如何使用 terraform 在我的公共 vcp 中创建堡垒主机？答案

【问题标题】：How to create bastion host in my public vcp using terraform?如何使用 terraform 在我的公共 vcp 中创建堡垒主机？
【发布时间】：2020-07-14 14:16:19
【问题描述】：

我有公共和私有的 vpc。

如何在公共上创建堡垒主机？

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 2.0"

  name = "${local.name}-vpc"
  cidr = "10.1.0.0/16"

  azs = ["us-east-2a", "us-east-2b", "us-east-2c"]

  private_subnets = ["10.1.1.0/24", "10.1.2.0/24", "10.1.3.0/24"]
  public_subnets  = ["10.1.101.0/24", "10.1.102.0/24", "10.1.103.0/24"]

  single_nat_gateway = true

  enable_nat_gateway   = true
  enable_vpn_gateway   = false
  enable_dns_hostnames = true

  public_subnet_tags = {
    Name = "public"
  }

  private_subnet_tags = {
    Name = "private"
  }

  public_route_table_tags = {
      Name = "public-RT"
  }

  private_route_table_tags = {
      Name = "private-RT"
  }

  tags = {
    Environment = local.environment
    Name        = local.name
  }
}

编辑我将其添加到上面的代码中：

resource "aws_security_group" "bastion-sg" {
  name   = "bastion-security-group"
  vpc_id = "${module.vpc.vpc_id}"

  ingress {
    protocol    = "tcp"
    from_port   = 22
    to_port     = 22
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    protocol    = -1
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "bastion" {
  ami                         = "ami-0d5d9d301c853a04a"
  key_name                    = "key"
  instance_type               = "t2.micro"
  vpc_security_group_ids      = ["${aws_security_group.bastion-sg.id}"]
  associate_public_ip_address = true
}

但是当我运行 terraform apply 时出现错误：

Error: Error launching source instance: InvalidParameter: Security group sg-0e3d05f76119af726 and subnet subnet-4b0c1123 belong to different networks.
        status code: 400, request id: ddce7fc3-3ef9-407d-b0cd-0dda640bb3a9

  on vpc.tf line 108, in resource "aws_instance" "bastion":
 108: resource "aws_instance" "bastion" {

【问题讨论】：

.name != "一个 ID"
您也没有遵循文档，如果您尝试为 VPC 执行此操作，则应改用 terraform.io/docs/providers/aws/r/…
我编辑了我的问题并更改为id，但现在我收到错误：InvalidParameter: Security group sg-0e3d05f76119af726 and subnet-4b0c1123 属于不同的网络。我做错了什么？
这是一个不同的问题:)
...您不应该将您的问题编辑为与原来不同的内容。如果我回答了你的问题，我可以发布答案。现在它没有多大意义了。

标签： amazon-web-services terraform terraform-provider-aws

【解决方案1】：

  resource "aws_security_group" "bastion-sg" {
  name   = "bastion-security-group"
  vpc_id = "aws_vpc.My_VPC.id"

  ingress {
    protocol    = var.bastion_ingress_protocol
    from_port   = var.bastion_ingress_from_port
    to_port     = var.bastion_ingress_to_port
    cidr_blocks = var.bastion_ingress_cidr
  }

  egress {
    protocol    = var.bastion_egress_protocol
    from_port   = var.bastion_egress_from_port
    to_port     = var.bastion_egress_to_port
    cidr_blocks = var.bastion_egress_cidr
  }
}

resource "aws_instance" "bastion" {
  ami                         = var.bastion_ami
  key_name                    = var.key
  instance_type               = var.bastion_instance_type
  security_groups             = [aws_security_group.bastion-sg.id]
  associate_public_ip_address = true
}

【讨论】：

请同时提供描述。