Terraform中用for_each创建NAT网关的两大配置难题求解

问题1：解决count生成的EIP无法直接用于for_each的问题 #

count生成的资源是元组（列表），而for_each要求输入集合或映射。直接用toset()无效是因为元组元素是对象，无法直接转为集合。可以通过for表达式把EIP元组转换成以索引为键的映射，适配for_each的要求：

resource "aws_nat_gateway" "nat_gw" {
  # 将EIP元组转为映射，键为索引，值为EIP对象
  for_each      = { for idx, eip in aws_eip.elastic_ip : idx => eip }
  allocation_id = each.value.id
  subnet_id     = # 问题2的解决方案放在此处
  # 标签部分保留原逻辑
}

问题2：动态选取对应数量的公有子网ID #

利用values()函数把公有子网的map结构转换成列表，结合each.key（即EIP的索引值0、1），直接按顺序选取对应数量的子网ID：

resource "aws_nat_gateway" "nat_gw" {
  for_each      = { for idx, eip in aws_eip.elastic_ip : idx => eip }
  allocation_id = each.value.id
  # 从公有子网列表中按索引取对应ID，prod环境取前2个，非prod取第1个
  subnet_id     = values(aws_subnet.public_subnet)[each.key].id

  tags = merge(var.tags, {
    Name        = "nat-gw-${var.name_suffix}-${each.key}"
    Description = "Terraform Managed NAT Gateway"
    Project     = var.project
    Environment = var.environment
  })
}

完整修正后的代码 #

EIP资源（无修改） #

resource "aws_eip" "elastic_ip" {
  count = var.environment == "prod" ? 2 : 1
  vpc = true
    
  tags = merge(var.tags, {
    Name        = "eip-${var.name_suffix}-${count.index}"
    Description = "Terraform Managed Elastic IP"
    Project     = var.project
    Environment = var.environment
  })
}

NAT网关资源（已修正） #

resource "aws_nat_gateway" "nat_gw" {
  for_each      = { for idx, eip in aws_eip.elastic_ip : idx => eip }
  allocation_id = each.value.id
  subnet_id     = values(aws_subnet.public_subnet)[each.key].id

  tags = merge(var.tags, {
    Name        = "nat-gw-${var.name_suffix}-${each.key}"
    Description = "Terraform Managed NAT Gateway"
    Project     = var.project
    Environment = var.environment
  })
}

公有子网资源（无修改） #

resource "aws_subnet" "public_subnet" {
  for_each = var.public_subnet
     
  availability_zone = each.value["az"]
  cidr_block        = each.value["cidr"]
  vpc_id            = aws_vpc.vpc.id
    
  tags = merge(var.tags, {
    Name        = "public-subnet-${var.name_suffix}"
    Description = "Terraform Managed Subnet"
    Project     = var.project
    Environment = var.environment
    AZ          = each.value["az"]
  })
}

子网变量定义（无修改） #

public_subnet = {
  subnet_a = {
    az = "eu-west-1a"
    cidr = "10.10.0.0/24"
  }
  subnet_b = {
    az = "eu-west-1b"
    cidr = "10.10.1.0/24"
  }
  subnet_c = {
    az = "eu-west-1c"
    cidr = "10.10.2.0/24"
  }
}

此方案完全无需额外定义locals或variables，仅通过Terraform内置表达式和函数就解决了两个问题：

1. 将count生成的EIP元组转成映射，满足for_each的类型要求
2. 动态匹配EIP数量，从3个公有子网中选取对应数量的ID

内容的提问来源于stack exchange，提问作者suren