AWS SG自我参考解析不同环境

Question

我想让它对不同的环境(Dev,UAT,PROD)更加模块化，在这种情况下，我认为我应该使用SG("App${local.environment}sec_group")的'name'，或者只使用Sec_group？ 这里它能解决source_security_group_id的问题吗？

resource "aws_security_group" "sec_group" {
name   = "App${local.environment}sec_group"
vpc_id = "${local.vpc_id}"
} resource "aws_security_group_rule" "sec_group_allow_1865" {
type              = "ingress"
from_port         = 1865
to_port           = 1865 
protocol          = "tcp" 
security_group_id = "${aws_security_group.sec_group.id}" 
source_security_group_id = "${aws_security_group.App${local.environment}sec_group.id}" ''' 
}

Variable.tf 文件:-

environment = "${lookup(var.ws_to_environment_map, terraform.workspace, var.default_environment)}"
vpc_id = "${lookup(var.ws_to_vpc_map, terraform.workspace, var.default_environment)}"
variable "default_environment" {
default = "dev"
}
variable "ws_to_vpc_map" {
type = "map"
default = {
dev = "vpc-03a05d67831e1ff035"
uat  = ""
prod = ""
}
}
variable "ws_to_environment_map" {
type = "map"
default = {
dev = "DEV"
uat  = "UAT"
prod = "PROD"
}
}

Answer 1

这里你可以使用

source_security_group_id = "${aws_security_group.sec_group.id}"

而不是

source_security_group_id = "${aws_security_group.App${local.environment}sec_group.id}"

aws_security_group.sec_group指的是以 "sec_group "名称创建的安全组资源（资源 "aws_security_group" "sec_group")和aws_security_group.sec_group.id会得到它的id。