Terraform中无需Internet Gateway配置NAT Gateway是否可行？

• 结论：不能在没有Internet Gateway（IGW）的情况下配置可用的NAT Gateway
  NAT Gateway的核心作用是为私有子网内的资源提供公网访问能力，它自身必须具备公网连通性，而这种连通性依赖于VPC关联的Internet Gateway。同时部署NAT Gateway的子网必须配置指向IGW的路由，确保NAT Gateway能正常访问公网。

• 针对你遇到的报错，可从以下几点排查：

  1. 检查部署NAT Gateway的子网是否为公有子网：该子网的路由表必须包含0.0.0.0/0 -> IGW实例ID的路由条目
  2. 确认NAT Gateway是否绑定了弹性公网IP（EIP）：NAT Gateway必须关联EIP才能获得公网访问能力，Terraform配置中要确保aws_nat_gateway资源正确关联aws_eip
  3. 私有子网路由表配置：私有子网的路由表需添加0.0.0.0/0 -> NAT Gateway实例ID的路由，让私有子网流量通过NAT Gateway访问公网
  4. 验证VPC与IGW的关联：确保aws_internet_gateway资源已正确绑定目标VPC，无依赖或权限配置错误

以下是极简的正确配置示例（Terraform）：

# 创建VPC
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

# 创建并关联Internet Gateway
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
}

# 公有子网（用于部署NAT Gateway）
resource "aws_subnet" "public" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"
}

# 公有子网路由表，指向IGW
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
}

resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

# 弹性公网IP
resource "aws_eip" "nat" {
  vpc = true
}

# 创建NAT Gateway
resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public.id
}

# 私有子网
resource "aws_subnet" "private" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "us-east-1a"
}

# 私有子网路由表，指向NAT Gateway
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main.id
  }
}

resource "aws_route_table_association" "private" {
  subnet_id      = aws_subnet.private.id
  route_table_id = aws_route_table.private.id
}

内容的提问来源于stack exchange，提问作者Williams Ebenezer