为什么Terraform会将另一个VPC中的安全组检测到子网？

Question

Terraform计划工作正常，但运行terraform apply时出现以下错误：

安全组sg-XXXXX和子网子网Defaul1a属于不同的网络。

这是我想要应用的Terraform代码：

variable "region" {
  default = "eu-west-1"
}

variable "zones" {
  type = "map"
  default = {
    "eu-west-1a" = "euw1-az2"
    "eu-west-1b" = "euw1-az3"
    "eu-west-1c" = "euw1-az1"
  }
}

variable "default_kp" {
  type = "string"
  default = "ireland-dev-my_own_project-default-kp"
}

data "aws_ami" "ami_amazon" {
  name_regex = "^amzn2-ami-hvm"
  most_recent = true
  owners = ["137112412989"]

  filter {
    name   = "root-device-type"
    values = ["ebs"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }
}

#   VPC
resource "aws_vpc" "ireland-dev-my_own_project-main_vpc" {
 cidr_block = "10.0.0.0/16"
 enable_dns_hostnames = true
 enable_dns_support = true

 tags = {
   Name = "ireland-dev-my_own_project-main_vpc"
   environment = "dev"
   application = "my_own_project-main"
 }
}

#   InternetGateway
resource "aws_internet_gateway" "ireland-dev-my_own_project-main_ig" {
 vpc_id = "${aws_vpc.ireland-dev-my_own_project-main_vpc.id}"
}

#Public Subnet's
resource "aws_subnet" "ireland-dev-my_own_project-sn-pub-1a" {
  cidr_block = "10.0.10.0/24"
  vpc_id = "${aws_vpc.ireland-dev-my_own_project-main_vpc.id}"
  availability_zone_id = "${var.zones.eu-west-1a}"
  tags = {
    Name = "ireland-dev-my_own_project-sn-pub-1a"
    environment = "dev"
    application = "my_own_project-main"
    finality = "publishing"
  }
}

#   Route Table
resource "aws_route_table" "ireland-dev-my_own_project-main_route_table" {
  vpc_id = "${aws_vpc.ireland-dev-my_own_project-main_vpc.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.ireland-dev-my_own_project-main_ig.id}"
  }

  tags = {
    Name = "ireland-dev-my_own_project-main_route_table"
    environment = "dev"
    application = "my_own_project-main"
    finality = "publishing"
  }
}

#   Route Tables asotiation with Public Subnets
resource "aws_route_table_association" "ireland-dev-my_own_project-route_pub1a" {
  route_table_id = "${aws_route_table.ireland-dev-my_own_project-main_route_table.id}"
  subnet_id = "${aws_subnet.ireland-dev-my_own_project-sn-pub-1a.id}"
}

#   Security Group's and Rules
resource "aws_security_group" "sg_local" {
  vpc_id = "${aws_vpc.ireland-dev-my_own_project-main_vpc.id}"
  description = "IP Cristian Sacristan Home"

  tags = {
    Name = "ireland-dev-my_own_project-sg-cs_local"
    env = "dev"
    application = "my_own_project-main"
    finality = "bastion"
  }
}

resource "aws_security_group_rule" "sg-local-ssh-cs_home" {
  type = "ingress"
  from_port = 22
  to_port = 22
  protocol = "tcp"
  security_group_id = "${aws_security_group.sg_local.id}"
  cidr_blocks = ["8.8.8.8/32"] # MyIP
}

resource "aws_security_group" "sg_bastion" {
  vpc_id = "${aws_vpc.ireland-dev-my_own_project-main_vpc.id}"
  description = "SG for bastion host"

  tags = {
    Name = "ireland-dev-my_own_project-sg-bastion"
    env = "dev"
    application = "my_own_project-main"
    finality = "bastion"
  }
}

#   Instances
resource "aws_instance" "bastion" {
  ami = "${data.aws_ami.ami_amazon.id}"
  instance_type = "t2.micro"
  availability_zone = "${aws_subnet.ireland-dev-my_own_project-sn-pub-1a.availability_zone}"
  vpc_security_group_ids = ["${aws_security_group.sg_local.id}","${aws_security_group.sg_bastion.id}"]
  key_name = "${var.default_kp}"
  associate_public_ip_address = true

  tags = {
    Name = "ireland-dev-my_own_project-ec2ins-bastion"
    env = "dev"
    application = "my_own_project-main"
    finality = "bastion"
  }
}

完整的apply输出：

aws_vpc.ireland-dev-my_own_project-main_vpc: Creating...
aws_vpc.ireland-dev-my_own_project-main_vpc: Creation complete after 3s [id=vpc-AAAAAAAAAAAAA]
aws_internet_gateway.ireland-dev-my_own_project-main_ig: Creating...
aws_subnet.ireland-dev-my_own_project-sn-pub-1a: Creating...
aws_security_group.sg_bastion: Creating...
aws_subnet.ireland-dev-my_own_project-sn-pub-1a: Creation complete after 1s [id=subnet-AAAAAAAAAAA]
aws_internet_gateway.ireland-dev-my_own_project-main_ig: Creation complete after 1s [id=igw-AAAAAAAAAA]
aws_route_table.ireland-dev-my_own_project-main_route_table: Creating...
aws_security_group.sg_local: Creation complete after 1s [id=sg-AAAAA]
aws_security_group_rule.sg-local-ssh-cs_home: Creating...
aws_security_group.sg_bastion: Creation complete after 1s [id=sg-AAAAAA]
aws_instance.bastion: Creating...
aws_route_table.ireland-dev-my_own_project-main_route_table: Creation complete after 1s [id=rtb-AAAAAAAA]
aws_route_table_association.ireland-dev-my_own_project-route_pub1a: Creating...
aws_security_group_rule.sg-local-ssh-cs_home: Creation complete after 1s [id=sgrule-AAAAA]
aws_route_table_association.ireland-dev-my_own_project-route_pub1a: Creation complete after 0s [id=rtbassoc-AAAA]

Error: Error launching source instance: InvalidParameter: Security group sg-AAAAAAAAAAAAA and subnet subnet-AA belong to different networks.
        status code: 400, request id: 6AAAAAA-AA-AAAA-AAAA-AAAAAAA

  on main.tf line 135, in resource "aws_instance" "bastion":
 135: resource "aws_instance" "bastion" {

Answer 1

您应该指定希望实例所在的子网而不是可用区。

因为您指定了availability_zone而不是subnet_id所以Terraform已尝试将实例放入与默认VPC中的AZ匹配的子网中，而不是您尝试将其放入的VPC。

不幸的是，这是一个问题，EC2 API允许EC2 Classic（pre VPC）帐户使用默认VPC来处理未指定子网的默认情况的每个区域。