允許使用terraform訪問一個AWS安全組到另一個使用

Question

我想給一個安全組訪問另一個，但我無法讓它工作，有人可以指出我，我做錯了。

這裏是我的模塊的main.tf：

resource "aws_security_group" "rds_sg" { 
    name = "${var.name}-${var.environment}-rds" 
    description = "Security Group ${var.name}-${var.environment}" 
    vpc_id = "${var.vpc_id}" 
    tags { 
     Name = "${var.name}-${var.environment}-rds" 
     environment = "${var.environment}" 
    } 

    // allows traffic from the SG itself 
    ingress { 
     from_port = 0 
     to_port = 0 
     protocol = "-1" 
     self = true 
    } 

    // allow traffic for TCP 3306 
    ingress { 
     from_port = 3306 
     to_port = 3306 
     protocol = "tcp" 
     security_group_id = "${var.security_group_id}" 
    } 

    // outbound internet access 
    egress { 
     from_port = 0 
     to_port = 0 
     protocol = "-1" 
     cidr_blocks = ["0.0.0.0/0"] 
    } 
} 

output "rds_sg_id" { 
    value = "${aws_db_security_group.rds_sg.id}" 
} 

模塊的variables.tf：

// Module specific variables 
variable "name" { 
    default = "test" 
} 

variable "environment" { 
    default = "test" 
} 

variable "vpc_id" { 
    description = "The VPC this security group will go in" 
} 

variable "security_group_id" { 
    description = "Security Group id" 
} 

其中security_groups_id的價值在我的主文件來到另一個模塊，所以它是這樣的：

module "rds_sg" { 
    source = "./modules/rds_sg" 
    name = "tendo" 
    environment = "dev" 
    vpc_id = "${module.vpc_subnets.vpc_id}" 
    security_group_id = "${module.web_sg.web_sg_id}" 
} 

但是當我嘗試執行「terraform」，我得到這個錯誤：

Errors: 

    * 1 error(s) occurred: 

* module root: module rds_sg: security_group_id is not a valid parameter 

Answer 1

我想我已經找到了問題;您在模塊的main.tf中提供安全組時使用了錯誤的參數。請參閱下面的修改代碼和文檔here。

// allow traffic for TCP 3306 
ingress { 
    from_port = 3306 
    to_port = 3306 
    protocol = "tcp" 
    security_groups = ["${var.security_group_id}"] 
} 

Answer 2

輸出安全組作爲一個變量的ID。

output "rds_sg_id" { 
    value = "${aws_security_group.rds_sg.id}" 
} 

當使用安全組

// allow traffic for TCP 3306 
    ingress { 
     from_port = 3306 
     to_port = 3306 
     protocol = "tcp" 
     security_group_id = "${var.rds_sg_id}" 
    }