Terraform在EC2部署Prometheus后，浏览器访问提示连接拒绝求助

问题现象 #

• 通过Terraform的remote-exec provisioner完成Prometheus部署，脚本执行无报错，服务已创建
• 外部浏览器访问http://<服务器IP/主机名>:9090提示连接拒绝
• 手动SSH登录服务器执行相同脚本后，服务可正常访问

涉及的Terraform配置 #

provisioner "remote-exec" {
  inline = [
    "sudo useradd --no-create-home --shell /bin/false prometheus",
    "sudo mkdir /etc/prometheus",
    "sudo mkdir /var/lib/prometheus",
    "sudo chown -R prometheus. /etc/prometheus",
    "sudo chown -R prometheus. /var/lib/prometheus",
    "cd ~",

    "wget  https://github.com/prometheus/prometheus/releases/download/v2.41.0/prometheus-2.41.0.linux-amd64.tar.gz",
    "tar -xvf prometheus-2.41.0.linux-amd64.tar.gz",
    "sudo cp prometheus-2.41.0.linux-amd64/prometheus /usr/local/bin/",
    "sudo cp prometheus-2.41.0.linux-amd64/promtool /usr/local/bin/",
    "sudo chown prometheus. /usr/local/bin/prometheus",
    "sudo chown prometheus. /usr/local/bin/promtool",
    "sudo cp -r prometheus-2.41.0.linux-amd64/consoles /etc/prometheus",
    "sudo cp -r prometheus-2.41.0.linux-amd64/console_libraries /etc/prometheus",

    "rm -rf prometheus-2.41.0.linux-amd64.tar.gz prometheus-2.41.0.linux-amd64",
    "sudo cp prometheus.yml /etc/prometheus/prometheus.yml",
    "sudo chown prometheus. /etc/prometheus/prometheus.yml",
    "sudo cp prometheus.service  /etc/systemd/system/prometheus.service",

    "sudo chown prometheus:prometheus /etc/prometheus",
    "sudo chown prometheus:prometheus /usr/local/bin/prometheus",
    "sudo chown prometheus:prometheus /usr/local/bin/promtool",
    "sudo chown -R prometheus:prometheus /etc/prometheus/consoles",
    "sudo chown -R prometheus:prometheus /etc/prometheus/console_libraries",
    "sudo chown -R prometheus:prometheus /var/lib/prometheus",

    "sudo systemctl daemon-reload",
    "sudo systemctl enable prometheus",
    "sudo systemctl start prometheus",
  ]
}

排查与解决方案 #

1. 修正Prometheus监听配置 #

默认Prometheus仅监听127.0.0.1:9090，只能本地访问。手动执行时你可能修改过配置，但Terraflow部署时用的是默认配置：

• 编辑本地prometheus.yml，添加/修改监听地址：

  global:
    scrape_interval: 15s
  web:
    listen-address: "0.0.0.0:9090" # 允许所有IP访问
  

• 确保该文件通过Terraform的file provisioner先上传到实例，再执行remote-exec中的复制命令

2. 开放服务器防火墙端口 #

Terraform部署时未添加端口开放命令，手动执行时你可能补了这一步：

• 在remote-exec的inline命令末尾添加开放端口的语句：

  # 针对firewalld
  sudo firewall-cmd --add-port=9090/tcp --permanent
  sudo firewall-cmd --reload
  # 针对iptables
  # sudo iptables -A INPUT -p tcp --dport 9090 -j ACCEPT
  # sudo service iptables save
  

3. 检查EC2安全组规则 #

EC2实例的安全组必须允许外部访问9090端口：

• 添加入站规则：协议TCP、端口9090、来源设为你的IP或0.0.0.0/0（按需配置）

4. 确认服务真实运行状态 #

Terraform执行systemctl start prometheus后，可能因配置文件错误导致服务假启动：

• 在remote-exec末尾添加状态检查命令，方便排查：

  sudo systemctl status prometheus
  sudo journalctl -u prometheus --no-pager
  

5. 调整文件上传顺序 #

当前remote-exec直接复制prometheus.yml和prometheus.service，但如果这两个文件还没上传到实例，会用错误的配置：

• 先添加file provisioner上传文件，再执行remote-exec：

  provisioner "file" {
    source      = "prometheus.yml"
    destination = "/home/ec2-user/prometheus.yml"
  }
  
  provisioner "file" {
    source      = "prometheus.service"
    destination = "/home/ec2-user/prometheus.service"
  }
  
  provisioner "remote-exec" {
    # 原inline命令...
  }
  

内容的提问来源于stack exchange，提问作者oluyemi