
availability_zone = "eu-central-1a"
dedicated_host_id = dependency.ec2_host.outputs.ec2_host_id
vpc_security_group_ids = [dependency.security_group.outputs.security_group_id]
subnet_id = dependency.vpc.outputs.private_subnets[0]
tags = local.tags
}