如何在Terraform的aws_api_gateway_integration中用阶段变量设置connection_id

我正在使用AWS API Gateway和Terraform，想要在aws_api_gateway_integration资源的connection_id字段中使用阶段变量${stageVariables.vpcLinkId}，以此为VPC Link的API Gateway集成动态设置connection_id。

我的配置代码如下：

resource "aws_api_gateway_integration" "vpc_integration_delete" {
  rest_api_id             = aws_api_gateway_rest_api.example.id
  resource_id             = aws_api_gateway_resource.example.id
  http_method             = "DELETE"
  type                    = "HTTP_PROXY"
  integration_http_method = "POST"
  uri                     = "http://example.com/resource"
  connection_type         = "VPC_LINK"
  connection_id           = "${stageVariables.vpcLinkId}" 
}

执行terraform apply时报错：A managed resource "stageVariables" "vpcLinkId" has not been declared in the root module.

我已经在aws_api_gateway_stage资源中定义了该阶段变量：

resource "aws_api_gateway_stage" "example_stage" {
  stage_name   = "dev"
  rest_api_id  = aws_api_gateway_rest_api.example.id
  deployment_id = aws_api_gateway_deployment.example.id

  variables = {
    vpcLinkId = aws_api_gateway_vpc_link.example.id
  }
}

同时也为prod环境定义了对应的阶段变量：

resource "aws_api_gateway_stage" "example_stage" {
  stage_name   = "prod"
  rest_api_id  = aws_api_gateway_rest_api.example.id
  deployment_id = aws_api_gateway_deployment.example.id

  variables = {
    vpcLinkId = aws_api_gateway_vpc_link.example.id
  }
}

请问是否可以在Terraform的aws_api_gateway_integration资源的connection_id字段中使用stageVariables.vpcLinkId这类阶段变量？如果不行，在Terraform中基于阶段变量动态设置connection_id的最佳方案是什么？

不能直接在aws_api_gateway_integration的connection_id字段中使用API Gateway的阶段变量。原因是Terraform会将${stageVariables.vpcLinkId}解析为自身的资源引用，而非API Gateway运行时的阶段变量，这就是你触发报错的核心原因。

以下是两种可行的解决方案：

方案一：按环境创建独立的集成资源 #

为每个环境（如dev、prod）分别定义aws_api_gateway_integration资源，直接绑定对应环境的VPC Link ID：

# Dev环境集成
resource "aws_api_gateway_integration" "vpc_integration_delete_dev" {
  rest_api_id             = aws_api_gateway_rest_api.example.id
  resource_id             = aws_api_gateway_resource.example.id
  http_method             = "DELETE"
  type                    = "HTTP_PROXY"
  integration_http_method = "POST"
  uri                     = "http://example.com/resource"
  connection_type         = "VPC_LINK"
  connection_id           = aws_api_gateway_vpc_link.example_dev.id
}

# Prod环境集成
resource "aws_api_gateway_integration" "vpc_integration_delete_prod" {
  rest_api_id             = aws_api_gateway_rest_api.example.id
  resource_id             = aws_api_gateway_resource.example.id
  http_method             = "DELETE"
  type                    = "HTTP_PROXY"
  integration_http_method = "POST"
  uri                     = "http://example.com/resource"
  connection_type         = "VPC_LINK"
  connection_id           = aws_api_gateway_vpc_link.example_prod.id
}

之后在对应环境的阶段部署中，关联对应的集成资源即可。这种方案简单直接，适合环境数量较少的场景。

方案二：使用Terraform变量+工作区动态切换 #

利用Terraform工作区（Workspace）或环境变量，在部署时动态传入当前环境的VPC Link ID：

1. 定义Terraform变量：

variable "environment" {
  type        = string
  description = "当前部署的环境（dev/prod）"
}

variable "vpc_link_ids" {
  type = map(string)
  default = {
    dev  = aws_api_gateway_vpc_link.example_dev.id
    prod = aws_api_gateway_vpc_link.example_prod.id
  }
}

2. 在集成资源中引用变量：

resource "aws_api_gateway_integration" "vpc_integration_delete" {
  rest_api_id             = aws_api_gateway_rest_api.example.id
  resource_id             = aws_api_gateway_resource.example.id
  http_method             = "DELETE"
  type                    = "HTTP_PROXY"
  integration_http_method = "POST"
  uri                     = "http://example.com/resource"
  connection_type         = "VPC_LINK"
  connection_id           = var.vpc_link_ids[var.environment]
}

3. 部署时指定环境：

# Dev环境
terraform workspace select dev
terraform apply -var="environment=dev"

# Prod环境
terraform workspace select prod
terraform apply -var="environment=prod"

这种方案适合多环境管理，能避免重复定义资源，通过工作区隔离不同环境的状态。

补充说明 #

API Gateway的阶段变量主要用于运行时动态调整配置（比如URI、请求参数等），但connection_id属于集成的静态配置项，Terraform在创建集成时就需要确定具体的VPC Link ID，无法延迟到运行时通过阶段变量解析。因此必须在Terraform部署阶段就明确当前环境对应的VPC Link ID。

内容的提问来源于stack exchange，提问作者DarshM