使用Terraform创建AWS EC2实例后无法SSH连接，寻求解决方案

核心问题分析 #

你的代码里有两个关键低级错误，直接导致实例无法被SSH访问：

• 安全组Ingress规则端口配置错误
  当前安全组的Ingress规则把from_port和to_port都设为0，即便协议是"-1"（所有协议），也没有正确放行SSH依赖的TCP 22端口流量。

• 自定义VPC缺少互联网网关与路由配置
  你创建了自定义VPC和子网，但没配置互联网网关（IGW）及关联的公网路由表。哪怕实例开启了associate_public_ip_address = true，没有路由到IGW的话，公网IP只是一个无效的NAT地址，无法和外部网络建立连接。

修正后的完整Terraform代码 #

resource "aws_key_pair" "test-terraform" {
  key_name   = "test-terraform"
  public_key = file("~/Documents/key-pairs/test-terraform.pub")
}

resource "aws_vpc" "main" {
  cidr_block       = "10.0.0.0/16"
  instance_tenancy = "default"

  tags = {
    Name = "main"
  }
}

# 添加互联网网关，让VPC能访问公网
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "main-igw"
  }
}

# 创建公网路由表，配置默认路由指向互联网网关
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = "public-route-table"
  }
}

# 将子网关联到公网路由表，让子网内实例能走公网
resource "aws_route_table_association" "main_subnet_public" {
  subnet_id      = aws_subnet.main_subnet.id
  route_table_id = aws_route_table.public.id
}

resource "aws_subnet" "main_subnet" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"

  tags = {
    Name = "main_subnet"
  }
}

resource "aws_security_group" "main_security_group" {
  name        = "main-security-group"
  description = "Security group for ec2 instances"
  vpc_id      = aws_vpc.main.id

  tags = {
    Name = "main_security_group"
  }

  # 允许所有出站流量
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 正确放行SSH（TCP 22端口）流量，建议替换cidr_blocks为你的公网IP提升安全性
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "web_server" {
  ami           = "ami-080e1f13689e07408" # us-east-1区域的Amazon Linux 2 AMI
  instance_type = "t2.micro"

  vpc_security_group_ids = [aws_security_group.main_security_group.id]
  subnet_id              = aws_subnet.main_subnet.id
  associate_public_ip_address = true
  key_name               = aws_key_pair.test-terraform.key_name

  tags = {
    Name = "Web Server Instance"
  }
}

output "public_ip" {
  value = aws_instance.web_server.public_ip
}

验证步骤 #

1. 执行terraform apply应用修正后的配置
2. 获取实例公网IP后，用SSH命令连接：ssh -i ~/Documents/key-pairs/test-terraform ec2-user@<你的公网IP>（注意：Amazon Linux 2默认用户是ec2-user，Ubuntu则是ubuntu）
3. 若AWS控制台连接仍失败，检查实例状态是否为running，查看系统日志确认无启动报错

内容的提问来源于stack exchange，提问作者Sakrine