Terraform在us-east-2创建EC2实例时密钥对NotFound报错求助

问题场景 #

• 在us-east-2区域创建AWS EC2实例
• 通过别名key的us-east-1区域AWS Provider，用data资源获取该区域的test_key密钥对，且已通过output验证可正常获取
• 关联该密钥对到EC2实例时触发以下错误：

Error: creating EC2 Instance: InvalidKeyPair.NotFound: The key pair 'test_key' does not exist
│ status code: 400, request id: 2d7f03c2-dce4-42fb-9d35-c88a8a218d36
│
│ with aws_instance.instance,
│ on EC2_instances.tf line 7, in resource "aws_instance" "instance":
│ 7: resource "aws_instance" "instance" {

原Terraform代码如下：

provider "aws" {
  alias  = "key"
  region = "us-east-1"
}
    
resource "aws_instance" "instance" {
  ami            = var.ami  
  instance_type  = var.instance_type
  key_name       = data.aws_key_pair.report_key.key_name
}

data "aws_key_pair" "report_key" {
  provider = aws.key
  key_name = "test_key"
} 

问题原因 #

AWS密钥对是区域级资源，每个AWS区域的密钥对独立存储。你在us-east-1获取的test_key仅存在于us-east-1区域，而EC2实例创建在us-east-2区域，该区域没有同名密钥对，因此AWS无法匹配，触发报错。

解决方案 #

方案1：在目标区域（us-east-2）创建/导入同名密钥对 #

直接在us-east-2区域创建或导入名为test_key的密钥对，确保EC2所在区域存在该资源。用Terraform实现的示例代码：

# 默认Provider指向us-east-2，用于创建EC2和密钥对
provider "aws" {
  region = "us-east-2"
}

provider "aws" {
  alias  = "key"
  region = "us-east-1"
}

# 导入本地公钥到us-east-2区域，创建同名密钥对
resource "aws_key_pair" "us_east_2_test_key" {
  key_name   = "test_key"
  public_key = file("~/.ssh/test_key.pub") # 替换为你的公钥文件路径
}

resource "aws_instance" "instance" {
  ami            = var.ami  
  instance_type  = var.instance_type
  key_name       = aws_key_pair.us_east_2_test_key.key_name
}

# 保留原data资源（若需验证us-east-1的密钥对）
data "aws_key_pair" "report_key" {
  provider = aws.key
  key_name = "test_key"
} 

方案2：复用源区域密钥对内容到目标区域 #

通过data资源获取us-east-1密钥对的公钥内容，自动在us-east-2区域创建同名密钥对，无需手动操作：

provider "aws" {
  region = "us-east-2"
}

provider "aws" {
  alias  = "key"
  region = "us-east-1"
}

# 获取us-east-1区域的密钥对信息
data "aws_key_pair" "report_key" {
  provider = aws.key
  key_name = "test_key"
}

# 在us-east-2区域创建同名密钥对，复用源区域的公钥
resource "aws_key_pair" "us_east_2_test_key" {
  key_name   = data.aws_key_pair.report_key.key_name
  public_key = data.aws_key_pair.report_key.public_key
}

resource "aws_instance" "instance" {
  ami            = var.ami  
  instance_type  = var.instance_type
  key_name       = aws_key_pair.us_east_2_test_key.key_name
}

内容的提问来源于stack exchange，提问作者Mohamed Ramadan