通过Terraform在两个不同的帐户中窥视VPC

Question

我试图在新加坡地区的两个不同的AWS帐户中建立一个vpc窥视连接。我遵循官方网站上的"vpc_peering_connection“和"vpc_peering_connection_accepter”的地形文档。这就是我的代码和失败：

请求者

resource "aws_vpc_peering_connection" "requester" {
   provider = aws.anhvq
   vpc_id = module.vpc.vpc_id
   peer_owner_id = "aws account id of accepter"
   # peer_region = "ap-southeast-1"
   peer_vpc_id = "vpc id of accepter"
   auto_accept = false

   tags = local.tags
   accepter {
   allow_remote_vpc_dns_resolution = true
 }
   requester {
   allow_remote_vpc_dns_resolution = true
 }
}

当我运行terraform plan时，没有什么会失败的。当运行terraform apply时，我会收到以下失败：

│ Error: Unable to modify peering options. The VPC Peering Connection "pcx-0e625f0fd4ef93696" is not active. 
Please set `auto_accept` attribute to `true`, or activate VPC Peering Connection manually. 
│
│   with aws_vpc_peering_connection.requester,
│   on vpc.tf line 49, in resource "aws_vpc_peering_connection" "requester":
│   49: resource "aws_vpc_peering_connection" "requester" {
│
╵

但是仍然创建了VPC窥视连接，并且我获得了VPC窥视ID。

受体

resource "aws_vpc_peering_connection_accepter" "accepter" {
    provider = aws.lamnx
    vpc_peering_connection_id = "pcx-0e625f0fd4ef93696"
    auto_accept = true
    accepter {
    allow_remote_vpc_dns_resolution = true
  }

结果:进行了terraform plan和terraform apply检查。

• 两个帐户中的VPC监视状态都是活动的。但是当我再次在terraform apply请求者中运行时，VPC窥视被破坏并被替换。

。

Answer 1

我决心自己。我在GitHub上读了一篇和我的一样的文章。所以我想和大家分享如何解决这个问题。原因是：

• Terraform不支持使用vpc查找不同帐户的DNS解析。它只支持vpc在一个帐户内窥视。
• 我使用resource "aws_vpc_peering_connection_options"修复它。这是我的工作代码：

resource "aws_vpc_peering_connection" "requester" {
    provider = aws.anhvq
    vpc_id = module.vpc.vpc_id
    peer_owner_id = "aws account id of accepter"
    # peer_region = "ap-southeast-1"
    peer_vpc_id = "vpc id of accepter"
    auto_accept = false

    tags = local.tags

}
resource "aws_vpc_peering_connection_accepter" "accepter" {
    provider = aws.lamnx
    vpc_peering_connection_id = "${aws_vpc_peering_connection.requester.id}"
    auto_accept = true

    tags = local.tags
}
resource "aws_vpc_peering_connection_options" "requester" {
    provider = aws.anhvq
  vpc_peering_connection_id = "${aws_vpc_peering_connection.requester.id}"

  requester {
    allow_remote_vpc_dns_resolution = true
  }
}
resource "aws_vpc_peering_connection_options" "accepter" {
  provider = aws.lamnx
  vpc_peering_connection_id = "${aws_vpc_peering_connection.requester.id}"

  accepter {
    allow_remote_vpc_dns_resolution = true
  }
}