Terraform部署EC2实例公网访问异常：无法Ping通且8080端口无法连通

你的Terraform配置存在多个关键问题，导致EC2实例无法从公网访问，以下是具体问题和修复方案：

1. 安全组配置错误 #

• VPC引用不完整：aws_security_group的vpc_id字段写成了aws_vpc.，缺少vpc.id，会导致配置报错，安全组无法正确关联VPC。修复后应为：

  vpc_id = aws_vpc.vpc.id
  

• 入站规则限制内网访问：当前ICMP（Ping）和8080端口的入站规则仅允许VPC内部CIDR访问，公网流量被拦截。需要将cidr_blocks改为["0.0.0.0/0"]（允许所有公网IP，或指定你需要的公网IP段）：

  ingress {
    from_port   = 8
    to_port     = 8
    protocol    = "icmp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  

• ICMP规则参数错误：Ping对应的ICMP类型是8，你设置了to_port = 0，这会导致ICMP包被拦截。需要将to_port改为8，或者使用更清晰的icmp_type_code块：

  ingress {
    protocol    = "icmp"
    cidr_blocks = ["0.0.0.0/0"]
    icmp_type_code {
      type = 8
      code = 0
    }
  }
  

2. 子网配置错误 #

子网使用了count.index但未定义count值，会导致Terraform报错，实例无法关联子网。如果只需要一个子网，移除count相关配置：

resource "aws_subnet" "subnet" {
  vpc_id                  = aws_vpc.vpc.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = true
}

如果需要多个子网，添加count参数，比如：

resource "aws_subnet" "subnet" {
  count                   = 1
  vpc_id                  = aws_vpc.vpc.id
  cidr_block              = cidrsubnet("10.0.0.0/16", 8, count.index)
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = true
}

3. 缺少公网路由表配置 #

仅创建Internet Gateway（IGW）不足以让VPC内的实例访问公网，需要创建路由表并添加默认路由指向IGW，同时关联到子网：

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.ig.id
  }

  tags = {
    Name = "public-route-table"
  }
}

resource "aws_route_table_association" "public-subnet" {
  subnet_id      = aws_subnet.subnet.id
  route_table_id = aws_route_table.public.id
}

修复后的完整配置示例 #

resource "aws_vpc" "vpc" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_internet_gateway" "ig" {
  vpc_id = aws_vpc.vpc.id

  tags = {
    Name = "main"
  }
}

resource "aws_subnet" "subnet" {
  vpc_id                  = aws_vpc.vpc.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = true
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.ig.id
  }

  tags = {
    Name = "public-route-table"
  }
}

resource "aws_route_table_association" "public-subnet" {
  subnet_id      = aws_subnet.subnet.id
  route_table_id = aws_route_table.public.id
}

resource "aws_security_group" "security" {
  name   = "security"
  vpc_id = aws_vpc.vpc.id

  ingress {
    protocol    = "icmp"
    cidr_blocks = ["0.0.0.0/0"]
    icmp_type_code {
      type = 8
      code = 0
    }
  }

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "applications" {
  ami                    = "ami-08c40ec9ead489470"
  instance_type          = "t2.micro"
  vpc_security_group_ids = [aws_security_group.security.id]
  subnet_id              = aws_subnet.subnet.id
}

内容的提问来源于stack exchange，提问作者mortymacs