如何在Terraform中关联RDS实例与Elastic Beanstalk？

核心逻辑说明 #

要关联RDS实例与Elastic Beanstalk（EB）环境，需完成两个关键操作：给EB应用传递数据库连接参数，以及配置安全组允许EB访问RDS端口。

1. 给EB环境注入数据库连接环境变量 #

在你的aws_elastic_beanstalk_environment资源中，通过setting块添加环境变量，让EB应用能直接获取RDS的连接信息：

resource "aws_elastic_beanstalk_environment" "your_env" {
  name                = "your-eb-env"
  application         = aws_elastic_beanstalk_application.your_app.name
  solution_stack_name = "64bit Amazon Linux 2 v3.4.9 running Python 3.8" # 替换为你的解决方案栈

  # 数据库连接相关环境变量
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_HOST"
    value     = aws_db_instance.default.endpoint
  }

  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_USERNAME"
    value     = aws_db_instance.default.username
  }

  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_PASSWORD"
    value     = aws_db_instance.default.password
  }

  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_DB_NAME"
    value     = aws_db_instance.default.db_name
  }
}

2. 配置安全组允许EB访问RDS #

默认RDS安全组会拒绝外部访问，需添加规则允许EB环境的EC2实例访问数据库端口（MySQL为3306）：

场景一：EB使用默认安全组

先通过数据源获取EB自动创建的安全组，再给RDS安全组添加入站规则：

# 获取EB环境的默认安全组
data "aws_security_group" "eb_default" {
  name = "awseb-${aws_elastic_beanstalk_environment.your_env.name}-*"
}

# 允许EB安全组访问RDS的3306端口
resource "aws_security_group_rule" "rds_allow_eb" {
  type                     = "ingress"
  from_port                = 3306
  to_port                  = 3306
  protocol                 = "tcp"
  source_security_group_id = data.aws_security_group.eb_default.id
  security_group_id        = aws_db_instance.default.vpc_security_group_ids[0]
}

场景二：EB使用自定义安全组

如果你给EB指定了自定义安全组，直接引用该安全组ID配置规则即可：

# 创建EB自定义安全组
resource "aws_security_group" "eb_custom" {
  name        = "eb-custom-sg"
  description = "Elastic Beanstalk环境安全组"
  vpc_id      = aws_vpc.default.id # 替换为你的VPC ID

  # 按需添加EB对外访问规则（比如HTTP/HTTPS）
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# 在EB环境中绑定自定义安全组
resource "aws_elastic_beanstalk_environment" "your_env" {
  # 其他配置...
  setting {
    namespace = "aws:ec2:vpc"
    name      = "SecurityGroups"
    value     = aws_security_group.eb_custom.id
  }
}

# 允许自定义EB安全组访问RDS
resource "aws_security_group_rule" "rds_allow_eb" {
  type                     = "ingress"
  from_port                = 3306
  to_port                  = 3306
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.eb_custom.id
  security_group_id        = aws_db_instance.default.vpc_security_group_ids[0]
}

关键注意事项 #

• 生产环境禁止硬编码数据库密码，建议用aws_secretsmanager_secret存储密码后通过数据源引用。
• skip_final_snapshot = true仅适合测试环境，生产环境需设为false，防止删除数据库时丢失数据。
• 确保RDS与EB环境处于同一VPC，跨VPC场景需额外配置VPC对等连接或网络打通方案。

内容的提问来源于stack exchange，提问作者Mike D Hovhannisyan