如何调整Terraform配置解决AWS安全组443/80端口连接超时问题

问题描述 #

我需要创建一个允许80和443端口通行的AWS安全组，但通过443端口下载GitHub Actions包时出现连接超时。在AWS控制台手动添加“ALL ICMP - IPv4”规则后恢复正常，请问如何调整以下Terraform配置来避免这个问题？

原Terraform配置 #

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = "~> 4.16"
    }
  }
  required_version = ">= 1.2.0"
}
provider "aws" {
  region = "us-east-1"
}
data "template_file" "nginx" {
  template = file("./cloud-init.yaml")
}
resource "aws_key_pair" "deployer" {
    key_name = "gb"
}
resource "aws_security_group" "gradebook" {
  name        = "gradebook"
  description = "Security group for Gradebook server"
  ingress {
    protocol   = "tcp"
    from_port  = 22
    to_port    = 22
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    protocol   = "tcp"
    from_port  = 80
    to_port    = 80
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    protocol   = "tcp"
    from_port  = 443
    to_port    = 443
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
    cidr_blocks = ["0.0.0.0/0"]
  }
}
resource "aws_instance" "web_server" {
  ami          = "ami-0574da719dca65348"
  instance_type = "t2.micro"
  vpc_security_group_ids = [aws_security_group.gradebook.id]
  user_data = data.template_file.nginx.rendered
  key_name = aws_key_pair.deployer.key_name
  tags = {
    Name = "BOSSES_gradebook_nginx"
  }
}

修改方案 #

调整后的安全组配置 #

删除原配置中无效的全协议 ingress 规则，添加明确的ICMP IPv4 ingress规则，确保网络控制报文能正常接收。修改后的aws_security_group资源代码如下：

resource "aws_security_group" "gradebook" {
  name        = "gradebook"
  description = "Security group for Gradebook server"
  
  # 允许SSH访问
  ingress {
    protocol    = "tcp"
    from_port   = 22
    to_port     = 22
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 允许HTTP访问
  ingress {
    protocol    = "tcp"
    from_port   = 80
    to_port     = 80
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 允许HTTPS访问
  ingress {
    protocol    = "tcp"
    from_port   = 443
    to_port     = 443
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 允许所有ICMP IPv4报文（解决TCP连接所需的网络控制问题）
  ingress {
    protocol    = "icmp"
    from_port   = -1  # ICMP类型：-1代表所有类型
    to_port     = -1  # ICMP代码：-1代表所有代码
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 允许所有出站流量
  egress {
    protocol    = "-1"
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }
}

原因说明 #

• 原配置中protocol = "-1"且端口为0-0的ingress规则是无效的：全协议规则不需要指定端口范围，指定0-0会过滤掉所有需要端口的流量，同时也无法正确放行ICMP（ICMP不使用端口）。
• HTTPS（443端口）的TCP连接依赖ICMP报文完成网络路径探测（比如MTU发现的Destination Unreachable），如果入方向ICMP被阻塞，实例无法接收这些控制报文，会导致连接超时。添加ICMP规则后，这些关键报文能正常到达，TCP连接即可正常建立。

内容的提问来源于stack exchange，提问作者crvxッ