如何使用多个 eip 和 ec2 实例创建 terraform aws_security_group？

Question

我正在尝试根据以下代码创建实例 -

resource "aws_instance" "ec2" {
  ami = "ami-0fe0b2cf0e1f25c8a"
  instance_type = var.ec2_instance_type
  count = var.number_of_instances

  tags = {
    Name = "ec2_instance_${count.index}"
  }
}

resource "aws_eip" "lb" {
  vpc = true
  count = var.number_of_instances
}

resource "aws_eip_association" "eic_assoc" {
  instance_id = aws_instance.ec2[count.index].id
  allocation_id = aws_eip.lb[count.index].id
  count = var.number_of_instances
}

resource "aws_security_group" "allow_tls" {
  name = "first-security-group-created-by-terraform"
  count = var.number_of_instances
  ingress {
      from_port = var.security_group_port
      to_port = var.security_group_port
      protocol = var.security_group_protocol
      cidr_blocks = ["${aws_eip.lb[count.index].public_ip}/32"]
  }
}

并出现以下错误 -

错误：创建安全组（first-security-group-created-by-terraform）：InvalidGroup.Duplicate：VPC“vpc-0fb3457c89d86e916”的安全组“first-security-group-created-by-terraform”已存在

可能是因为当有多个 eip 和 ec2 实例时，这不是创建 aws_security_group 的正确方法。

这样做的正确方法是什么？

Answer 1

您正在创建多个安全组，但为它们赋予了完全相同的名称。 每个安全组的名称必须是唯一的。 你可以这样修复它：

resource "aws_security_group" "allow_tls" {
  count = var.number_of_instances
  name  = "first-security-group-created-by-terraform-${count.index}"
  ingress {
      from_port = var.security_group_port
      to_port = var.security_group_port
      protocol = var.security_group_protocol
      cidr_blocks = ["${aws_eip.lb[count.index].public_ip}/32"]
  }
}

---

创建具有多个入口规则的单个安全组的一种方法是创建没有任何ingress块的组，然后分别创建入口规则：

resource "aws_security_group" "allow_tls" {
  name  = "first-security-group-created-by-terraform"
}

resource "aws_security_group_rule" "allow_tls_rules" {
  count = var.number_of_instances

  type              = "ingress"
  from_port         = var.security_group_port
  to_port           = var.security_group_port
  protocol          = var.security_group_protocol
  cidr_blocks       = ["${aws_eip.lb[count.index].public_ip}/32"]
  security_group_id = aws_security_group.allow_tls.id
}