如何在Terraform Transit Gateway模块中关闭自动关联/传播功能？

我使用Terraform模块创建了Transit Gateway（TGW），跨账号共享时系统默认创建了关联和传播配置，但我不需要这一默认设置——因为该模块已创建spoke和hub两个路由表，我需要为每个路由表配置特定的关联规则。尝试添加default_route_table = false并未生效，以下是我的模块配置：

module "tgw" {
  source = "git::https://github.com/terraform-aws-transit-gateway.git?ref=v1.1.0"

  amazon_side_asn = var.amazon_side_asn

  enable_auto_accept_shared_attachments = true
  enable_multicast_support              = false
  enable_vpn_ecmp_support               = true

  vpc_attachments = {
    vpc_endpoint = {
      vpc_id = data.aws_ssm_parameter.endpoint_network_id.value
      subnet_ids = [
        data.aws_ssm_parameter.endpoint_tgw_attachment_network_private_id1.value,
        data.aws_ssm_parameter.endpoint_tgw_attachment_network_private_id2.value
      ]
      dns_support = true

      transit_gateway_default_route_table_association = false
      transit_gateway_default_route_table_propagation = false

    },

    vpc_iam_nss = {
      vpc_id = data.aws_ssm_parameter.iam_network_id.value
      subnet_ids = [
        data.aws_ssm_parameter.iam_nss_tgw_attachment_network_private_id1.value,
        data.aws_ssm_parameter.iam_nss_tgw_attachment_network_private_id2.value
      ]
      dns_support = true

      transit_gateway_default_route_table_association = false
      transit_gateway_default_route_table_propagation = false

    }
}

问题出在模块的全局默认行为上：仅在单个VPC附件中设置transit_gateway_default_route_table_association = false无法覆盖跨账号共享时的默认路由表关联规则，需要从全局层面调整TGW配置，并手动绑定自定义路由表。

1. 全局禁用TGW默认路由表关联与传播 #

在模块配置中添加全局参数，彻底关闭默认路由表的自动关联和传播：

module "tgw" {
  source = "git::https://github.com/terraform-aws-transit-gateway.git?ref=v1.1.0"

  amazon_side_asn = var.amazon_side_asn

  enable_auto_accept_shared_attachments = true
  enable_multicast_support              = false
  enable_vpn_ecmp_support               = true

  # 全局禁用默认路由表关联
  default_route_table_association = false
  # 全局禁用默认路由表传播
  default_route_table_propagation = false

  vpc_attachments = {
    # 保留原有VPC附件配置
    vpc_endpoint = {
      ...
    },
    vpc_iam_nss = {
      ...
    }
  }
}

2. 手动绑定自定义路由表 #

利用模块输出的路由表ID和附件ID，创建自定义的关联与传播规则（模块通常会输出transit_gateway_route_table_ids和vpc_attachment_ids变量）：

# 将vpc_endpoint关联到hub路由表
resource "aws_transit_gateway_route_table_association" "vpc_endpoint_hub" {
  transit_gateway_route_table_id = module.tgw.transit_gateway_route_table_ids["hub"]
  transit_gateway_attachment_id  = module.tgw.vpc_attachment_ids["vpc_endpoint"]
}

# 将vpc_endpoint路由传播到spoke路由表
resource "aws_transit_gateway_route_table_propagation" "vpc_endpoint_spoke" {
  transit_gateway_route_table_id = module.tgw.transit_gateway_route_table_ids["spoke"]
  transit_gateway_attachment_id  = module.tgw.vpc_attachment_ids["vpc_endpoint"]
}

# 将vpc_iam_nss关联到spoke路由表
resource "aws_transit_gateway_route_table_association" "vpc_iam_nss_spoke" {
  transit_gateway_route_table_id = module.tgw.transit_gateway_route_table_ids["spoke"]
  transit_gateway_attachment_id  = module.tgw.vpc_attachment_ids["vpc_iam_nss"]
}

# 将vpc_iam_nss路由传播到hub路由表
resource "aws_transit_gateway_route_table_propagation" "vpc_iam_nss_hub" {
  transit_gateway_route_table_id = module.tgw.transit_gateway_route_table_ids["hub"]
  transit_gateway_attachment_id  = module.tgw.vpc_attachment_ids["vpc_iam_nss"]
}

注意：请确认你使用的v1.1.0版本模块支持default_route_table_association和default_route_table_propagation参数，可通过查看模块的variables.tf文件验证。若模块不支持，需升级模块版本或手动修改模块代码添加相关配置。

内容的提问来源于stack exchange，提问作者Renaira Santos