如何在 Terraform 中修复“此用户没有默认 VPC，状态代码：400”？答案

【问题标题】：How to fix "No default VPC for this user, status code: 400" in Terraform?如何在 Terraform 中修复“此用户没有默认 VPC，状态代码：400”？
【发布时间】：2020-08-16 20:14:20
【问题描述】：

我正在尝试修复这段代码，我想创建堡垒主机，但我收到：错误：应用计划时出错：

发生 1 个错误： * aws_instance.bastion：发生 1 个错误： * aws_instance.bastion：启动源实例时出错：VPCIdNotSpecified：此用户没有默认 VPC 状态码：400，请求ID：daf3dd12-d7c4-469a-9be5-3707c0490c2a

我正在使用 Terraform 0.11

代码：

resource "aws_vpc" "main" {
    cidr_block       = "${var.main_vpc_cidr}"
    instance_tenancy = "default"
    enable_dns_support = true
    enable_dns_hostnames = true

     tags {
         Name = "main"
            }
        }


 resource "aws_subnet" "subnet1" {
   vpc_id     = "${aws_vpc.main.id}"
   cidr_block = "10.0.1.0/24"
   availability_zone = "${var.availability_zone1}"


  tags {
    Name = "app-subnet-1"
    }
 }



    ########## Create bastion host ######

##resource "aws_default_vpc" "default" {}

resource "aws_instance" "bastion" {

  ami                         = "ami-0fdc6293d3e87a86e"
  key_name                    = "${aws_key_pair.bastion_key.key_name}"
  instance_type               = "t2.micro"
  security_groups             = ["${aws_security_group.bastion-sg.name}"]
  associate_public_ip_address = true
  
}

resource "aws_security_group" "bastion-sg" {
  name   = "bastion-security-group"
  vpc_id = "${aws_vpc.main.id}"

  ingress {
    protocol    = "tcp"
    from_port   = 22
    to_port     = 22
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    protocol    = -1
    from_port   = 0 
    to_port     = 0 
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_key_pair" "bastion_key" {
  key_name   = "your_key_name"
  public_key = "ssh-rsa AAA

output "bastion_public_ip" {
  value = "${aws_instance.bastion.public_ip}"
}

variables.tf 文件：

variable "aws_access_key" {}
variable "aws_secret_key" {}

variable "aws_region" {
    description = "EC2 Region for the VPC"
    default = "eu-west-1"
}
variable "availability_zone1" {
    description = "Avaialbility Zones"
    default = "eu-west-1a"
}

variable "availability_zone2" {
    description = "Avaialbility Zones"
    default = "eu-west-1b"
}
variable "main_vpc_cidr" {
    description = "CIDR of the VPC"
    default = "10.0.0.0/16"
}

【问题讨论】：

标签： amazon-web-services terraform

【解决方案1】：

如果您只想让默认 VPC 运行，并且可以选择使用 AWS CLI，这对我有用：

aws ec2 create-default-vpc

参考：AWS Docs - Default VPC and default subnets

【讨论】：

【解决方案2】：

代码中有几个错误，例如：

创建没有任何子网、路由表、互联网网关的自定义 vpc（或者您可能只想使用不存在的默认 VPC？），
主 vpc 中的 tags 应为 tags = ，
使用自定义 vpc 时，堡垒中的 security_groups 应为 vpc_security_group_ids，
aws_key_pair 格式错误。

如果您提供有关您要达到的目标的更多信息，则可以提供更详细的答案。

代码更新

代码部署在us-east-1。您可能需要将其修改回您所在的区域（例如 ami、可用区）。

resource "aws_vpc" "main" {
    cidr_block       = "${var.main_vpc_cidr}"
    instance_tenancy = "default"
    enable_dns_support = true
    enable_dns_hostnames = true

     tags = {
         Name = "main"
            }
        }


 resource "aws_subnet" "subnet1" {
   vpc_id     = "${aws_vpc.main.id}"
   cidr_block = "10.0.1.0/24"
   availability_zone = "${var.availability_zone1}"


  tags  =  {
    Name = "app-subnet-1"
    }
 }
 resource "aws_subnet" "subnet2" {
   vpc_id     = "${aws_vpc.main.id}"
   cidr_block = "10.0.2.0/24"
   availability_zone = "${var.availability_zone2}"


     tags  =  {
      Name = "app-subnet-2"
     }
   }
  resource "aws_subnet" "subnet3" {
   vpc_id     = "${aws_vpc.main.id}"
  cidr_block = "10.0.3.0/24"
    availability_zone = "${var.availability_zone1}"


   tags  =  {
     Name = "elb-subnet-1"
 }
}
resource "aws_subnet" "subnet4" {
 vpc_id     = "${aws_vpc.main.id}"
 cidr_block = "10.0.4.0/24"
 availability_zone = "${var.availability_zone2}"


 tags  =  {
  Name = "elb-subnet-2"
  }
 }
    resource "aws_subnet" "subnet5-database" {
    vpc_id     = "${aws_vpc.main.id}"
    cidr_block = "10.0.5.0/24"
     availability_zone = "${var.availability_zone1}"


  tags  =  {
    Name = "db-subnet-1"
 }
}
 resource "aws_subnet" "subnet6-database" {
  vpc_id     = "${aws_vpc.main.id}"
  cidr_block = "10.0.6.0/24"
  availability_zone = "${var.availability_zone2}"


  tags  =  {
  Name = "db-subnet-2"
  }
 }

 resource "aws_internet_gateway" "main-igw" {
   vpc_id = "${aws_vpc.main.id}"

  tags = {
   Name = "main-igw"
   }
   }


resource "aws_eip" "nat" {
}

resource "aws_nat_gateway" "main-natgw" {
  allocation_id = "${aws_eip.nat.id}"
  subnet_id     = "${aws_subnet.subnet4.id}"

  tags = {
    Name = "main-nat"
  }
}

resource "aws_route_table" "main-public-rt" {
  vpc_id = "${aws_vpc.main.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.main-igw.id}"
  }

  tags = {
    Name = "main-public-rt"
  }
}

resource "aws_route_table" "main-private-rt" {
  vpc_id = "${aws_vpc.main.id}"
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_nat_gateway.main-natgw.id}"
  }

  tags  = {
    Name = "main-private-rt"
  }
}

resource "aws_route_table_association" "public-assoc-1" {
  subnet_id      = "${aws_subnet.subnet3.id}"
  route_table_id = "${aws_route_table.main-public-rt.id}"
}
resource "aws_route_table_association" "public-assoc-2" {
  subnet_id      = "${aws_subnet.subnet4.id}"
  route_table_id = "${aws_route_table.main-public-rt.id}"
}


resource "aws_route_table_association" "private-assoc-1" {
  subnet_id      = "${aws_subnet.subnet1.id}"
  route_table_id = "${aws_route_table.main-private-rt.id}"
}
resource "aws_route_table_association" "private-assoc-2" {
  subnet_id      = "${aws_subnet.subnet2.id}"
  route_table_id = "${aws_route_table.main-private-rt.id}"
}
resource "aws_route_table_association" "private-assoc-3" {
  subnet_id      = "${aws_subnet.subnet5-database.id}"
  route_table_id = "${aws_route_table.main-private-rt.id}"
}
resource "aws_route_table_association" "private-assoc-4" {
  subnet_id      = "${aws_subnet.subnet6-database.id}"
  route_table_id = "${aws_route_table.main-private-rt.id}"
}


    ########## Create bastion host ######

##resource "aws_default_vpc" "default" {}

resource "aws_instance" "bastion" {

  ami                         = "ami-0fdc6293d3e87a86e"
  key_name                    = "${aws_key_pair.bastion_key.key_name}"
  instance_type               = "t2.micro"
 # security_groups             = ["${aws_security_group.bastion-sg.name}"]
  vpc_security_group_ids      = ["${aws_security_group.bastion-sg.id}"]
  associate_public_ip_address = true
  
  subnet_id = aws_subnet.subnet1.id
  
}

resource "aws_security_group" "bastion-sg" {
  name   = "bastion-security-group"
##  vpc_id = "${aws_default_vpc.default.id}"
   vpc_id = "${aws_vpc.main.id}"

  ingress {
    protocol    = "tcp"
    from_port   = 22
    to_port     = 22
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    protocol    = -1
    from_port   = 0 
    to_port     = 0 
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_key_pair" "bastion_key" {
   key_name   = "your_key_name"
   public_key = "ssh-rsa AAA
}

output "bastion_public_ip" {
  value = "${aws_instance.bastion.public_ip}"
}

【讨论】：

@TJstock 嗨。我修复了代码。我可以确认它部署在us-east-1。请注意，我只是让它部署。我没有检查生成的 VPC、堡垒、SG、路由表是否按预期工作。我只检查了部署过程。如果答案有帮助，如果它对发布的问题有帮助，我们将不胜感激。
但是我有一个代码和 variables.tf 文件已添加到这篇文章中。请查看此附加文件。
@TJstock 我刚刚删除了重复的变量。
所以我再次运行 terraform 但我现在有不同的错误，我不确定是什么问题：错误：启动源实例时出错：不支持：当前不支持请求的配置。请查看文档以了解支持的配置。状态码：400，请求 id：0c2fc9c5-9d41-41fe-8a22-c827d9214706 可能是因为我在此脚本中使用了一个不存在的测试密钥，所以 public_key 有问题？你觉得怎么样。我的 EC2 实例在 AWS 控制台上不存在，但其余配置存在。我有所有 Subtnes、VPC 等。
@TJstock 检查您的 AMI 和其他员工。我用us-east-1。 AMI 是特定于区域的。对于您所在的地区，AMI 可能会有所不同。如果需要，您可以使用新的错误消息和相关信息提出新问题。

【解决方案3】：

您需要创建一个默认VPC，然后错误就会消失。

基本上，您没有默认 VPC，这就是您收到错误的原因。

【讨论】：

【解决方案4】：

创建一个默认的 VPC 运行对我有用。

Default VPC and default subnets

【讨论】：