Terraform创建RDS Proxy报错：指定子网不存在（实际存在）

配置代码 #

module "my-rds-proxy" {
  source = "terraform-aws-modules/rds-proxy/aws"
  version = "2.1.2"
  name                   = "my-rds-proxy"
  create_iam_policy      = false
  create_iam_role        = false
  role_arn               = "arn:aws:iam::XXXX:role/my-role"
  vpc_subnet_ids         = ["subnet-XXXX"]
  vpc_security_group_ids = ["securitygroup-XXXX"]

  db_proxy_endpoints = {
    read_write = {
      name                   = "read-write-endpoint"
      vpc_subnet_ids         = ["subnet-XXXX"]
      vpc_security_group_ids = ["securitygroup-XXXX"]
    },
    read_only = {
      name                   = "read-only-endpoint"
      vpc_subnet_ids         = ["subnet-XXXX"]
      vpc_security_group_ids = ["securitygroup-XXXX"]
      target_role            = "READ_ONLY"
    }
  }
  target_db_cluster     = true
  db_cluster_identifier = "rds-cluster-XXXX"
  ...
}

部署错误信息 #

│ Error: creating RDS DB Proxy: InvalidSubnet: The subnet ID 'subnet-XXXX' does not exist
│   status code: 400, request id: XXXX
│ 
│   with module.rds-proxy.module.my-rds-proxy.aws_db_proxy.this[0],
│   on .terraform/modules/rds-proxy.my-rds-proxy/main.tf line 13, in resource "aws_db_proxy" "this":
│   13: resource "aws_db_proxy" "this" {

背景信息与疑问 #

• 子网subnet-XXXX确实存在于us-east-2区域，AWS控制台可查
• 关联IAM角色已配置该子网访问权限
• RDS集群rds-cluster-XXXX同样位于us-east-2区域
• 疑问：该Terraform模块未提供provider参数，它如何确定AWS区域？是否默认和关联RDS集群同区域？为何us-east-1环境下用对应子网创建代理正常，us-east-2却报错？

问题根源与解决方案 #

1. 模块的区域确定逻辑 #

Terraform模块不会自动关联RDS集群的区域，它完全依赖当前执行环境中配置的AWS Provider区域，不存在"默认跟随RDS集群区域"的逻辑。模块本身没有区域感知能力，所有AWS资源操作都由传入的Provider决定。

2. 跨区域报错的原因 #

你在us-east-1环境执行时，默认Provider的区域是us-east-1，且使用的子网属于该区域；而在us-east-2环境下，要么是默认Provider的区域未切换到us-east-2，要么是没有为模块显式指定us-east-2的Provider，导致模块仍在默认区域（比如us-east-1）查找子网，自然找不到。

3. 具体解决方法 #

方法一：设置默认Provider为us-east-2

在Terraform根模块中配置默认AWS Provider的区域：

provider "aws" {
  region = "us-east-2"
}

方法二：为模块显式传递us-east-2的Provider

如果需要多区域管理，可创建指定区域的Provider并传递给模块：

provider "aws" {
  alias  = "us-east-2"
  region = "us-east-2"
}

module "my-rds-proxy" {
  source = "terraform-aws-modules/rds-proxy/aws"
  version = "2.1.2"
  
  # 显式指定使用us-east-2的Provider
  providers = {
    aws = aws.us-east-2
  }

  # 其余配置保持不变
  name                   = "my-rds-proxy"
  create_iam_policy      = false
  create_iam_role        = false
  role_arn               = "arn:aws:iam::XXXX:role/my-role"
  vpc_subnet_ids         = ["subnet-XXXX"]
  vpc_security_group_ids = ["securitygroup-XXXX"]

  db_proxy_endpoints = {
    read_write = {
      name                   = "read-write-endpoint"
      vpc_subnet_ids         = ["subnet-XXXX"]
      vpc_security_group_ids = ["securitygroup-XXXX"]
    },
    read_only = {
      name                   = "read-only-endpoint"
      vpc_subnet_ids         = ["subnet-XXXX"]
      vpc_security_group_ids = ["securitygroup-XXXX"]
      target_role            = "READ_ONLY"
    }
  }
  target_db_cluster     = true
  db_cluster_identifier = "rds-cluster-XXXX"
  ...
}

额外验证点 #

• 执行terraform plan时，确认Provider区域显示为us-east-2
• 检查子网ID是否完全正确（注意大小写、字符输入错误）

内容的提问来源于stack exchange，提问作者Dane Iracleous