选择CIDR块

Question

在我使用CIDR模块的方式上，我很难理解它们。我的理解是(可能是错误的)，它们是为您的环境保留一系列IP地址的一种方式，您可以跨应用程序分配它们。但我不能让它在我的案子里起作用。我用地形来管理一个简单的环境。包含Lambda和RDS实例的VPC。RDS不会被公开访问，lambda将被HTTP触发器调用。每个Lambda和RDS实例都需要自己的子网，RDS需要两个子网。我在terraform中有这样的配置，但由于这个错误和类似的错误，它一直失败：

The new Subnets are not in the same Vpc as the existing subnet group

所建立的地形是：

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"

  tags = {
    Name = "vpc"
  }
}

resource "aws_subnet" "rds_subnet_1a" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "eu-west-1a"

  tags = {
    Name = "rds_subnet_1a"

  }
}

resource "aws_subnet" "rds_subnet_1b" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "eu-west-1b"

  tags = {
    Name = "rds_subnet_1b"
  }
}

resource "aws_subnet" "lambda_subnet_1a" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.3.0/24"
  availability_zone = "eu-west-1a"

  tags = {
    Name = "lambda_subnet_1a"
  }
}


resource "aws_db_subnet_group" "default" {
  name       = "main"
  subnet_ids = [aws_subnet.rds_subnet_1a.id, aws_subnet.rds_subnet_1b.id]
  tags = {
    Name = "My DB subnet group"
  }
}

resource "aws_security_group" "rds" {
  name   = "rds-sg"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]
  }

  egress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]
  }

  tags = {
    Name = "rds-sg"
  }
}

resource "aws_security_group" "lambda" {
  name   = "lambda_sg"
  vpc_id = aws_vpc.main.id

  ingress {
    protocol  = -1
    self      = true
    from_port = 0
    to_port   = 0
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["10.0.0.0/16"]
  }

  tags = {
    Name = "lambda_sg"
  }
}

我知道这是基本的，但我只是认为，如果我得到一些答案，我的情况，它可能会帮助我更好地理解概念。

编辑- lambda配置：

resource "aws_lambda_function" "api_uprn" {
  function_name = "api-uprn"

  s3_bucket = aws_s3_bucket.lambdas_bucket.id
  s3_key    = "api-uprn/function_0.0.8.zip"

  runtime = "python3.9"
  handler = "app.main.handler"

  role = aws_iam_role.lambda_exec.arn

  vpc_config {
    subnet_ids         = [aws_subnet.subnet_1a.id]
    security_group_ids = [aws_security_group.lambda.id]

  }
}

resource "aws_cloudwatch_log_group" "api_uprn" {
  name = "/aws/lambda/${aws_lambda_function.api_uprn.function_name}"

  retention_in_days = 30
}

resource "aws_iam_role" "lambda_exec" {
  name = "api_uprn"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Sid    = ""
      Principal = {
        Service = "lambda.amazonaws.com"
      }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "lambda_policy" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "aws_iam_role_policy_attachment" "rds_read" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess"
}

resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
}

Answer 1

请您在这里张贴，完全错误？它将更容易理解是什么状态抛出错误！

我的提示是，您需要在lambda配置中更改您的subnet_ids。据我所知，您的lambda配置应该如下所示：

resource "aws_lambda_function" "api_uprn" {
  function_name = "api-uprn"

  s3_bucket = aws_s3_bucket.lambdas_bucket.id
  s3_key    = "api-uprn/function_0.0.8.zip"

  runtime = "python3.9"
  handler = "app.main.handler"

  role = aws_iam_role.lambda_exec.arn

  vpc_config {
    subnet_ids         = [aws_subnet. lambda_subnet_1a.id]
    security_group_ids = [aws_security_group.lambda.id]
  }
}