为什么在 Terraform 中尝试 auto_accept vpc peering 时出现权限错误？

Question

我正在尝试在账户之间创建一个 VPC 对等点并自动接受它，但它失败并出现权限错误。

这里是 ma​​in.tf

中的 providers

provider "aws" {
  region                   = "${var.region}"
  shared_credentials_file  = "/Users/<username>/.aws/credentials"
  profile                  = "sandbox"
}

data "aws_caller_identity" "current" { }

这是 vpc_peer 模块：

resource "aws_vpc_peering_connection" "peer" {
      peer_owner_id              = "${var.peer_owner_id}"
      peer_vpc_id                = "${var.peer_vpc_id}"
      vpc_id                     = "${var.vpc_id}"
      auto_accept                = "${var.auto_accept}"

      accepter {
        allow_remote_vpc_dns_resolution = true
      }

      requester {
        allow_remote_vpc_dns_resolution = true
      }

      tags {
        Name = "VPC Peering between ${var.peer_vpc_id} and ${var.vpc_id}"
      }
}

这是maint.ft中的模块执行

module "peering" {
  source = "../modules/vpc_peer"

  region        = "${var.region}"
  peer_owner_id = "<management account number>"
  peer_vpc_id   = "<vpc-********>"
  vpc_id        = "${module.network.vpc_id}"
  auto_accept   = "true"
}

现在，我从“沙盒”提供商使用的 IAM 用户拥有在主账户中的 VPC 中进行 VPC 对等互连的权限。

我使用 AWS 的以下程序：http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

不幸的是，我一直失败并出现以下错误：

1 error(s) occurred:

* aws_vpc_peering_connection.peer: Unable to accept VPC Peering Connection: OperationNotPermitted: User 651267440910 cannot accept peering pcx-f9c55290
    status code: 400, request id: cfbe1163-241e-413b-a8de-d2bca19726e5

有什么想法吗？

Answer 1

我设法运行了一个接受对等体的 local_exec。

这是一个例子：

resource "aws_vpc_peering_connection" "peer" {

  peer_owner_id              = "${var.peer_owner_id}"
  peer_vpc_id                = "${var.peer_vpc_id}"
  vpc_id                     = "${var.vpc_id}"

  provisioner "local-exec" {
    command = "aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id=${aws_vpc_peering_connection.peer.id} --region=${var.region} --profile=${var.profile}"

  }

  tags {
    Name = "VPC Peering between ${var.peer_vpc_id} and ${var.vpc_id}"
  }
}

Answer 2

Terraform 中的auto_acceptargument 只能在同一账户的 VPC 上使用。来自documentation：

auto_accept -（可选）接受对等互连（两个 VPC 都需要在 同一个 AWS 账户）。

...

如果两个 VPC 不在同一个 AWS 账户中，请不要启用 auto_accept 属性。您仍然必须接受 VPC 对等互连 使用 AWS 管理控制台、AWS CLI、 通过 SDK 等。

因此，您只需在没有 auto_accept 的 terraform 中建立这一端的对等连接，然后在目标帐户中手动或以编程方式接受它。一些编程选项：

• AWS CLI：accept-vpc-peering-connection

• AWS API：AcceptVpcPeeringConnection

您选择的语言的 AWS 开发工具包也应该有一个匹配的方法。

Answer 3

VPC 对等将发生在具有相同帐户或不同帐户的同一区域，在双方都需要接受 VPC 对等才能从一个 vpc 访问另一个 vpc。

Answer 4

Latest doc example works fine for me（跨账户使用）

其他答案无效

terraform 版本示例 > 1

provider "aws" {
  alias = "requester"

  # Requester's credentials.
}

provider "aws" {
  alias = "accepter"

  # Accepter's credentials.
}

resource "aws_vpc" "main" {
  provider = aws.requester

  cidr_block = "10.0.0.0/16"

  enable_dns_support   = true
  enable_dns_hostnames = true
}

resource "aws_vpc" "peer" {
  provider = aws.accepter

  cidr_block = "10.1.0.0/16"

  enable_dns_support   = true
  enable_dns_hostnames = true
}

data "aws_caller_identity" "peer" {
  provider = aws.accepter
}

# Requester's side of the connection.
resource "aws_vpc_peering_connection" "peer" {
  provider = aws.requester

  vpc_id        = aws_vpc.main.id
  peer_vpc_id   = aws_vpc.peer.id
  peer_owner_id = data.aws_caller_identity.peer.account_id
  auto_accept   = false

  tags = {
    Side = "Requester"
  }
}

# Accepter's side of the connection.
resource "aws_vpc_peering_connection_accepter" "peer" {
  provider = aws.accepter

  vpc_peering_connection_id = aws_vpc_peering_connection.peer.id
  auto_accept               = true

  tags = {
    Side = "Accepter"
  }
}

resource "aws_vpc_peering_connection_options" "requester" {
  provider = aws.requester

  # As options can't be set until the connection has been accepted
  # create an explicit dependency on the accepter.
  vpc_peering_connection_id = aws_vpc_peering_connection_accepter.peer.id

  requester {
    allow_remote_vpc_dns_resolution = true
  }
}

resource "aws_vpc_peering_connection_options" "accepter" {
  provider = aws.accepter

  vpc_peering_connection_id = aws_vpc_peering_connection_accepter.peer.id

  accepter {
    allow_remote_vpc_dns_resolution = true
  }
}