Terraform创建的AWS资源栈无法销毁，求排查报错原因

我在AWS环境中通过Terraform创建了多可用区PostgreSQL RDS实例、只读副本和用于微服务的EC2实例（EC2需访问RDS），执行terraform apply耗时约15分钟，但terraform destroy执行20分钟后失败，报错如下：

aws_internet_gateway.example: Still destroying... [id=igw-0acac09118fd268dc, 20m0s elapsed]
╷
│ Error: deleting RDS DB Parameter Group (pg15): operation error RDS: DeleteDBParameterGroup, https response error StatusCode: 400, RequestID: 74a4dcce-118c-46d4-9f46-42bbd90334a2, InvalidDBParameterGroupState: One or more database instances are still members of this parameter group pg15, so the group cannot be deleted
│ 
│ 
╵
╷
│ Error: deleting EC2 Internet Gateway (igw-0acac09118fd268dc): detaching EC2 Internet Gateway (igw-0acac09118fd268dc) from VPC (vpc-045dd1b8ec6453e33): DependencyViolation: Network vpc-045dd1b8ec6453e33 has some mapped public address(es). Please unmap those public address(es) before detaching the gateway.
│       status code: 400, request id: 6d7c4aad-39e5-4c5a-b9fe-4443058b6109
│ 
│ 
╵
╷
│ Error: final_snapshot_identifier is required when skip_final_snapshot is false
│ 
│ 
╵

最终只能用aws-nuke清理遗留资源，以下是我的Terraform配置文件：

provider "aws" {
region = "us-west-2"
}

# 创建VPC
resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support = true
  tags = {
    Name = "example-vpc"
  }
}

# 创建互联网网关
resource "aws_internet_gateway" "example" {
vpc_id = aws_vpc.example.id
}

# 创建子网
resource "aws_subnet" "example" {
  vpc_id     = aws_vpc.example.id
  cidr_block = "10.0.1.0/24"
  availability_zone = "us-west-2b"
  tags = {
  Name = "example-subnet-1"
  }
}

resource "aws_subnet" "example2" {
  vpc_id     = aws_vpc.example.id
  cidr_block = "10.0.2.0/24"
  availability_zone = "us-west-2c"
  tags = {
    Name = "example-subnet-2"
  }
}

# 创建路由表
resource "aws_route_table" "example" {
vpc_id = aws_vpc.example.id

route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.example.id
}
}

# 关联路由表与子网
resource "aws_route_table_association" "example" {
subnet_id     = aws_subnet.example.id
route_table_id = aws_route_table.example.id
}

resource "aws_route_table_association" "example2" {
subnet_id     = aws_subnet.example2.id
route_table_id = aws_route_table.example.id
}

# 创建RDS安全组
resource "aws_security_group" "rds_sg" {
name        = "example-rds-sg"
description = "RDS安全组"
vpc_id      = aws_vpc.example.id

ingress {
from_port   = 5432
to_port     = 5432
protocol    = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}

egress {
from_port   = 0
to_port     = 0
protocol    = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}

# 创建EC2安全组
resource "aws_security_group" "ec2_sg" {
name        = "example-ec2-sg"
description = "EC2安全组"
vpc_id      = aws_vpc.example.id

ingress {
from_port   = 80
to_port     = 80
protocol    = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}

egress {
from_port   = 0
to_port     = 0
protocol    = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}

resource "aws_db_parameter_group" "pg15" {
  name   = "pg15"
  family = "postgres15"

  parameter {
    name  = "log_connections"
    value = "1"
  }

  lifecycle {
    create_before_destroy = true
  }
}

# 创建RDS实例
resource "aws_db_instance" "example" {
engine               = "postgres"
engine_version       = "15.4"
instance_class       = "db.t3.micro"
identifier            = "example-db"
username             = "exampleuser"
password             = "examplepassword"
parameter_group_name = "pg15"
backup_retention_period = 5
multi_az              = true
publicly_accessible  = true
vpc_security_group_ids = [aws_security_group.rds_sg.id]
db_subnet_group_name  = aws_db_subnet_group.example.name
allocated_storage = 20
tags = {
Name = "example-db"
}
}

# 创建RDS子网组
resource "aws_db_subnet_group" "example" {
name        = "example-db-subnet-group"
subnet_ids = [aws_subnet.example.id, aws_subnet.example2.id]
}

错误原因及解决办法 #

1. RDS参数组无法删除 #

原因：Terraform销毁顺序错误，尝试先删除参数组再删除RDS实例。问题出在RDS实例配置中，parameter_group_name使用了硬编码的"pg15"，而非资源引用aws_db_parameter_group.pg15.name，导致Terraform无法识别实例与参数组的依赖关系，销毁时顺序混乱。

解决办法：修改RDS实例的参数组配置为资源引用：

resource "aws_db_instance" "example" {
  # 其他配置保持不变
  parameter_group_name = aws_db_parameter_group.pg15.name
}

这样Terraform会自动确保先销毁RDS实例，再删除参数组。另外，参数组的create_before_destroy生命周期选项主要用于参数组更新时的无缝替换，销毁时不需要调整，但依赖关系必须正确建立。

2. 互联网网关无法删除 #

原因：VPC内仍有绑定公网IP的资源（你提到的EC2实例）未被销毁，导致网关无法从VPC解绑。如果EC2实例是手动创建或未纳入当前Terraform配置管理，Terraform不会自动销毁它，进而阻塞网关的销毁流程。

解决办法：

• 如果EC2实例由Terraform管理：确保在配置文件中定义了EC2资源，Terraform会自动处理销毁顺序（先销毁EC2，再销毁网关）。
• 如果EC2实例是手动创建：先手动终止EC2实例释放公网IP，再重新执行terraform destroy。

3. RDS销毁缺少最终快照配置 #

原因：aws_db_instance资源默认skip_final_snapshot = false，销毁时要求指定最终快照名称；若不需要快照，需显式设置跳过。你的配置中未设置这两个参数，导致销毁失败。

解决办法：根据需求二选一：

• 测试环境（无需快照）：添加skip_final_snapshot = true

resource "aws_db_instance" "example" {
  # 其他配置保持不变
  skip_final_snapshot = true
}

• 生产环境（需要快照）：添加final_snapshot_identifier指定快照名称

resource "aws_db_instance" "example" {
  # 其他配置保持不变
  final_snapshot_identifier = "example-db-final-snapshot"
}

额外注意点 #

你提到创建了RDS只读副本，但当前配置文件中未包含相关资源。若副本存在且未被Terraform管理，需先手动删除副本，否则主实例无法被销毁，同样会导致参数组删除失败。

内容的提问来源于stack exchange，提问作者Dean Schulze