为什么我在申请后无法连接到我的 ec2 实例？

Question

我已经将我的第一个 terraform 脚本放在一起，用于在 AWS 上进行资产配置。但是，我无法连接到公有子网中的 EC2 实例

我可以看到所有预期的资源都已创建：子网/实例/路由表/网关等

我已经排除了 provider.tf，因为它包含敏感的秘密。

我的地区是 ap-south-1。

resource "aws_vpc" "vpc1" {
  cidr_block = "10.20.0.0/16"
  tags = {
    name = "tf_vpc"
  }
}

# subnets below
resource "aws_subnet" "subnet_public"{
  vpc_id  = "${aws_vpc.vpc1.id}"
  cidr_block = "10.20.10.0/24"
  availability_zone = "ap-south-1a"

  map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_private"{
  vpc_id  = "${aws_vpc.vpc1.id}"
  cidr_block = "10.20.20.0/24"
  availability_zone = "ap-south-1a"
}

resource "aws_security_group" "sg-web" {
  name ="allow80"
  description="allows traffic on port 80"
  vpc_id ="${aws_vpc.vpc1.id}"

  ingress{
    from_port = 80
    to_port   = 80
    protocol  = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress{
    from_port = 22
    to_port   = 22
    protocol  = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    name="allowhttp"
  }
}

resource "aws_default_route_table" "public" {
  default_route_table_id = "${aws_vpc.vpc1.main_route_table_id}"

  tags = {
    name = "route-default"
  }
}

resource "aws_internet_gateway" "ig"{
  vpc_id = "${aws_vpc.vpc1.id}"
}

resource "aws_route_table" "route_public"{
  vpc_id = "${aws_vpc.vpc1.id}"
}

resource "aws_route" "r1" {
  route_table_id = "${aws_route_table.route_public.id}"
  destination_cidr_block = "0.0.0.0/16"
  gateway_id = "${aws_internet_gateway.ig.id}"
}

resource "aws_route_table_association" "public" {
  subnet_id = "${aws_subnet.subnet_public.id}"
  route_table_id = "${aws_route_table.route_public.id}"
}

resource "aws_instance" "ins1_web"{
  ami = "ami-0447a12f28fddb066"
  instance_type = "t2.micro"
  subnet_id = "${aws_subnet.subnet_public.id}"
  vpc_security_group_ids = ["${aws_security_group.sg-web.id}"]

  key_name = "myBOMkey-2"

  tags = {
    name="tf-1"
  } 
} 

resource "aws_instance" "ins1_db"{
  ami = "ami-0447a12f28fddb066"
  instance_type = "t2.micro"
  subnet_id = "${aws_subnet.subnet_private.id}"
  vpc_security_group_ids = ["${aws_security_group.sg-web.id}"]

  key_name = "myBOMkey-2"

  tags = {
    name="tf-1"
  } 
} 

为什么我在申请后无法连接到我的 ec2 实例？

Answer 1

看看CIDR（0.0.0.0/16），好像不太对。可能是笔误。Any-IP 用 "0.0.0.0/0" 表示，因为 any-IP 目的地需要路由到 Internet 网关。

resource "aws_route" "r1" {
  route_table_id = "${aws_route_table.route_public.id}"
  destination_cidr_block = "0.0.0.0/0"
  gateway_id = "${aws_internet_gateway.ig.id}"
}

您的安全组配置中还缺少出口（出站）流量，因为 terraform 不会将允许的所有流量作为出站流量中的默认值。请参阅 terraform 安全组文档。

egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

希望这可以帮助 ！