如何使用 terraform 将 AWS Lambda fn 附加到现有 vpc？

Question

TLDR：我们使用 Terraform 部署 Lambda 函数。新的 lambda 需要将 VPC 附加到现有 VPC。如何在 terraform 中定义此网络附件？我当前的解决方案通过了所有 terraform 步骤，但是在控制台中检查我的 Lambda 时，它没有连接到任何 VPC。

我发现this article Deploy AWS Lambda to VPC with Terraform 很有见地，但该示例涉及添加一个新 VPC（带有子网、安全组等），而不是附加到现有 VPC，现有子网、安全组等

这是我目前的解决方案。从我项目的 main.tf 我调用一个模块...

module "lambda" {
    source = "git::https://corpsource.io/corp-cloud-platform-team/corpcloudv2/terraform/lambda-modules.git?ref=dev" 
    lambda_name = var.name
    lambda_role = "arn:aws:iam::${var.ACCOUNT}:role/${var.lambda_role}"
    lambda_handler = var.handler
    lambda_runtime = var.runtime
    default_lambda_timeout = var.timeout
    ACCOUNT = var.ACCOUNT
    vpc_subnet_ids = "${var.SUBNET_IDS}"
    vpc_security_group_ids = "${var.SECURITY_GROUP_IDS}"
}

这是模块：

resource "aws_lambda_function" "lambda_function" {
  filename         = "lambda_package.zip"
  function_name    = var.lambda_name
  role             = var.lambda_role
  handler          = var.lambda_handler
  runtime          = var.lambda_runtime
  memory_size      = 256
  timeout          = var.default_lambda_timeout
  source_code_hash = filebase64sha256("lambda_code/lambda_package.zip")
  vpc_config {
    subnet_ids = var.vpc_subnet_ids
    security_group_ids = var.vpc_security_group_ids
  }
}

它顺利通过了所有 Terraform 步骤，但似乎没有将我的 Lambda 附加到 VPC。我做错了什么？

提前致谢。

更新：

Terraform Plan 的输出：

$ terraform plan
Acquiring state lock. This may take a few moments...
module.lambda.aws_lambda_function.lambda_function: Refreshing state... [id=create-vault-entry]
module.lambda_iam.aws_iam_policy.base_policy: Refreshing state... [id=arn:aws:iam::############:policy/create-vault-entry-role]
module.lambda_iam.aws_iam_role.module_role: Refreshing state... [id=create-vault-entry-role]
module.lambda_iam.aws_iam_role_policy_attachment.lambda_attach: Refreshing state... [id=create-vault-entry-role-############################]
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place
Terraform will perform the following actions:
  # module.lambda.aws_lambda_function.lambda_function will be updated in-place
  ~ resource "aws_lambda_function" "lambda_function" {
        id                             = "create-vault-entry"
      ~ last_modified                  = "2022-01-11T19:48:18.000+0000" -> (known after apply)
      ~ source_code_hash               = "g/hash/hash=" -> "hash/hash"
        tags                           = {}
        # (18 unchanged attributes hidden)
        # (2 unchanged blocks hidden)
    }
Plan: 0 to add, 1 to change, 0 to destroy.
Warning: Interpolation-only expressions are deprecated
  on main.tf line 3, in locals:
   3:     vault_HOST = "${var.vault_HOST}",
Terraform 0.11 and earlier required all non-constant expressions to be
provided via interpolation syntax, but this pattern is now deprecated. To
silence this warning, remove the "${ sequence from the start and the }"
sequence from the end of this expression, leaving just the inner expression.
Template interpolation syntax is still used to construct strings from
expressions when the template includes multiple interpolation sequences or a
mixture of literal strings and interpolations. This deprecation applies only
to templates that consist entirely of a single interpolation sequence.
(and 5 more similar warnings elsewhere)

Answer 1

您似乎正在将列表转换为字符串。 Lambda VPC subnet_ids 和 security_group_ids 属性需要一个列表，而不是字符串。我真的不确定您当前的代码是如何工作的而没有报告任何错误。

看起来你需要改变这个：

vpc_subnet_ids = "${var.SUBNET_IDS}"
vpc_security_group_ids = "${var.SECURITY_GROUP_IDS}"

到这里：

vpc_subnet_ids = var.SUBNET_IDS
vpc_security_group_ids = var.SECURITY_GROUP_IDS