使用Terraform部署AWS站点到站点VPN时静态路由配置错误排查

错误提示明确说明：关联到Transit Gateway的VPN连接，静态路由必须通过Transit Gateway API添加，不能用传统的aws_vpn_connection_route资源。

解决方案步骤： #

1. 删除错误资源：移除原来的aws_vpn_connection_route资源块，该资源仅适用于关联VPC网关（VGW）的VPN连接。
2. 替换为Transit Gateway路由资源：使用aws_ec2_transit_gateway_route资源，在Transit Gateway的路由表中添加静态路由，指定下一跳为你的VPN连接。

修改后的代码示例： #

resource "aws_customer_gateway" "customer_gateway" {
  bgp_asn    = var.customer_gateway_bgp_asn
  ip_address = var.customer_gateway_ip
  type       = var.customer_gateway_type
}

resource "aws_ec2_transit_gateway" "transit_gateway" {
  default_route_table_association = "enable"
  default_route_table_propagation = "enable"
}

resource "aws_ec2_transit_gateway_route_table" "transit_gateway_route_table" {
  transit_gateway_id = aws_ec2_transit_gateway.transit_gateway.id
}

resource "aws_vpn_connection" "vpn_connection" {
  customer_gateway_id = aws_customer_gateway.customer_gateway.id
  type                = var.customer_gateway_type
  transit_gateway_id  = aws_ec2_transit_gateway.transit_gateway.id
}

# 替换原aws_vpn_connection_route，添加Transit Gateway静态路由
resource "aws_ec2_transit_gateway_route" "vpn_static_route" {
  for_each                      = toset(var.vpn_routes)
  destination_cidr_block        = each.key
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.transit_gateway_route_table.id
  # 将VPN连接作为路由的下一跳附件
  transit_gateway_attachment_id = aws_vpn_connection.vpn_connection.id
}

关键说明： #

• transit_gateway_route_table_id：指定要添加路由的Transit Gateway路由表ID，这里使用自定义创建的路由表；如果要使用TG的默认路由表，可替换为aws_ec2_transit_gateway.transit_gateway.default_route_table_id。
• transit_gateway_attachment_id：必须填写VPN连接ID，因为VPN连接是Transit Gateway的一种网络附件，路由会指向该附件转发流量。

内容的提问来源于stack exchange，提问作者praiseHellRaiseDale