每次执行“terraform apply/plan”时重新创建相同的安全组规则

Question

在不对 main.tf 进行任何更改的情况下，Terraform 添加已经存在的安全组规则。 Terrafrom 将 main.tf 中的每个 SG 规则标识为新规则（但这些规则已在 aws 中作为先前执行的结果）并在我执行命令时尝试重新创建它们（terrafrom plan/apply）

这是 terraform apply 命令的输出

~ module.application_sg.aws_security_group.security_group
    ingress.#:                            "3" => "1"
    ingress.2358522502.cidr_blocks.#:     "1" => "0"
    ingress.2358522502.cidr_blocks.0:     "20.0.1.0/24" => ""
    ingress.2358522502.from_port:         "443" => "0"
    ingress.2358522502.protocol:          "tcp" => ""
    ingress.2358522502.security_groups.#: "0" => "0"
    ingress.2358522502.self:              "false" => "false"
    ingress.2358522502.to_port:           "443" => "0"
    ingress.3250959853.cidr_blocks.#:     "1" => "0"
    ingress.3250959853.cidr_blocks.0:     "20.0.1.0/24" => ""
    ingress.3250959853.from_port:         "8080" => "0"
    ingress.3250959853.protocol:          "tcp" => ""
    ingress.3250959853.security_groups.#: "0" => "0"
    ingress.3250959853.self:              "false" => "false"
    ingress.3250959853.to_port:           "8080" => "0"
    ingress.753360330.cidr_blocks.#:      "0" => "0"
    ingress.753360330.from_port:          "0" => "0"
    ingress.753360330.protocol:           "-1" => "-1"
    ingress.753360330.security_groups.#:  "0" => "0"
    ingress.753360330.self:               "true" => "true"
    ingress.753360330.to_port:            "0" => "0"

+ module.rule1.aws_security_group_rule.rule
    cidr_blocks.#:            "1"
    cidr_blocks.0:            "20.0.1.0/24"
    from_port:                "80"
    protocol:                 "tcp"
    security_group_id:        "sg-17c13770"
    self:                     "false"
    source_security_group_id: "<computed>"
    to_port:                  "80"
    type:                     "ingress"

此规则已经存在。请帮助避免这种情况，因为当我们要向环境添加新规则时，这很难理解。

Answer 1

检查状态文件。这通常发生在 Terraform 已应用更改但尚未更新状态文件时。

您可以使用以下命令列出该位置的状态文件中的内容：

terraform state list

如果状态文件中缺少它，您应该能够使用 Terraform 的导入命令将预先存在的资源导入状态文件，如下所示：

terraform import aws_security_group.security_group sg-123456

Answer 2

不要将入口/出口规则放在aws_security_group 对象中。使用aws_security_group_rule管理规则。

例如。

resource "aws_security_group" "my-secret-group" {
  name = "my-secret-group"
  vpc_id = "vpc-12345678"
}

resource "aws_security_group_rule" "ssh-external-to-node" {
  type = "ingress"
  security_group_id = "${aws_security_group.my-secret-group.id}"
  from_port = 22
  to_port = 22
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
}

resource "aws_security_group_rule" "http-external-to-node" {
  type = "ingress"
  security_group_id = "${aws_security_group.my-secret-group.id}"
  from_port = 80
  to_port = 80
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
}