如何绕过AWS Terraform Provider的ECS服务5个负载均衡配置限制？

问题根源 #

当前AWS Terraform Provider对aws_ecs_service资源的load_balancer块存在硬编码的最多5个条目限制，但AWS底层API和控制台实际上支持配置更多负载均衡关联，因此会出现控制台可行但Terraform报错的矛盾情况。

解决方案 #

方案1：升级AWS Terraform Provider到最新版本 #

优先尝试升级你的AWS Provider版本，后续版本可能已跟进AWS API更新，解除了5个负载均衡的限制。在Terraform配置文件顶部指定最新稳定版本：

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.20.0" # 替换为当前最新稳定版本
    }
  }
}

执行terraform init完成版本升级后，重新运行terraform apply，若限制已解除，原有代码即可正常运行。

方案2：使用local-exec调用AWS CLI绕过限制 #

如果升级Provider后问题仍存在，可通过null_resource配合local-exec provisioner直接调用AWS CLI创建/更新ECS服务，绕过Terraform资源的硬编码限制。

示例代码

# 保留原有依赖资源（集群、任务定义、目标组等）
resource "aws_ecs_cluster" "elastic_integrations" {
  name = "elastic_integrations"
}

resource "aws_ecs_task_definition" "elastic_agent" {
  family                   = "elastic_agent"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.ecs_execution.arn
  task_role_arn            = aws_iam_role.ecs_task.arn
  container_definitions    = jsonencode([{
    name      = "elastic_agent"
    image     = "docker.elastic.co/beats/elastic-agent:8.10.0"
    portMappings = [
      # 根据实际业务需求添加端口映射
      { containerPort = 8080 },
      { containerPort = 8081 },
      { containerPort = 8082 },
      { containerPort = 8083 },
      { containerPort = 8084 },
      { containerPort = 8085 }
    ]
  }])
}

resource "aws_lb_target_group" "ecs_service" {
  for_each = local.xxxx_mappings
  name     = "tg-${each.key}"
  port     = each.value
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
  target_type = "ip"
}

# 通过null_resource + local-exec创建/更新ECS服务
resource "null_resource" "ecs_elastic_agent_service" {
  triggers = {
    cluster_id          = aws_ecs_cluster.elastic_integrations.id
    task_def_arn        = aws_ecs_task_definition.elastic_agent.arn
    target_groups_json  = jsonencode([for k, v in local.xxxx_mappings : {
      targetGroupArn = aws_lb_target_group.ecs_service[k].arn
      containerName  = "elastic_agent"
      containerPort  = v
    }])
    desired_count       = 1
    subnets             = join(",", aws_subnet.main.*.id)
    security_groups     = aws_security_group.ecs_service.id
  }

  # 自动判断服务是否存在，存在则更新，不存在则创建
  provisioner "local-exec" {
    command = <<EOT
      if aws ecs describe-services --cluster ${self.triggers.cluster_id} --services elastic_agent >/dev/null 2>&1; then
        aws ecs update-service \
          --cluster ${self.triggers.cluster_id} \
          --service-name elastic_agent \
          --task-definition ${self.triggers.task_def_arn} \
          --desired-count ${self.triggers.desired_count} \
          --load-balancers '${self.triggers.target_groups_json}' \
          --network-configuration "awsvpcConfiguration={subnets=[${self.triggers.subnets}],securityGroups=[${self.triggers.security_groups}],assignPublicIp=ENABLED}"
      else
        aws ecs create-service \
          --cluster ${self.triggers.cluster_id} \
          --service-name elastic_agent \
          --task-definition ${self.triggers.task_def_arn} \
          --launch-type FARGATE \
          --desired-count ${self.triggers.desired_count} \
          --load-balancers '${self.triggers.target_groups_json}' \
          --network-configuration "awsvpcConfiguration={subnets=[${self.triggers.subnets}],securityGroups=[${self.triggers.security_groups}],assignPublicIp=ENABLED}"
      fi
    EOT
  }
}

注意事项

• 确保本地环境已配置AWS CLI凭证，且凭证拥有ecs:CreateService、ecs:UpdateService、ecs:DescribeServices等权限
• 根据实际网络环境调整network-configuration中的子网、安全组和公网IP配置
• 此方式下，ECS服务的负载均衡配置不会被Terraform状态管理，后续变更需同步更新local-exec中的命令参数

内容的提问来源于stack exchange，提问作者user20803163