[英]How to pass the EC2 instance ID created by an aws_instance resource into a file and place it inside an EC2 instance using Terraform?
[英]Terraform - Use security group ID created in separate file for EC2 instance creation
我已经使用这个模块在 AWS VPC 中创建了一个安全组。 如何在单独的文件中引用由此创建的资源? 我在同一个 repo 的单独目录中创建我们的堡垒实例。
我的堡垒配置如下所示,使用 Terraform EC2 模块,如果我硬编码 vpc 安全组 ID,它就可以工作,但我希望它能够直接从创建安全组时获取它,因为这可能会在未来发生变化..
terraform/aws/layers/bastion/main.tf
provider "aws" {
region = var.region
}
module "ec2-instance" {
source = "terraform-aws-modules/ec2-instance/aws"
name = "bastion"
instance_count. = 1
ami = var.image_id
instance_type = var.instance_type
vpc_security_group_ids = ["${}"]
subnet_id = var.subnet
iam_instance_profile = "aws-example-ec2-role"
tags = {
Layer = "Bastion"
}
}
这就是我创建安全组的方式: terraform/aws/global/vpc/bastion_sg.tf
module "bastion-sg" {
source = "terraform-aws-modules/security-group/aws"
name = "Bastion"
description = "Bastion example group"
vpc_id = "vpc-12345"
ingress_with_cidr_blocks = [
{
from_port = ##
to_port = ##
protocol = "##"
description = "Bastion SSH"
cidr_blocks = "1.2.3.4/5"
},
{
from_port = ##
to_port = ##
protocol = "##"
description = "Bastion SSH"
cidr_blocks = "1.2.3.4/5"
}
]
egress_with_source_security_group_id = [
{
from_port = ##
to_port = ##
protocol = "##"
description = "Access to default server security group"
source_security_group_id = "sg-12345"
},
{
from_port = ##
to_port = ##
protocol = "##"
description = "Access to db"
source_security_group_id = "sg-12345"
}
]
}
我是否需要将安全组 ID output 设置到由 bastion_sg.tf 创建的 outputs.tf 中,然后才能在 bastion/main.tf 中引用它,如下所示?
module "bastion_sg"
source "../../global/vpc"
然后以某种方式将 ID 传递到 vpc_security_group_id =?
我不会使用 terraform-aws-modules。 我会直接使用 aws_security_group 和 aws_security_group_rules 等 aws 提供程序资源。 由于 Terraform 0.12,这些单资源模块没有任何好处,只是增加了复杂性。
这是一个示例,说明您的代码可以使用直接的 aws 提供程序资源并且没有多余的模块:
provider "aws" {
region = var.region
}
resource "aws_instance" "bastion" {
name = "bastion"
ami = var.image_id
instance_type = var.instance_type
vpc_security_group_ids = [aws_security_group.bastion.id]
subnet_id = var.subnet
iam_instance_profile = "aws-example-ec2-role"
tags = {
Layer = "Bastion"
}
}
resource "aws_security_group" "bastion_from_ssh" {
name = "Bastion"
description = "Bastion example group"
vpc_id = "vpc-12345"
}
resource "aws_security_group_rule" "allow_ssh" {
type = "ingress"
from_port = ##
to_port = ##
protocol = "##"
description = "Bastion SSH"
cidr_blocks = ["1.2.3.4/5"]
}
resource "aws_security_group_rule" "bastion_to_db" {
type = "egress"
from_port = ##
to_port = ##
protocol = "##"
description = "Access to default server security group"
source_security_group_id = "sg-12345"
}
output "security_group_id" {
value = aws_security_group.bastion_from_ssh.id
}
示例:在另一个模块中引用 output:
module "bastion" {
source = "path/to/dir/with/code/above"
// ... any variables it needs
}
resource "aws_security_group" "app_server" {
name = "AppServer"
description = "App Server group"
vpc_id = "vpc-12345"
}
resource "aws_security_group_rule" "allow_ssh_to_app_server" {
security_group_id = module.bastion.security_group_id
type = "egress"
from_port = 22
to_port = 22
protocol = "tcp"
description = "SSH to App Server"
source_security_group_id = aws_security_group.app_server.id
}
resource "aws_security_group_rule" "allow_ssh_from_bastion" {
security_group_id = aws_security_group.app_server.id
type = "ingress"
from_port = 22
to_port = 22
protocol = "tcp"
description = "SSH from Bastion"
source_security_group_id = module.bastion.security_group_id
}
从您正在使用的模块文档中,这些是输出。
module.bastion-sg.this_security_group_id
所以你的terraform/aws/layers/bastion/main.tf
文件看起来像:
provider "aws" {
region = var.region
}
module "ec2-instance" {
source = "terraform-aws-modules/ec2-instance/aws"
name = "bastion"
instance_count. = 1
ami = var.image_id
instance_type = var.instance_type
vpc_security_group_ids = [module.bastion-sg.this_security_group_id]
subnet_id = var.subnet
iam_instance_profile = "aws-example-ec2-role"
tags = {
Layer = "Bastion"
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.