允许使用terraform访问一个AWS安全组到另一个使用

Question

我想给一个安全组访问另一个，但我无法让它工作，有人可以指出我，我做错了。

这里是我的模块的main.tf：

resource "aws_security_group" "rds_sg" { 
    name = "${var.name}-${var.environment}-rds" 
    description = "Security Group ${var.name}-${var.environment}" 
    vpc_id = "${var.vpc_id}" 
    tags { 
     Name = "${var.name}-${var.environment}-rds" 
     environment = "${var.environment}" 
    } 

    // allows traffic from the SG itself 
    ingress { 
     from_port = 0 
     to_port = 0 
     protocol = "-1" 
     self = true 
    } 

    // allow traffic for TCP 3306 
    ingress { 
     from_port = 3306 
     to_port = 3306 
     protocol = "tcp" 
     security_group_id = "${var.security_group_id}" 
    } 

    // outbound internet access 
    egress { 
     from_port = 0 
     to_port = 0 
     protocol = "-1" 
     cidr_blocks = ["0.0.0.0/0"] 
    } 
} 

output "rds_sg_id" { 
    value = "${aws_db_security_group.rds_sg.id}" 
} 

模块的variables.tf：

// Module specific variables 
variable "name" { 
    default = "test" 
} 

variable "environment" { 
    default = "test" 
} 

variable "vpc_id" { 
    description = "The VPC this security group will go in" 
} 

variable "security_group_id" { 
    description = "Security Group id" 
} 

其中security_groups_id的价值在我的主文件来到另一个模块，所以它是这样的：

module "rds_sg" { 
    source = "./modules/rds_sg" 
    name = "tendo" 
    environment = "dev" 
    vpc_id = "${module.vpc_subnets.vpc_id}" 
    security_group_id = "${module.web_sg.web_sg_id}" 
} 

但是当我尝试执行“terraform”，我得到这个错误：

Errors: 

    * 1 error(s) occurred: 

* module root: module rds_sg: security_group_id is not a valid parameter 

Answer 1

我想我已经找到了问题;您在模块的main.tf中提供安全组时使用了错误的参数。请参阅下面的修改代码和文档here。

// allow traffic for TCP 3306 
ingress { 
    from_port = 3306 
    to_port = 3306 
    protocol = "tcp" 
    security_groups = ["${var.security_group_id}"] 
} 

Answer 2

输出安全组作为一个变量的ID。

output "rds_sg_id" { 
    value = "${aws_security_group.rds_sg.id}" 
} 

当使用安全组

// allow traffic for TCP 3306 
    ingress { 
     from_port = 3306 
     to_port = 3306 
     protocol = "tcp" 
     security_group_id = "${var.rds_sg_id}" 
    }