EC2有两个接口（一个公共接口和一个专用接口）

Question

我基本上想要一个EC2，一个接口在公共子网，一个在私有子网。我应该能够通过公共接口从外界SSH，私有网络将用于与私有网络中的数据库通信。

在地形上。。。

• 我在该 VPC 中创建了一个 VPC，两个子网（一个公共子网，一个私有子网）。
• 创建了一个互联网网关，即 VPC 中的路由表，其路由为 0.0.0.0/0 至 IGW
• 已在与公有子网和路由表之间创建路由关联。
• 已创建一个 EC2 实例，其中一个接口位于公有子网中，另一个接口位于私有子网中。
• 在 EC2 的公有接口上创建了弹性 IP 地址
• 已创建允许 ssh 端口的安全组 （22）

我不能SSH，连接超时，谁能看看这个？

conf_vpc_cidr_block = "10.100.0.0/16"
conf_vpc_enable_dns_support = "true"
conf_vpc_enable_dns_hostnames =  "true"
conf_vpc_enable_classiclink =  "false"
conf_vpc_instance_tenancy = "default"

conf_private_subnet_cidr_block = "10.100.100.0/24"
conf_private_subnet_map_public_ip_on_launch = "false"
conf_private_subnet_availability_zone = "eu-north-1a"

conf_public_subnet_cidr_block = "10.100.200.0/24"
conf_public_subnet_map_public_ip_on_launch = "true"
conf_public_subnet_availability_zone = "eu-north-1a"

conf_instance_ami = "ami-000e50175c5f86214"
conf_instance_type = "t3.micro"

provider "aws" {
  region = var.conf_aws_region
  profile = var.conf_aws_profile
}

resource "aws_vpc" "Terraform_XX_VPC" {
  cidr_block = var.conf_vpc_cidr_block
  enable_dns_support = var.conf_vpc_enable_dns_support
  enable_dns_hostnames =  var.conf_vpc_enable_dns_hostnames
  enable_classiclink =  var.conf_vpc_enable_classiclink
  instance_tenancy = var.conf_vpc_instance_tenancy

}

resource "aws_subnet" "Terraform_XX_Private_SN" {
  vpc_id = "${aws_vpc.Terraform_XX_VPC.id}"
  cidr_block = var.conf_private_subnet_cidr_block
  map_public_ip_on_launch = var.conf_private_subnet_map_public_ip_on_launch
  availability_zone = var.conf_private_subnet_availability_zone

}


resource "aws_subnet" "Terraform_XX_Public_SN" {
  vpc_id = "${aws_vpc.Terraform_XX_VPC.id}"
  cidr_block = var.conf_public_subnet_cidr_block
  map_public_ip_on_launch = var.conf_public_subnet_map_public_ip_on_launch
  availability_zone = var.conf_public_subnet_availability_zone

}


resource "aws_internet_gateway" "Terraform_XX_IGW" {
  vpc_id = "${aws_vpc.Terraform_XX_VPC.id}"

}


resource "aws_route_table" "Terraform_XX_Route_Public" {
  vpc_id = "${aws_vpc.Terraform_XX_VPC.id}"

  route {
    cidr_block =  "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.Terraform_XX_IGW.id}"
  }

}


resource "aws_route_table_association" "Terraform_XX_Route_Table_Public_Association" {

  subnet_id      = "${aws_subnet.Terraform_XX_Public_SN.id}"
  route_table_id = "${aws_route_table.Terraform_XX_Route_Public.id}"
}


resource "aws_security_group" "Terraform_XX_SG_ALLOW_SSH" {
  name        = "Terraform_XX_SG_ALLOW_SSH"
  description = "Allow SSH"
  vpc_id      = "${aws_vpc.Terraform_XX_VPC.id}"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "Terraform_XX_EC2" {
  ami = var.conf_instance_ami
  instance_type = var.conf_instance_type
  key_name = "${local.environmentLC}"

  network_interface  {
    device_index         = 0
    network_interface_id = "${aws_network_interface.Terraform_XX_EC2_Private_Intf.id}"
    #delete_on_termination = true
  }
  network_interface  {
    device_index         = 1
    network_interface_id = "${aws_network_interface.Terraform_XX_EC2_Public_Intf.id}"
    #delete_on_termination = true
  }

}

resource "aws_network_interface" "Terraform_XX_EC2_Private_Intf" {
  subnet_id       = "${aws_subnet.Terraform_XX_Private_SN.id}"
  private_ips     = ["10.100.100.5"]
  security_groups = [aws_security_group.Terraform_XX_SG_ALLOW_SSH.id]
}

resource "aws_network_interface" "Terraform_XX_EC2_Public_Intf" {
  subnet_id       = "${aws_subnet.Terraform_XX_Public_SN.id}"
  private_ips     = ["10.100.200.5"]
  security_groups = [aws_security_group.Terraform_XX_SG_ALLOW_SSH.id]
}

resource "aws_eip" "Terraform_XX_EC2_EIP" {
  vpc             = true
  network_interface = "${aws_network_interface.Terraform_XX_EC2_Public_Intf.id}"
}

Answer 1

我可以通过将device_index交换为公共和私有接口来解决这个问题