如何在 terraform 工作区中使用资源引用？答案

【问题标题】：How to use resource reference into terraform workspace?如何在 terraform 工作区中使用资源引用？
【发布时间】：2020-07-01 02:13:51
【问题描述】：

目前，我正在使用 terraform 工作区将相同的代码部署到多个环境中。但是现在我被困在特定工作区中的资源引用中。

代码示例

resource "aws_security_group" "testing-ec2" {
  name = "${local.env}-testing-ec2"
  vpc_id = "${aws_vpc.vpc.id}"
  ingress {
    from_port = 8080
    to_port = 8080
    protocol = "tcp"
    security_groups = ["${local.security-groups}"]
  }
  ingress {
    from_port = 22
    to_port = 22
    protocol = "tcp"
    cidr_blocks = ["${local.bastion_ip}"]
  }
  egress {
    from_port = 0
    to_port = 0
    protocol = -1
    cidr_blocks = ["0.0.0.0/0"]
  }
}

工作区安全组

local {
tf_security-groups = {
   dev = ""
   stg = "${aws_security_group.test-private-alb.id}"
   qa = "${aws_security_group.test1-private-alb.id}"
   prod = "${aws_security_group.test2-private-alb.id}"
 }
 security-groups = "${lookup(local.tf_security-groups,local.env)}"
}

当我尝试应用到 stg 工作区时，会出现此错误

* local.tf_security-groups: local.tf_security-groups: Resource 'aws_security_group.test1-private-alb' not found for variable 'aws_security_group.test1-private-alb.id'

【问题讨论】：

标签： terraform

【解决方案1】：

您可以使用数据源 terraform_remote_state 来筛选状态，但您还必须将每个安全组 ids 设为输出。

data "terraform_remote_state" "this" {
  backend = "s3"

  workspace = "stg"

  config {
    bucket = ""
    key    = ""
    region = ""
  }
}

改用aws_security_group 数据源会更简洁。

locals {
  env = "qa"

  security_group_map = {
    stg  = data.aws_security_group.test_private_alb.id
    qa   = data.aws_security_group.test1_private_alb.id
    prod = data.aws_security_group.test2_private_alb.id
  }

  security_groups = lookup(local.security_group_map, local.env, "")
}

data "aws_security_group" "test_private_alb" {
  name = "test_private_alb"
}

data "aws_security_group" "test1_private_alb" {
  name = "test1_private_alb"
}

data "aws_security_group" "test2_private_alb" {
  name = "test2_private_alb"
}

【讨论】：