如何用Terraform创建关联多EC2、EIP的AWS安全组？解决重复报错

问题原因 #

你遇到的错误核心是同一VPC内AWS安全组名称必须唯一，但你的aws_security_group资源使用了count = var.number_of_instances，且硬编码了固定名称first-security-group-created-by-terraform。当实例数量大于1时，Terraform会尝试创建多个同名安全组，触发AWS的重复校验报错。

正确实现方式 #

根据你的需求，提供两种可行方案：

方案1：所有实例共用一个安全组（推荐）

如果不需要为每个实例单独配置安全组，创建一个安全组并将所有实例的EIP加入允许规则，更高效且符合安全组设计理念：

resource "aws_instance" "ec2" {
  ami           = "ami-0fe0b2cf0e1f25c8a"
  instance_type = var.ec2_instance_type
  count         = var.number_of_instances

  # 关联共用的安全组
  vpc_security_group_ids = [aws_security_group.allow_tls.id]

  tags = {
    Name = "ec2_instance_${count.index}"
  }
}

resource "aws_eip" "lb" {
  vpc   = true
  count = var.number_of_instances
}

resource "aws_eip_association" "eic_assoc" {
  instance_id   = aws_instance.ec2[count.index].id
  allocation_id = aws_eip.lb[count.index].id
  count         = var.number_of_instances
}

# 创建单个安全组，遍历所有EIP生成 ingress 规则
resource "aws_security_group" "allow_tls" {
  name = "first-security-group-created-by-terraform"

  dynamic "ingress" {
    for_each = aws_eip.lb
    content {
      from_port   = var.security_group_port
      to_port     = var.security_group_port
      protocol    = var.security_group_protocol
      cidr_blocks = ["${ingress.value.public_ip}/32"]
    }
  }

  # 显式声明出站规则（AWS默认允许所有出站，显式配置更清晰）
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

方案2：每个实例对应一个独立安全组

如果确实需要为每个实例单独创建安全组，需通过count.index拼接名称保证唯一性：

resource "aws_instance" "ec2" {
  ami           = "ami-0fe0b2cf0e1f25c8a"
  instance_type = var.ec2_instance_type
  count         = var.number_of_instances

  # 关联对应索引的独立安全组
  vpc_security_group_ids = [aws_security_group.allow_tls[count.index].id]

  tags = {
    Name = "ec2_instance_${count.index}"
  }
}

resource "aws_eip" "lb" {
  vpc   = true
  count = var.number_of_instances
}

resource "aws_eip_association" "eic_assoc" {
  instance_id   = aws_instance.ec2[count.index].id
  allocation_id = aws_eip.lb[count.index].id
  count         = var.number_of_instances
}

# 每个实例对应一个安全组，名称加入索引确保唯一
resource "aws_security_group" "allow_tls" {
  name = "first-security-group-created-by-terraform-${count.index}"
  count = var.number_of_instances

  ingress {
    from_port   = var.security_group_port
    to_port     = var.security_group_port
    protocol    = var.security_group_protocol
    cidr_blocks = ["${aws_eip.lb[count.index].public_ip}/32"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

内容的提问来源于stack exchange，提问作者nirkov