InvalidParameterCombination：数据库实例和EC2安全组在不同的VPC

Question

我有两个 VPC。一个是blue vpc (vpc_id = vpc-0067ff2ab41cc8a3e)，另一个是shared VPC (vpc_id = vpc-076a4c26ec2217f9d)。 VPC 对等连接这两个 VPC。我在共享 VPC 中配置 MariaDB。但是，我得到以下错误。

错误：创建数据库实例时出错：InvalidParameterCombination：数据库实例和 EC2 安全组位于不同的 VPC 中。数据库实例在 vpc-076a4c26ec2217f9d 中，EC2 安全组在 vpc-0067ff2ab41cc8a3e 中状态码：400，请求 ID：75954d06-375c-4680-b8fe-df9a67f2574d

下面是代码。有人可以帮忙吗？

module "master" {
  source = "terraform-aws-modules/rds/aws"
  version = "2.20.0"
  identifier = var.master_identifier
  engine            = var.engine
  engine_version    = var.engine_version
  instance_class    = var.instance_class
  allocated_storage = var.allocated_storage
  storage_type      = var.storage_type
  storage_encrypted = var.storage_encrypted
  name     = var.mariadb_name
  username = var.mariadb_username
  password = var.mariadb_password
  port     = var.mariadb_port
  vpc_security_group_ids = [data.terraform_remote_state.vpc-shared.outputs.default_security_group_id,
                            data.terraform_remote_state.vpc-blue.outputs.default_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.worker_group_general_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.worker_group_gitea_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.all_workers_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.cluster_security_group_id]
  maintenance_window = var.maintenance_window_master
  backup_window      = var.backup_window_master
  multi_az = true
  tags = {
    Owner       = "MariaDB"
    Environment = "blue-green"
  }
  enabled_cloudwatch_logs_exports = ["audit", "general"]
  subnet_ids = data.terraform_remote_state.vpc-shared.outputs.database_subnets
  create_db_option_group = true
  apply_immediately = true
  family = var.family
  major_engine_version = var.major_engine_version
  final_snapshot_identifier = var.final_snapshot_identifier
  deletion_protection = false
  parameters = [
    {
      name  = "character_set_client"
      value = "utf8"
    },
    {
      name  = "character_set_server"
      value = "utf8"
    }
  ]
  options = [
    {
      option_name = "MARIADB_AUDIT_PLUGIN"
      option_settings = [
        {
          name  = "SERVER_AUDIT_EVENTS"
          value = "CONNECT"
        },
        {
          name  = "SERVER_AUDIT_FILE_ROTATIONS"
          value = "7"
        },
      ]
    },
  ]
}

module "replica" {
  source = "terraform-aws-modules/rds/aws"
  version = "2.20.0"
  identifier = var.replica_identifier
  replicate_source_db = module.master.this_db_instance_id
  engine            = var.engine
  engine_version    = var.engine_version
  instance_class    = var.instance_class
  allocated_storage = var.allocated_storage
  username = ""
  password = ""
  port     = var.mariadb_port
  vpc_security_group_ids = [data.terraform_remote_state.vpc-shared.outputs.default_security_group_id,
                            data.terraform_remote_state.vpc-blue.outputs.default_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.worker_group_general_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.worker_group_gitea_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.all_workers_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.cluster_security_group_id]

  maintenance_window = var.maintenance_window_replica
  backup_window      = var.backup_window_replica
  multi_az = false
  backup_retention_period = 0
  create_db_subnet_group = false
  create_db_option_group    = false
  create_db_parameter_group = false
  major_engine_version = var.major_engine_version
}

Answer 1

通常情况下，您应该从您的 RDS 所在的 VPC 获取 vpc_security_group_ids。在您的情况下，它将是 shared vpc:

vpc_security_group_ids = [data.terraform_remote_state.vpc-shared.outputs.default_security_group_id]

有了这个 SG，您可以向其添加规则以允许来自其他安全组的入口流量。所以基本上，您的 RDS 将有 一个具有多个入口规则的 SG。入口规则将指定允许的其他安全组。

InvalidParameterCombination：数据库实例和EC2安全组在不同的VPC

InvalidParameterCombination: The DB instance and EC2 security group are in different VPCs

amazon-web-services

amazon-rds

terraform