AWS Terraform试图摧毁和重建RDS集群

Question

我有一个使用Terraform构建的RDS集群，目前正在运行删除保护。

当我更新Terraform脚本(例如，安全组更改)并将其运行到环境中时，它总是尝试崩溃并重新构建RDS集群。

现在使用删除保护运行此操作将停止重新构建，但会导致terraform apply失败，因为它无法破坏群集。

在每次运行脚本时，我如何才能保持现有的RDS集群而不进行重建呢？

`resource "aws_rds_cluster" "env-cluster" {
  cluster_identifier      = "mysql-env-cluster"
  engine                  = "aurora-mysql"
  engine_version          = "5.7.mysql_aurora.2.03.2"
  availability_zones      = ["${var.aws_az1}", "${var.aws_az2}"]
  db_subnet_group_name   = "${aws_db_subnet_group.env-rds-subg.name}"
  database_name           = "dbname"
  master_username         = "${var.db-user}"
  master_password         = "${var.db-pass}"
  backup_retention_period = 5
  preferred_backup_window = "22:00-23:00"
  deletion_protection     = true
  skip_final_snapshot     = true
 }

resource "aws_rds_cluster_instance" "env-01" {
  identifier              = "${var.env-db-01}"
  cluster_identifier      = "${aws_rds_cluster.env-cluster.id}"
  engine                  = "aurora-mysql"
  engine_version          = "5.7.mysql_aurora.2.03.2"
  instance_class          = "db.t2.small"
  apply_immediately       = true
}

resource "aws_rds_cluster_instance" "env-02" {
  identifier              = "${var.env-db-02}"
  cluster_identifier      = "${aws_rds_cluster.env-cluster.id}"
  engine                  = "aurora-mysql"
  engine_version          = "5.7.mysql_aurora.2.03.2"
  instance_class          = "db.t2.small"
  apply_immediately       = true
}

resource "aws_rds_cluster_endpoint" "env-02-ep" {
  cluster_identifier          = "${aws_rds_cluster.env-cluster.id}"
  cluster_endpoint_identifier = "reader"
  custom_endpoint_type        = "READER"

  excluded_members = ["${aws_rds_cluster_instance.env-01.id}"]
}`

Answer 1

在尝试设置AWS Aurora集群和实例时，我也有过类似的经验。

每次运行terraform apply时，它都会尝试重新创建Aurora集群和实例。

这是我的Terraform脚本：

locals {
  aws_region      = "eu-west-1"
  tag_environment = "Dev"
  tag_terraform = {
    "true"  = "Managed by Terraform"
    "false" = "Not Managed by Terraform"
  }
  tag_family = {
    "aurora" = "Aurora"
  }
  tag_number = {
    "1" = "1"
    "2" = "2"
    "3" = "3"
    "4" = "4"
  }
}

# RDS Cluster
module "rds_cluster_1" {
  source = "../../../../modules/aws/rds-cluster-single"

  rds_cluster_identifier              = var.rds_cluster_identifier
  rds_cluster_engine                  = var.rds_cluster_engine
  rds_cluster_engine_mode             = var.rds_cluster_engine_mode
  rds_cluster_engine_version          = var.rds_cluster_engine_version
  rds_cluster_availability_zones      = ["${local.aws_region}a"]
  rds_cluster_database_name           = var.rds_cluster_database_name
  rds_cluster_port                    = var.rds_cluster_port
  rds_cluster_master_username         = var.rds_cluster_master_username
  rds_cluster_master_password         = module.password.password_result
  rds_cluster_backup_retention_period = var.rds_cluster_backup_retention_period
  rds_cluster_apply_immediately       = var.rds_cluster_apply_immediately
  allow_major_version_upgrade         = var.allow_major_version_upgrade
  db_cluster_parameter_group_name     = var.rds_cluster_parameter_group_name
  rds_cluster_deletion_protection     = var.rds_cluster_deletion_protection
  enabled_cloudwatch_logs_exports     = var.enabled_cloudwatch_logs_exports
  skip_final_snapshot                 = var.skip_final_snapshot
  # vpc_security_group_ids              = var.vpc_security_group_ids
  tag_environment = local.tag_environment
  tag_terraform   = local.tag_terraform.true
  tag_number      = local.tag_number.1
  tag_family      = local.tag_family.aurora
}

，这是我怎么解决的，

问题是，每次我运行terraform apply Terraform时，都会尝试检查在两个子网中重新创建资源：

Terraform detected the following changes made outside of Terraform since the last "terraform apply":

  # module.rds_cluster_1.aws_rds_cluster.main has changed
  ~ resource "aws_rds_cluster" "main" {
      ~ availability_zones                  = [
          + "eu-west-1b",
          + "eu-west-1c",
            # (1 unchanged element hidden)
        ]
      ~ cluster_members                     = [
          + "aurora-postgres-instance-0",

但是，我的terraform脚本只指定了一种可用性(rds_cluster_availability_zones = ["${local.aws_region}a") )。我所要做的就是为我的区域指定所有三个可用性区域(rds_cluster_availability_zones = ["${local.aws_region}a", "${local.aws_region}b", "${local.aws_region}c"])：

locals {
  aws_region      = "eu-west-1"
  tag_environment = "Dev"
  tag_terraform = {
    "true"  = "Managed by Terraform"
    "false" = "Not Managed by Terraform"
  }
  tag_family = {
    "aurora" = "Aurora"
  }
  tag_number = {
    "1" = "1"
    "2" = "2"
    "3" = "3"
    "4" = "4"
  }
}

# RDS Cluster
module "rds_cluster_1" {
  source = "../../../../modules/aws/rds-cluster-single"

  rds_cluster_identifier              = var.rds_cluster_identifier
  rds_cluster_engine                  = var.rds_cluster_engine
  rds_cluster_engine_mode             = var.rds_cluster_engine_mode
  rds_cluster_engine_version          = var.rds_cluster_engine_version
  rds_cluster_availability_zones      = ["${local.aws_region}a", "${local.aws_region}b", "${local.aws_region}c"]
  rds_cluster_database_name           = var.rds_cluster_database_name
  rds_cluster_port                    = var.rds_cluster_port
  rds_cluster_master_username         = var.rds_cluster_master_username
  rds_cluster_master_password         = module.password.password_result
  rds_cluster_backup_retention_period = var.rds_cluster_backup_retention_period
  rds_cluster_apply_immediately       = var.rds_cluster_apply_immediately
  allow_major_version_upgrade         = var.allow_major_version_upgrade
  db_cluster_parameter_group_name     = var.rds_cluster_parameter_group_name
  rds_cluster_deletion_protection     = var.rds_cluster_deletion_protection
  enabled_cloudwatch_logs_exports     = var.enabled_cloudwatch_logs_exports
  skip_final_snapshot                 = var.skip_final_snapshot
  # vpc_security_group_ids              = var.vpc_security_group_ids
  tag_environment = local.tag_environment
  tag_terraform   = local.tag_terraform.true
  tag_number      = local.tag_number.1
  tag_family      = local.tag_family.aurora
}

Resources：Terraform希望在每个应用程序#8上重新创建集群

Answer 2

如果您不想在三个区域中使用RDS，这里有一个解决方法：https://github.com/hashicorp/terraform-provider-aws/issues/1111#issuecomment-373433010