Terraform创建Security Group时出现循环依赖错误求助

问题描述 #

使用Terraform创建AWS安全组时遭遇循环依赖错误，即便移除了安全组间的互相引用，甚至仅保留单个安全组时仍会出现自引用错误。

错误信息 #

Error: Cycle: aws_security_group.security_groups["SSH-Security-Group"], aws_security_group.security_groups["Backend-Security-Group"], aws_security_group.security_groups["Frontend-Security-Group"], aws_security_group.security_groups["Frontend-ALB-Security-Group"], aws_security_group.security_groups["Database-Security-Group"], aws_security_group.security_groups["Backend-NLB-Security-Group"]

资源定义 #

variable "security_groups" {}

locals {
  vpc_id = {
    tersu = data.aws_vpc.tersu
  }
}

resource "aws_security_group" "security_groups" {
  for_each = var.security_groups

  name        = each.value.name
  description = each.value.description
  vpc_id      = local.vpc_id[each.value.vpc].id

  dynamic "ingress" {
    for_each = each.value.ingress
    content {
      description     = ingress.value.description
      from_port       = ingress.value.from_port
      to_port         = ingress.value.to_port
      protocol        = ingress.value.protocol
      cidr_blocks     = lookup(ingress.value, "cidr_blocks", null) != null ? ingress.value.cidr_blocks : null
      security_groups = lookup(ingress.value, "security_groups", null) != null ? [for sg in ingress.value.security_groups : aws_security_group.security_groups[sg].id] : null
    }
  }

  dynamic "egress" {
    for_each = each.value.egress
    content {
      description     = egress.value.description
      from_port       = egress.value.from_port
      to_port         = egress.value.to_port
      protocol        = egress.value.protocol
      cidr_blocks     = lookup(egress.value, "cidr_blocks", null) != null ? egress.value.cidr_blocks : null
      security_groups = lookup(egress.value, "security_groups", null) != null ? [for sg in egress.value.security_groups : aws_security_group.security_groups[sg].id] : null
    }
  }

  tags = merge(each.value.tags, local.tags)
}

变量配置 #

security_groups = {
  "Frontend-ALB-Security-Group" = {
    name        = "Frontend-ALB-Security-Group"
    description = "Enable http/https access on port 80/443"
    vpc         = "tersu"
    ingress = [
      {
        description = "http access"
        from_port   = 80
        to_port     = 80
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      },
      {
        description = "https access"
        from_port   = 443
        to_port     = 443
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]
    egress = [
      {
        from_port   = 0
        to_port     = 0
        protocol    = "-1"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]
    tags = {
      Name = "Frontend-ALB-Security-Group"
    }
  }

  "Backend-NLB-Security-Group" = {
    name        = "Backend-NLB-Security-Group"
    description = "Enable http/https access on port 5000"
    vpc         = "tersu"
    ingress = [
      {
        description     = "Backend access from frontend"
        from_port       = 5000
        to_port         = 5000
        protocol        = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]
    egress = [
      {
        from_port   = 0
        to_port     = 0
        protocol    = "-1"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]
    tags = {
      Name = "Backend-ALB-Security-Group"
    }
  },

  "Frontend-Security-Group" = {
    name        = "Frontend-Security-Group"
    description = "Enable http, https, and ssh access on ports 80, 443, and 22 respectively"
    vpc         = "tersu"
    ingress = [
      {
        description = "HTTP access"
        from_port   = 80
        to_port     = 80
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      },
      {
        description = "HTTPS access"
        from_port   = 443
        to_port     = 443
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      },
      {
        description = "ssh access"
        from_port   = 22
        to_port     = 22
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]
    egress = [
      {
        description     = "Allow outbound traffic to backend"
        from_port       = 5000
        to_port         = 5000
        protocol        = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]
    tags = {
      Name = "Frontend-Security-Group"
    }
  }

  "Backend-Security-Group" = {
    name        = "Backend-Security-Group"
    description = "Enable http, https, on port 5000 for ingress, and 5432 for egress respectively"
    vpc         = "tersu"
    ingress = [
      {
        description     = "Allow inbound traffic from frontend"
        from_port       = 5000
        to_port         = 5000
        protocol        = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]
    egress = [
      {
        description     = "Allow outbound traffic to database"
        from_port       = 5432
        to_port         = 5432
        protocol        = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]
    tags = {
      Name = "Backend-Security-Group"
    }
  }

  "Database-Security-Group" = {
    name        = "Database-Security-Group"
    description = "Enable Postgresql access on port 5432"
    vpc         = "tersu"
    ingress = [
      {
        description     = "https access"
        from_port       = 5432
        to_port         = 5432
        protocol        = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]

    egress = [
      {
        from_port   = 0
        to_port     = 0
        protocol    = "-1"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]

    tags = {
      Name = "Database-Security-Group"
    }
  }

  "SSH-Security-Group" = {
    name        = "SSH-Security-Group"
    description = "Enable SSH access on port 22"
    vpc         = "tersu"

    ingress = [
      {
        description = "ssh access"
        from_port   = 22
        to_port     = 22
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]

    egress = [
      {
        from_port   = 0
        to_port     = 0
        protocol    = "-1"
        cidr_blocks = ["0.0.0.0/0"]
      }
    ]

    tags = {
      Name = "SSH-Security-Group"
    }
  }
}

问题原因与解决方案 #

核心问题 #

1. 语法错误触发异常解析：变量配置中Backend-NLB-Security-Group定义末尾多了一个逗号，导致Terraform解析变量结构时出现异常，间接触发循环依赖检测误判。
2. 隐式依赖链残留：资源定义中保留了security_groups字段的处理逻辑，即便变量里没有显式引用，Terraform仍会尝试解析所有可能的引用路径，形成隐式循环。

修复步骤 #

1. 修正变量语法错误
   删除Backend-NLB-Security-Group定义末尾的多余逗号：

"Backend-NLB-Security-Group" = {
  // ... 原有配置内容
  tags = {
    Name = "Backend-ALB-Security-Group"
  }
} // 移除此处多余的逗号

2. 优化引用逻辑避免隐式循环
   将动态块中security_groups的默认值从null改为空数组[]，避免Terraform解析时生成不必要的依赖链：
   修改动态ingress块中的对应代码：

security_groups = lookup(ingress.value, "security_groups", []) != [] ? [for sg in ingress.value.security_groups : aws_security_group.security_groups[sg].id] : []

同理修改动态egress块中的对应代码。

3. 分离规则与安全组彻底打破循环
   如果后续需要安全组间互相引用，建议使用aws_security_group_rule单独定义规则，将安全组本身和规则资源分离：

// 先创建所有安全组
resource "aws_security_group" "security_groups" {
  for_each = var.security_groups

  name        = each.value.name
  description = each.value.description
  vpc_id      = local.vpc_id[each.value.vpc].id
  tags        = merge(each.value.tags, local.tags)
}

// 单独定义入站规则
resource "aws_security_group_rule" "ingress" {
  for_each = flatten([
    for sg_key, sg in var.security_groups : [
      for idx, rule in sg.ingress : {
        sg_key   = sg_key
        rule_idx = idx
        rule     = rule
      }
    ]
  ])

  type              = "ingress"
  security_group_id = aws_security_group.security_groups[each.value.sg_key].id
  description       = each.value.rule.description
  from_port         = each.value.rule.from_port
  to_port           = each.value.rule.to_port
  protocol          = each.value.rule.protocol
  cidr_blocks       = lookup(each.value.rule, "cidr_blocks", [])
  security_groups   = lookup(each.value.rule, "security_groups", []) != [] ? [for sg in each.value.rule.security_groups : aws_security_group.security_groups[sg].id] : []
}

// 单独定义出站规则
resource "aws_security_group_rule" "egress" {
  for_each = flatten([
    for sg_key, sg in var.security_groups : [
      for idx, rule in sg.egress : {
        sg_key   = sg_key
        rule_idx = idx
        rule     = rule
      }
    ]
  ])

  type              = "egress"
  security_group_id = aws_security_group.security_groups[each.value.sg_key].id
  description       = each.value.rule.description
  from_port         = each.value.rule.from_port
  to_port           = each.value.rule.to_port
  protocol          = each.value.rule.protocol
  cidr_blocks       = lookup(each.value.rule, "cidr_blocks", [])
  security_groups   = lookup(each.value.rule, "security_groups", []) != [] ? [for sg in each.value.rule.security_groups : aws_security_group.security_groups[sg].id] : []
}

内容的提问来源于stack exchange，提问作者David Essien