如何用Terraform配置跨区域TGW路由并解决默认路由表干扰问题？

核心问题分析 #

你的配置存在三个关键疏漏：

1. TGW默认路由表会自动关联新创建的VPC附件，导致本地子网路由被优先匹配
2. 跨区域对等连接未自动接受，需要手动操作的环节打断了自动化流程
3. 自定义路由表未关联VPC附件，且路由规则错误指向了本地VPC附件而非对等连接

以下是全自动化的Terraform修正方案：

1. 禁用TGW默认路由表自动关联 #

创建TGW时添加default_route_table_association = false，阻止VPC附件自动绑定到默认路由表：

resource "aws_ec2_transit_gateway" "main" {
  description                  = "main transit gateway"
  provider                     = aws
  default_route_table_association = false # 关键配置

  tags = {
    Name = "main draas transit gateway"
  }
}

resource "aws_ec2_transit_gateway" "dr" {
  provider                     = aws.dr
  description                  = "dr transit gateway"
  default_route_table_association = false # 关键配置

  tags = {
    Name = "dr transit draas gateway"
  }
}

2. 将VPC附件绑定到自定义路由表 #

使用aws_ec2_transit_gateway_route_table_association资源，把VPC附件关联到你创建的自定义路由表：

# 主区域VPC附件关联自定义路由表
resource "aws_ec2_transit_gateway_route_table_association" "main_vpc" {
  provider                        = aws
  transit_gateway_route_table_id  = aws_ec2_transit_gateway_route_table.main.id
  transit_gateway_attachment_id   = aws_ec2_transit_gateway_vpc_attachment.main.id
}

# DR区域VPC附件关联自定义路由表
resource "aws_ec2_transit_gateway_route_table_association" "dr_vpc" {
  provider                        = aws.dr
  transit_gateway_route_table_id  = aws_ec2_transit_gateway_route_table.dr.id
  transit_gateway_attachment_id   = aws_ec2_transit_gateway_vpc_attachment.dr.id
}

3. 自动接受跨区域对等连接 #

在DR区域添加 accepter 资源，无需手动在控制台操作：

resource "aws_ec2_transit_gateway_peering_attachment_accepter" "dr" {
  provider                          = aws.dr
  transit_gateway_peering_attachment_id = aws_ec2_transit_gateway_peering_attachment.main.id
  tags = {
    Name = "accepted dr tgw peering"
  }
}

4. 修正路由规则指向对等连接 #

把之前指向本地VPC附件的路由，修改为指向跨区域对等连接：

# 主区域路由：目标DR子网指向对等连接
resource "aws_ec2_transit_gateway_route" "main" {
  provider                        = aws
  destination_cidr_block          = var.staging_private_subnet_cidr
  transit_gateway_route_table_id  = aws_ec2_transit_gateway_route_table.main.id
  transit_gateway_attachment_id   = aws_ec2_transit_gateway_peering_attachment.main.id # 改为对等连接ID
}

# DR区域路由：目标主子网指向对等连接
resource "aws_ec2_transit_gateway_route" "dr" {
  provider                        = aws.dr
  destination_cidr_block          = var.main_private_subnet_cidr
  transit_gateway_route_table_id  = aws_ec2_transit_gateway_route_table.dr.id
  transit_gateway_attachment_id   = aws_ec2_transit_gateway_peering_attachment.main.id # 改为对等连接ID
}

5. 验证子网路由表配置 #

确保VPC私有子网的路由表中，已添加指向TGW的路由（目标为对端子网CIDR）：

# 主区域私有子网路由表添加TGW路由
resource "aws_route" "main_private_tgw" {
  route_table_id         = aws_route_table.private.id
  destination_cidr_block = var.staging_private_subnet_cidr
  transit_gateway_id     = aws_ec2_transit_gateway.main.id
}

# DR区域私有子网路由表添加TGW路由
resource "aws_route" "dr_private_tgw" {
  provider               = aws.dr
  route_table_id         = aws_route_table.staging_private.id
  destination_cidr_block = var.main_private_subnet_cidr
  transit_gateway_id     = aws_ec2_transit_gateway.dr.id
}

内容的提问来源于stack exchange，提问作者BPS