创建AWS路由表以公开访问子网时，Terraform"不支持路由目标"

Question

使用terraform v0。12.21和AWS供应商v2。51.0，我正在尝试从头开始创建一些基础设施（没有以前的地形状态）。

我们的目标是在一个VPC中拥有一些可公开访问的EC2实例，我认为这些是实现这一目标所需的资源：

• VPC
• VPC中的互联网网关
• VPC中的子网
• VPC中连接子网到Internet网关的路由表
• 将子网连接到路由表的路由表关联
• VPC中的安全组，将为实例设置
• 多个EC2实例

使用这个terraform配置：

locals {
  office_cidr = ["x.x.x.x/32", "x.x.x.x/32"]
}

provider "aws" {
  region  = var.region
  version = "~> 2.51"
}

resource "aws_vpc" "main" {
  cidr_block       = "10.0.0.0/16"
  instance_tenancy = "default"
}

resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.main.id
}

resource "aws_subnet" "main" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_route_table" "r" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = aws_subnet.main.cidr_block
    gateway_id = aws_internet_gateway.gw.id
  }
}

resource "aws_route_table_association" "a" {
  subnet_id      = aws_subnet.main.id
  route_table_id = aws_route_table.r.id
}


resource "aws_security_group" "allow_http" {
  name        = "security group"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = local.office_cidr
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = local.office_cidr
  }

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = local.office_cidr
  }
}

resource "aws_instance" "a" {
  ami                         = "ami-xxxxxxxxxxxxxxxxx"
  instance_type               = "t2.micro"
  vpc_security_group_ids      = ["${aws_security_group.allow_http.id}"]
  subnet_id                   = aws_subnet.main.id
  associate_public_ip_address = true
}
resource "aws_instance" "b" {
  ami                         = "ami-xxxxxxxxxxxxxxxxx"
  instance_type               = "t2.micro"
  vpc_security_group_ids      = ["${aws_security_group.allow_http.id}"]
  subnet_id                   = aws_subnet.main.id
  associate_public_ip_address = true
}

当我计划它时，一切看起来都很好（这里只显示计划输出的aws_route_table部分）：

# aws_route_table.r will be created


 + resource "aws_route_table" "r" {
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = [
          + {
              + cidr_block                = "10.0.1.0/24"
              + egress_only_gateway_id    = ""
              + gateway_id                = (known after apply)
              + instance_id               = ""
              + ipv6_cidr_block           = ""
              + nat_gateway_id            = ""
              + network_interface_id      = ""
              + transit_gateway_id        = ""
              + vpc_peering_connection_id = ""
            },
        ]
      + vpc_id           = (known after apply)
    }

aws\u子网。主要的cidr_块在路径中的cidr_块的输入插入到“10.0.1.0/24”。

但是当我申请时，我得到了这个错误：

Error: Error creating route: InvalidParameterValue: Route target is not supported. This route only supports interface and instance targets.
status code: 400, request id: a303e768-69e2-4af0-88d4-e97ebcaeae5d

  on main.tf line 38, in resource "aws_route_table" "r":
  38: resource "aws_route_table" "r" {

“接口目标”指的是网络接口吗？如果是这样，是在创建专有网络时自动创建网络接口，还是我也应该创建aws\u network\u interface资源并将internet网关连接到该资源？

基本上，我想知道在一个子网上创建实例的最佳实践，该子网上的实例需要有公共IP地址并可公开访问，是否不需要我的任何资源，以及我是否缺少通常包含的任何资源。

但是对于这个问题：我应该如何更改aws_route_table资源块和任何其他资源块，以解决这个错误并使其可以公开访问？




Answer 1

把cidr_block改成"0.0.0.0/0"而不是"10.0.1.0/24"对我有用。像这样：

resource "aws_route_table" "prod-rt" {
vpc_id = aws_vpc.prod-vpc.id

route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.prod-gw.id
}

route {
ipv6_cidr_block        = "::/0"
gateway_id = aws_internet_gateway.prod-gw.id
}

tags = {
Name = "prod-rt"
}
}

Answer 2

如果在路由中使用互联网网关gateway_id=aws_internet_gateway.gw.id，对于这样的路由cidr_block必须0.0.0.0/0但不能aws_subnet.main.cidr_block