创建 AWS 路由表以使子网可公开访问时 Terraform“不支持路由目标”

Question

使用 terraform v0.12.21 和 AWS provider v2.51.0，我试图从头开始创建一些基础设施（没有以前的 terraform 状态）。

目标是在单个 VPC 中拥有一些可公开访问的 EC2 实例，我认为这些是我需要完成的资源：

• 专有网络
• VPC中的互联网网关
• VPC 中的子网
• VPC 中用于将子网连接到 Internet 网关的路由表
• 将子网连接到路由表的路由表关联
• VPC中的一个安全组，将为实例设置
• 多个 EC2 实例

使用这个 terraform 配置：

locals {
  office_cidr = ["x.x.x.x/32", "x.x.x.x/32"]
}

provider "aws" {
  region  = var.region
  version = "~> 2.51"
}

resource "aws_vpc" "main" {
  cidr_block       = "10.0.0.0/16"
  instance_tenancy = "default"
}

resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.main.id
}

resource "aws_subnet" "main" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_route_table" "r" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = aws_subnet.main.cidr_block
    gateway_id = aws_internet_gateway.gw.id
  }
}

resource "aws_route_table_association" "a" {
  subnet_id      = aws_subnet.main.id
  route_table_id = aws_route_table.r.id
}


resource "aws_security_group" "allow_http" {
  name        = "security group"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = local.office_cidr
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = local.office_cidr
  }

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = local.office_cidr
  }
}

resource "aws_instance" "a" {
  ami                         = "ami-xxxxxxxxxxxxxxxxx"
  instance_type               = "t2.micro"
  vpc_security_group_ids      = ["${aws_security_group.allow_http.id}"]
  subnet_id                   = aws_subnet.main.id
  associate_public_ip_address = true
}
resource "aws_instance" "b" {
  ami                         = "ami-xxxxxxxxxxxxxxxxx"
  instance_type               = "t2.micro"
  vpc_security_group_ids      = ["${aws_security_group.allow_http.id}"]
  subnet_id                   = aws_subnet.main.id
  associate_public_ip_address = true
}

当我计划它时，一切似乎没问题（这里只显示aws_route_table计划输出的一部分）：

# aws_route_table.r will be created


 + resource "aws_route_table" "r" {
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = [
          + {
              + cidr_block                = "10.0.1.0/24"
              + egress_only_gateway_id    = ""
              + gateway_id                = (known after apply)
              + instance_id               = ""
              + ipv6_cidr_block           = ""
              + nat_gateway_id            = ""
              + network_interface_id      = ""
              + transit_gateway_id        = ""
              + vpc_peering_connection_id = ""
            },
        ]
      + vpc_id           = (known after apply)
    }

在aws_subnet.main.cidr_block对输入cidr_block的route内插来"10.0.1.0/24"。

但是当我申请时，我收到此错误：

Error: Error creating route: InvalidParameterValue: Route target is not supported. This route only supports interface and instance targets.
status code: 400, request id: a303e768-69e2-4af0-88d4-e97ebcaeae5d

  on main.tf line 38, in resource "aws_route_table" "r":
  38: resource "aws_route_table" "r" {

“接口目标”是指网络接口吗？如果是这样，是在创建 VPC 时自动创建网络接口，还是应该创建一个aws_network_interface 资源并将 Internet 网关连接到该资源？

基本上，我想知道在需要具有公共 IP 地址并且可公开访问的子网上创建实例的最佳实践，是否不需要我的任何资源，以及我是否缺少通常包含的任何资源.

但是就这个问题而言：我应该如何更改aws_route_table资源块和任何其他资源块，以解决此错误并使我的实例可以公开访问？

Answer 1

如果在路由中使用 Internet 网关 gateway_id = aws_internet_gateway.gw.id，则对于此类路由，cidr_block 必须为 0.0.0.0/0 但不是 aws_subnet.main.cidr_block