Terraform - 使用在单独文件中创建的安全组 ID 来创建 EC2 实例

问题描述

我用过 这个 在 AWS VPC 中创建安全组的模块.如何在单独的文件中引用由此创建的资源?我正在同一个 repo 的单独目录中创建我们的堡垒实例.

I have used this module to create a security group in AWS VPC. How do I reference the resource created from this in a separate file? I am creating our bastion instance in a separate directory in the same repo.

我的堡垒配置如下所示，使用 Terraform EC2 模块，如果我硬编码 vpc 安全组 ID，它就可以工作，但我希望它能够直接从创建安全组时获取它，因为这可能会改变未来..

My bastion config looks like the following, uses the Terraform EC2 module and works if I hard code the vpc security group ID, but I want it to be able to take it directly from when the security group is created as this could change in the future..

terraform/aws/layers/bastion/main.tf

    provider "aws" {
        region = var.region
    }

    module "ec2-instance" {
      source = "terraform-aws-modules/ec2-instance/aws"

      name                   = "bastion"
      instance_count.        = 1
      ami                    = var.image_id
      instance_type          = var.instance_type
      vpc_security_group_ids = ["${}"]
      subnet_id              = var.subnet
      iam_instance_profile   = "aws-example-ec2-role"

      tags = {
        Layer = "Bastion"
      }
    }

这就是我创建安全组的方式:terraform/aws/global/vpc/bastion_sg.tf

This is how I have created the security group:terraform/aws/global/vpc/bastion_sg.tf

        module "bastion-sg" {
          source = "terraform-aws-modules/security-group/aws"

      name        = "Bastion"
      description = "Bastion example group"
      vpc_id      = "vpc-12345"

      ingress_with_cidr_blocks = [
        {
          from_port   = ##
          to_port     = ##
          protocol    = "##"
          description = "Bastion SSH"
          cidr_blocks = "1.2.3.4/5"
        },
        {
          from_port   = ##
          to_port     = ##
          protocol    = "##"
          description = "Bastion SSH"
          cidr_blocks = "1.2.3.4/5"
        }
      ]
      egress_with_source_security_group_id = [
        {
          from_port                = ##
          to_port                  = ##
          protocol                 = "##"
          description              = "Access to default server security group"
          source_security_group_id = "sg-12345"
        },
        {
          from_port                = ##
          to_port                  = ##
          protocol                 = "##"
          description              = "Access to db"
          source_security_group_id = "sg-12345"
        }
      ]
    }

我是否需要将安全组 ID 输出到由 bastion_sg.tf 创建的 output.tf 中，然后才能在 bastion/main.tf 中引用它，如下所示?

Do I need to output the security group ID to outputs.tf where I have created by bastion_sg.tf before I can reference it within bastion/main.tf like below?

    module "bastion_sg"
        source "../../global/vpc"

然后以某种方式将 ID 传递给 vpc_security_group_id = ?

and then somehow pass the ID into vpc_security_group_id = ?

推荐答案

我不会使用 terraform-aws-modules.我会直接使用 aws_security_group 和 aws_security_group_rules 等 aws 提供程序资源.从 Terraform 0.12 开始，这些单资源模块没有任何好处，只是增加了复杂性.

I would not use terraform-aws-modules. I would use aws provider resources like aws_security_group and aws_security_group_rules directly. Since Terraform 0.12, there is no benefit to these single-resource modules, just added complexity.

这是一个示例，说明您的代码可以使用直接的 aws 提供程序资源并且没有多余的模块:

Here's an example of what your code could be with direct aws provider resources and no superfluous modules:

provider "aws" {
    region = var.region
}

resource "aws_instance" "bastion" {
  name                   = "bastion"
  ami                    = var.image_id
  instance_type          = var.instance_type
  vpc_security_group_ids = [aws_security_group.bastion.id]
  subnet_id              = var.subnet
  iam_instance_profile   = "aws-example-ec2-role"

  tags = {
    Layer = "Bastion"
  }
}

resource "aws_security_group" "bastion_from_ssh" {
  name        = "Bastion"
  description = "Bastion example group"
  vpc_id      = "vpc-12345"
}

resource "aws_security_group_rule" "allow_ssh" {
  type                     = "ingress"
  from_port   = ##
  to_port     = ##
  protocol    = "##"
  description = "Bastion SSH"
  cidr_blocks = ["1.2.3.4/5"]
}

resource "aws_security_group_rule" "bastion_to_db" {
  type                     = "egress"
  from_port                = ##
  to_port                  = ##
  protocol                 = "##"
  description              = "Access to default server security group"
  source_security_group_id = "sg-12345"
}

output "security_group_id" {
    value = aws_security_group.bastion_from_ssh.id
}

示例:引用另一个模块中的输出:

Example: Referencing the output in another module:

module "bastion" {
   source = "path/to/dir/with/code/above"
   // ... any variables it needs
}

resource "aws_security_group" "app_server" {
  name        = "AppServer"
  description = "App Server group"
  vpc_id      = "vpc-12345"
}

resource "aws_security_group_rule" "allow_ssh_to_app_server" {
  security_group_id = module.bastion.security_group_id
  type = "egress"

  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  description = "SSH to App Server"
  source_security_group_id = aws_security_group.app_server.id
}

resource "aws_security_group_rule" "allow_ssh_from_bastion" {
  security_group_id = aws_security_group.app_server.id
  type = "ingress"

  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  description = "SSH from Bastion"
  source_security_group_id = module.bastion.security_group_id
}

这篇关于Terraform - 使用在单独文件中创建的安全组 ID 来创建 EC2 实例的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！