使用terraform在非默认VPC中创建AWS RDS实例

问题描述：

我正在使用Terraform v0.10.2。我已经创建了VPC modules/vpc/main.tf和 modules/acl/main.tf。我正在使用它的输出访问它。使用terraform在非默认VPC中创建AWS RDS实例

我可以成功地在上面VPC公共子网创建EC2实例，像这样：

subnet_id = "${element(module.vpc.public_subnet_ids, count.index)}"

我想了RDS实例添加到专用子网。我试过什么terraform文档说：

vpc_security_group_ids = [ 
    "${aws_security_group.db_access_sg.id}" 
] 
db_subnet_group_name = "${module.vpc.aws_db_subnet_group_database}"

但是，它是添加到默认的VPC。如果我把子网放在模块外面并访问资源，它会给变量找不到错误。

我引用了很多GitHub的例子，但没有成功。我错过了什么吗？

这也是我称为链路之一：模块/ VPC的https://github.com/hashicorp/terraform/issues/13739

内容/ main.tf

resource "aws_vpc" "mod" { 
    cidr_block = "${var.cidr}" 

    tags { 
    Name = "${var.name}" 
    } 
} 

resource "aws_internet_gateway" "mod" { 
    vpc_id = "${aws_vpc.mod.id}" 
} 

resource "aws_route_table" "public" { 
    vpc_id   = "${aws_vpc.mod.id}" 
    propagating_vgws = ["${compact(split(",", var.public_propagating_vgws))}"] 

    tags { 
    Name = "${var.name}-public" 
    } 
} 

resource "aws_route" "public_internet_gateway" { 
    route_table_id   = "${aws_route_table.public.id}" 
    destination_cidr_block = "0.0.0.0/0" 
    gateway_id    = "${aws_internet_gateway.mod.id}" 
} 

resource "aws_route_table" "private" { 
    vpc_id   = "${aws_vpc.mod.id}" 
    propagating_vgws = ["${compact(split(",", var.private_propagating_vgws))}"] 

    tags { 
    Name = "${var.name}-private" 
    } 
} 

resource "aws_subnet" "private" { 
    vpc_id   = "${aws_vpc.mod.id}" 
    cidr_block  = "${element(split(",", var.private_subnets), count.index)}" 
    availability_zone = "${element(split(",", var.azs), count.index)}" 
    count    = "${length(compact(split(",", var.private_subnets)))}" 

    tags { 
    Name = "${var.name}-private" 
    } 
} 

resource "aws_subnet" "public" { 
    vpc_id   = "${aws_vpc.mod.id}" 
    cidr_block  = "${element(split(",", var.public_subnets), count.index)}" 
    availability_zone = "${element(split(",", var.azs), count.index)}" 
    count    = "${length(compact(split(",", var.public_subnets)))}" 

    tags { 
    Name = "${var.name}-public" 
    } 

    map_public_ip_on_launch = true 
} 

resource "aws_db_subnet_group" "database" { 
    name   = "${var.name}-rds-subnet-group-${count.index}" 
    description = "Database subnet groups for ${var.name}" 
    subnet_ids = ["${aws_subnet.private.*.id}"] 
    #tags  = "${merge(var.tags, map("Name", format("%s-database-subnet-group", var.name)))}" 
    count  = "${length(compact(split(",", var.private_subnets)))}" 
} 

resource "aws_route_table_association" "private" { 
    count   = "${length(compact(split(",", var.private_subnets)))}" 
    subnet_id  = "${element(aws_subnet.private.*.id, count.index)}" 
    route_table_id = "${aws_route_table.private.id}" 
} 

resource "aws_route_table_association" "public" { 
    count   = "${length(compact(split(",", var.public_subnets)))}" 
    subnet_id  = "${element(aws_subnet.public.*.id, count.index)}" 
    route_table_id = "${aws_route_table.public.id}" 
}

模块的内容/ VPC/outputs.tf

output "vpc_id" { 
    value = "${aws_vpc.mod.id}" 
} 

output "public_subnet_ids" { 
    value = ["${aws_subnet.public.*.id}"] 
} 

output "private_subnet_ids" { 
    value = ["${aws_subnet.private.*.id}"] 
} 

output "aws_db_subnet_group_database" { 
    value = "${aws_db_subnet_group.database.name}" 
}

modules/acl/main.tf的内容

resource "aws_network_acl" "private_app_subnets" { 
    vpc_id = "${var.vpc_id}" 

    subnet_ids = ["${var.private_subnet_ids}"] 
}

你可以发布你的完整模块/ vpc/main.tf和modules/acl/main.tf吗？ – strongjz

编辑我的文章以包含main.tf内容 –

为什么你在'aws_db_subnet_group'上有'count'？子网组跨越多个子网，然后将数据库实例放入'aws_db_subnet_group'中，允许它跨子网组指定的子网移动。我有点惊讶你的VPC模块输出没有失败，因为使用计数不应该有'aws_db_subnet_group.database.name'值。从子网组中删除计数应该足以使其工作。 – ydaetskcoR

答

问题是，我试图将RDS实例添加到私有子网时启用了“公开访问”为真。当然，我不得不从aws_db_subnet_group中删除计数，就像ydaetskcoR告诉我的那样。

使用terraform在非默认VPC中创建AWS RDS实例

相关推荐