Terraform 重新部署 EC2 实例

Question

我相信这很容易解决。我在 AWS 中使用 Terraform，部署 VPC、子网、安全组（这看起来像问题）以及单个 EC2 实例。

症状

当第一次使用 terraform apply 部署时，一切都按预期创建，但是，立即跟进另一个 terraform apply 或 terraform plan 表明需要对 EC2 实例进行更改重新部署 EC2 实例。基础 Terraform 代码没有变化。

根据 terraform plan 的报告重新部署 EC2 实例。

我不希望在运行额外的 terraform apply 命令时重新部署每个 EC2 实例。我不确定这是否可能，但我确定这是否简单，我只是在文档中遗漏了一些东西。

Terraform 文件

vpc.tf

# Create a VPC
resource "aws_vpc" "vpcSandbox" {
  cidr_block = var.vpcSandboxCIDR
  tags = {
    Name      = "vpcSandbox"
    Terraform = "True"
  }
}

# Create DHCP Options for VPC
resource "aws_vpc_dhcp_options" "dhcpOptSandbox" {
  domain_name         = var.searchDomain
  domain_name_servers = ["208.67.220.220", "208.67.222.222"]

  tags = {
    Name      = "dhcpOptSandbox"
    Terraform = "True"
  }
}

# Associated DHCP Options for VPC
resource "aws_vpc_dhcp_options_association" "dhcpOptAssocSandbox" {
  vpc_id          = aws_vpc.vpcSandbox.id
  dhcp_options_id = aws_vpc_dhcp_options.dhcpOptSandbox.id
}

# Create all Subnets
resource "aws_subnet" "sub-sandbox1a" {
  vpc_id            = aws_vpc.vpcSandbox.id
  availability_zone = "us-east-1a"
  cidr_block        = "10.11.1.0/24"
  tags = {
    Terraform = "True"
  }
}
resource "aws_subnet" "sub-sandbox1b" {
  vpc_id            = aws_vpc.vpcSandbox.id
  availability_zone = "us-east-1b"
  cidr_block        = "10.11.2.0/24"
  tags = {
    Terraform = "True"
  }
}
resource "aws_subnet" "sub-sandbox1c" {
  vpc_id            = aws_vpc.vpcSandbox.id
  availability_zone = "us-east-1c"
  cidr_block        = "10.11.3.0/24"
  tags = {
    Terraform = "True"
  }
}
resource "aws_subnet" "sub-sandbox1d" {
  vpc_id            = aws_vpc.vpcSandbox.id
  availability_zone = "us-east-1d"
  cidr_block        = "10.11.4.0/24"
  tags = {
    Terraform = "True"
  }
}
resource "aws_subnet" "sub-sandbox1e" {
  vpc_id            = aws_vpc.vpcSandbox.id
  availability_zone = "us-east-1e"
  cidr_block        = "10.11.5.0/24"
  tags = {
    Terraform = "True"
  }
}
resource "aws_subnet" "sub-sandbox1f" {
  vpc_id            = aws_vpc.vpcSandbox.id
  availability_zone = "us-east-1f"
  cidr_block        = "10.11.6.0/24"
  tags = {
    Terraform = "True"
  }
}

# Create Internet Gateway for VPC
resource "aws_internet_gateway" "gwSandbox" {
  vpc_id = aws_vpc.vpcSandbox.id

  tags = {
    Name      = "gwSandbox"
    Terraform = "True"
  }
}

# Adding some routes to the sandbox VPC
resource "aws_route" "default-v4-sandbox" {
  route_table_id         = aws_vpc.vpcSandbox.default_route_table_id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.gwSandbox.id
}
resource "aws_route" "default-v6-sandbox" {
  route_table_id              = aws_vpc.vpcSandbox.default_route_table_id
  destination_ipv6_cidr_block = "::/0"
  gateway_id                  = aws_internet_gateway.gwSandbox.id
}

securitygroup.tf

# Create security groups for test server
resource "aws_security_group" "sandbox" {
  name        = "sandbox"
  description = "Allow SSH inbound traffic from Trusted Internet Addresses and all Outbound Traffic"
  vpc_id      = aws_vpc.vpcSandbox.id
  tags = {
    Name      = "sandbox"
    Terraform = "True"
  }
}

resource "aws_security_group_rule" "workHQOfficeInbound" {
  type        = "ingress"
  from_port   = 0
  to_port     = 0
  protocol    = "-1"
  cidr_blocks = [var.workOfficeWAN]
  security_group_id = aws_security_group.sandbox.id
}

resource "aws_security_group_rule" "tgs_office_inbound" {
  type              = "ingress"
  from_port         = 0
  to_port           = 65535
  protocol          = "-1"
  cidr_blocks       = [var.devOfficeWAN]
  security_group_id = aws_security_group.sandbox.id
}

resource "aws_security_group_rule" "alloutbound" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  ipv6_cidr_blocks  = ["::/0"]
  security_group_id = aws_security_group.sandbox.id
}

ec2.tf

## Adding a test server
# Create a new Keypair
resource "aws_key_pair" "deployer" {
  key_name   = "deployer-key"
  public_key = var.certDeployerPub
  tags = {
    Name      = "deployer"
    Terraform = "True"
  }
}

# Creating an interface for the test server
resource "aws_network_interface" "int-tc-amazlinux" {
  subnet_id = aws_subnet.sub-sandbox1a.id
  # private_ips = ["172.16.10.100"]

  tags = {
    Name      = "int-tc-amazlinux"
    Terraform = "True"
  }
}

# Adding a test Server
resource "aws_instance" "tc-amazlinux01" {
  ami                         = "ami-0e341fcaad89c3650"
  instance_type               = "t4g.small"
  key_name                    = aws_key_pair.deployer.key_name
  subnet_id                   = aws_subnet.sub-sandbox1a.id
  associate_public_ip_address = "true"
  security_groups = [
    aws_security_group.sandbox.id
  ]

  tags = {
    Name      = "tc-amazlinux01"
    Terraform = "True"
  }
}

输出

以下是运行的输出示例，一个 terraform apply 紧接着另一个 terraform plan，没有对 terraform 文件进行任何修改。

为了篇幅，它在这里： https://pastebin.com/raw/2Ly0NmVr

Answer 1

这可能是因为您的安全组不正确。

所以应该是：

resource "aws_instance" "tc-amazlinux01" {
  ami                         = "ami-0e341fcaad89c3650"
  instance_type               = "t4g.small"
  key_name                    = aws_key_pair.deployer.key_name
  subnet_id                   = aws_subnet.sub-sandbox1a.id
  associate_public_ip_address = "true"
  vpc_security_group_ids = [
    aws_security_group.sandbox.id
  ]

  tags = {
    Name      = "tc-amazlinux01"
    Terraform = "True"
  }
}

Terraform 重新部署 EC2 实例

Terraform redeploys EC2 instance

amazon-web-services

amazon-ec2

terraform

症状

Terraform 文件

vpc.tf

securitygroup.tf

ec2.tf

输出