使用Terraform创建OCI Network Load Balancer时遇404权限/资源未找到错误

错误详情 #

使用Terraform在OCI创建Network Load Balancer（NLB）时，出现以下错误：

│ Error: 404-NotAuthorizedOrNotFound, Authorization failed or requested resource not found.
│ Suggestion: Either the resource has been deleted or service Network Load Balancer need policy to access this resource. Policy reference: https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/policyreference.htm
│ Documentation: https://registry.terraform.io/providers/oracle/oci/latest/docs/resources/network_load_balancer_network_load_balancer 
│ API Reference: https://docs.oracle.com/iaas/api/#/en/networkloadbalancer/20200501/NetworkLoadBalancer/CreateNetworkLoadBalancer 
│ Request Target: POST https://network-load-balancer-api.af-johannesburg-1.oci.oraclecloud.com/20200501/networkLoadBalancers 
│ Provider version: 5.31.0, released on 2024-02-29. This provider is 4 Update(s) behind to current. 
│ Service: Network Load Balancer 
│ Operation Name: CreateNetworkLoadBalancer 
│ OPC request ID: 0256511fde90f28584e79623b17f1b38/190C305D6D14F898BC9F8EEFCB93878A/4ED76C648A27CAEBD406E5EE79D813C2 
│ │ 
│   with oci_network_load_balancer_network_load_balancer.web,
│   on nlb.tf line 3, in resource "oci_network_load_balancer_network_load_balancer" "web":
│    3: resource "oci_network_load_balancer_network_load_balancer" "web" { 

手动创建NLB并导入tfstate后，仍出现相同错误：

404-NotAuthorizedOrNotFound, Authorization failed or requested resource not found.
│ Suggestion: Either the resource has been deleted or service Network Load Balancer need policy to access this resource. Policy reference: https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/policyreference.htm
│ Documentation: https://registry.terraform.io/providers/oracle/oci/latest/docs/resources/network_load_balancer_network_load_balancer 
│ API Reference: https://docs.oracle.com/iaas/api/#/en/networkloadbalancer/20200501/NetworkLoadBalancer/CreateNetworkLoadBalancer 
│ Request Target: POST https://network-load-balancer-api.af-johannesburg-1.oci.oraclecloud.com/20200501/networkLoadBalancers 
│ Provider version: 5.31.0, released on 2024-02-29. This provider is 4 Update(s) behind to current. 
│ Service: Network Load Balancer 
│ Operation Name: CreateNetworkLoadBalancer 
│ OPC request ID: 393f50d1bc243450e5d99f5d35b2633a/6BE524CE75B807B16CE03B3CCC3EFF51/F18A5909F19EBA97E64AACB30AECFE36 

Terraform代码 #

# Create a network load balancer for web servers
resource "oci_network_load_balancer_network_load_balancer" "web" {
  compartment_id                 = "ocid1.compartment.oc1xxxx"
  display_name                   = "web"
  subnet_id                      = oci_core_subnet.web_public_01.id
  freeform_tags                  = local.tags.defaults
  is_preserve_source_destination = true
  is_private                     = false
  network_security_group_ids = [
    oci_core_network_security_group_security_rule.web.id
  ]
}

# NSG Backend Sets
resource "oci_network_load_balancer_backend_set" "web" {

  name                     = "web-backend-sets"
  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.web.id
  policy                   = "FIVE_TUPLE"


  health_checker {

    protocol = "HTTP"

    #Optional
    interval_in_millis = 10000
    port               = 80
    # request_data        = var.backend_set_health_checker_request_data
    # response_body_regex = var.backend_set_health_checker_response_body_regex
    # response_data       = var.backend_set_health_checker_response_data
    # retries             = var.backend_set_health_checker_retries
    # return_code         = var.backend_set_health_checker_return_code
    # timeout_in_millis   = var.backend_set_health_checker_timeout_in_millis
    url_path = "/"
  }

  #Optional
  # ip_version = var.backend_set_ip_version
  # is_preserve_source = var.backend_set_is_preserve_source
}

# NSG Backends
resource "oci_network_load_balancer_backend" "web_01" {
  backend_set_name         = oci_network_load_balancer_backend_set.web.name
  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.web.id
  port                     = 80

  is_backup  = false
  is_drain   = false
  is_offline = false
  # name       = oci_core_instance.web_01.display_name
  target_id = oci_core_instance.web_01.id
  weight    = 1
}

resource "oci_network_load_balancer_backend" "web_02" {
  backend_set_name         = oci_network_load_balancer_backend_set.web.name
  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.web.id
  port                     = 80

  is_backup  = false
  is_drain   = false
  is_offline = false
  # name       = oci_core_instance.web_02.display_name
  target_id = oci_core_instance.web_02.id
  weight    = 1
}

# NSG Listeners
resource "oci_network_load_balancer_listener" "web" {
  #Required
  default_backend_set_name = oci_network_load_balancer_backend_set.web.name
  name                     = "web-listeners"
  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.web.id
  port                     = 80
  protocol                 = "TCP_AND_UDP"
}

提问 #

请问我是否缺少用于创建NLB资源的策略？

1. 代码中的明显错误 #

你的NLB资源配置里，network_security_group_ids字段引用的是网络安全组规则（NSG Rule）的OCID，但这个字段要求传入的是网络安全组（NSG）的OCID。这会直接导致Terraform无法找到合法的NSG资源，触发NotFound类错误。

修改方式：将oci_core_network_security_group_security_rule.web.id替换为对应的NSG资源ID，比如如果你的NSG资源是oci_core_network_security_group.web，就改成oci_core_network_security_group.web.id。

2. 权限策略缺失的可能性 #

如果修正上述代码后仍报错，需要检查OCI身份策略是否赋予了Terraform所用账号足够的权限：

• 确保账号拥有创建、管理NLB的权限，至少需要以下策略（替换<compartment-name>为你的 compartment 名称）：

  Allow group <your-group> to manage network-load-balancers in compartment <compartment-name>
  Allow group <your-group> to use subnets in compartment <compartment-name>
  Allow group <your-group> to use network-security-groups in compartment <compartment-name>
  

• 另外，NLB服务本身也需要权限访问相关资源，需要添加服务主体的策略：

  Allow service network-load-balancer to use subnets in compartment <compartment-name>
  Allow service network-load-balancer to use network-security-groups in compartment <compartment-name>
  

3. 其他排查点 #

• 检查Terraform使用的OCI Provider版本，报错提示当前版本落后4个更新，尝试升级到最新版本，避免版本兼容性问题。
• 确认手动创建的NLB和Terraform配置中的compartment_id、subnet_id等参数完全匹配，导入tfstate时没有参数错误。

内容的提问来源于stack exchange，提问作者Mervin Hemaraju