2

我在为每个子网创建的 VPC 中建立了公共子网和私有子网。我现在正在尝试为子网和 nat 网关创建路由表，专门用于访问私有实例。我的子网、路由表和公共子网关联工作正常。我无法让我的私有子网附加到将其连接到 NAT 网关的路由表。我相信我的逻辑是正确的。我的 NAT 网关位于我的公共子网中。唯一的问题是私有子网附加到连接到 NAT 网关的路由表。以下是我的代码，不胜感激。

resource "aws_route_table" "public" {
  for_each = var.pub_subnet
  vpc_id   = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = var.rt_tags
  }
}

resource "aws_route_table_association" "public" {
  for_each       = aws_subnet.public
  route_table_id = aws_route_table.public[each.key].id
  subnet_id      = each.value.id
}

resource "aws_route_table_association" "nat" {
  for_each       = aws_subnet.private
  route_table_id = aws_route_table.nat[each.key].id
  subnet_id      = each.value.id
}

resource "aws_route_table" "nat" {
  for_each = var.pub_subnet
  vpc_id   = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_nat_gateway.main[each.key].id
  }

  tags = {
    Name = var.rt_tags_private
  }
}

resource "aws_subnet" "public" {
  for_each                = var.pub_subnet
  vpc_id                  = aws_vpc.main.id
  cidr_block              = each.value.cidr_block
  availability_zone       = each.value.availability_zone
  map_public_ip_on_launch = true
  tags = {
    Name = each.key
  }
}

resource "aws_subnet" "private" {
  for_each                = var.priv_subnet
  vpc_id                  = aws_vpc.main.id
  cidr_block              = each.value.cidr_block
  availability_zone       = each.value.availability_zone
  map_public_ip_on_launch = false
  tags = {
    Name = each.key
  }
}

变量

variable "pub_subnet" {
  type = map(object({
    cidr_block        = string
    availability_zone = string
  }))
  default = {
    "PubSub1" = {
      cidr_block        = "10.0.1.0/24"
      availability_zone = "us-west-1a"
    }
  }
}

variable "priv_subnet" {
  type = map(object({
    cidr_block        = string
    availability_zone = string
  }))
  default = {
    "PrivSub1" = {
      cidr_block        = "10.0.2.0/24"
      availability_zone = "us-west-1c"
    }
  }
}

错误

Error: Invalid index

  on vpc.tf line 61, in resource "aws_route_table_association" "nat":
  61:   route_table_id = aws_route_table.nat[each.key].id
    |----------------
    | aws_route_table.nat is object with 1 attribute "PubSub1"
    | each.key is "PrivSub1"

The given key does not identify an element in this collection value.

NAT网关

resource "aws_nat_gateway" "main" {
  for_each      = aws_subnet.public
  subnet_id     = each.value.id
  allocation_id = aws_eip.main[each.key].id
}

生态工业园

resource "aws_eip" "main" {
  for_each = aws_subnet.public
  vpc      = true

  lifecycle {
    create_before_destroy = true
  }
}
4

1 回答 1

1

您正在使用var.pub_subnet以下形式为 nat 定义路由表：

  "PubSub1" = {
      cidr_block        = "10.0.1.0/24"
      availability_zone = "us-west-1a"
    }

因此，要引用aws_route_table您必须使用PubSub1密钥。

但是，在您中，aws_route_table_association您正在迭代aws_subnet.private哪个具有PrivSub1.

更新

可以通过为私有=>公共子网名称创建本地映射来解决此问题，例如：

locals {
   private_public_mapping = zipmap(keys(var.priv_subnet), keys(var.pub_subnet))
}

resource "aws_route_table_association" "nat" {
  for_each       = aws_subnet.private
  route_table_id = aws_route_table.nat[local.private_public_mapping[each.key]].id
  subnet_id      = each.value.id
}
于 2020-08-12T22:47:06.743 回答