如何通过Terraform自动传递Postgres信息至AWS Elastic Beanstalk Python应用

我正在用Terraform管理AWS Elastic Beanstalk应用和环境，希望将Terraform创建的Postgres数据库信息自动传递给Python应用，无需手动配置。以下是具体实现方法：

步骤1：在Terraform中为Elastic Beanstalk配置数据库环境变量 #

修改Terraform/elastic_beanstalk.tf，在aws_elastic_beanstalk_environment资源中添加数据库相关的环境变量配置，直接通过Terraform引用RDS实例的属性：

resource "aws_elastic_beanstalk_application" "application" {
  name = "my-awesome-app"
}

resource "aws_elastic_beanstalk_environment" "environment" {
  name                = "my-awesome-environment"
  application         = aws_elastic_beanstalk_application.application.name
  solution_stack_name = "64bit Amazon Linux 2 v3.4.0 running Python 3.8"

  setting {
    namespace = "aws:autoscaling:launchconfiguration"
    name      = "IamInstanceProfile"
    value     = "aws-elasticbeanstalk-ec2-role"
  }

  # 传递数据库连接信息到EB环境变量
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_HOSTNAME"
    value     = aws_db_instance.dbbanco.address
  }

  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_PORT"
    value     = aws_db_instance.dbbanco.port
  }

  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_DB_NAME"
    value     = aws_db_instance.dbbanco.name
  }

  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_USERNAME"
    value     = aws_db_instance.dbbanco.username
  }

  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RDS_PASSWORD"
    value     = var.db_password
  }
}

步骤2：修正Python数据库配置代码 #

修改database.py，移除无用的endpoint参数，确保变量引用逻辑正确：

import os

if 'RDS_DB_NAME' in os.environ:
    DATABASE_URL = (
        'postgresql://{username}:{password}@{host}:{port}/{database}'.format(
            username=os.environ['RDS_USERNAME'],
            password=os.environ['RDS_PASSWORD'],
            host=os.environ['RDS_HOSTNAME'],
            port=os.environ['RDS_PORT'],
            database=os.environ['RDS_DB_NAME']
        )
    )

步骤3：优化RDS安全组（可选但推荐） #

为提升安全性，将RDS安全组的访问权限限制为仅允许Elastic Beanstalk实例访问，而非开放给所有IP。修改Terraform/db.tf中的aws_security_group.rds：

resource "aws_security_group" "rds" {
  name   = "helptech_rds"
  vpc_id = module.vpc.vpc_id

  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    # 仅允许EB实例安全组访问RDS
    security_groups = [aws_elastic_beanstalk_environment.environment.instance_security_group]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "helptech_rds"
  }
}

验证部署 #

执行terraform apply部署或更新基础设施，Terraform会自动将RDS的连接信息注入到Elastic Beanstalk的环境变量中。EB启动时，Python应用可直接读取这些环境变量生成数据库连接URL。

内容的提问来源于stack exchange，提问作者roger oliveira