Terraform for_each场景下IGW引用错误及调试求助

错误信息 #

Error: Missing resource instance key

    on modules/vpc/main.tf line 55, in resource "aws_route_table" "RT":
    55:       gateway_id = aws_internet_gateway.igw.id
 
    Because aws_internet_gateway.igw has "for_each" set, its attributes must be accessed on
    specific instances.
 
    For example, to correlate with indices of a referring resource, use:
     aws_internet_gateway.igw[each.key]

现有配置文件 #

variables.tf #

variable "vpc" {
    type = map(object({
        cidr = string
        tags = map(string)
    }))
    default = {
      "main" = {
        cidr = "10.0.0.0/16"
        tags = {
          "Name" = "Main-Vpc"
        }
      }
    }
}

# Subnets

variable "subnets" {
  type = map(object({
    cidr = string
    tags = map(string)
  }))
  # Privates
  default = {
    "Private1" = {
      cidr = "10.0.10.0/24"
      tags = {
        "Name" = "Private1"
      }
    }
    "Private2" = {
        cidr = "10.0.20.0/24"
        tags = {
            "Name" = "Private2"
        }
    }
    #Publcs 
    "Public1" = {
        cidr = "10.0.1.0/24"
        tags = {
            "Name" = "Public1"
        }
    }
    "Public2" = {
        cidr = "10.0.2.0/24"
        tags = {
            "Name" = "Public2"
        }
    }
  }
}

# Route tables

variable "route-tables" {
  type = map(object({
    cidr_block = string
    tags  = map(string)
  }))
  default = {
    "Public1" = {
      cidr_block = "0.0.0.0/0"
      tags = {
        "Name" = "Public1"
      }
    }
    "Public2" = {
      cidr_block = "0.0.0.0/0"
      tags = {
        "Name" = "Public2"
      }
    }
    "Private1" = {
      cidr_block = "0.0.0.0/0"
      tags = {
        "Name" = "Private1"
      }
    }
    "Private2" = {
      cidr_block = "0.0.0.0/0"
      tags = {
        "Name" = "Private2"
      }
    }
  }
}

main.tf #

resource "aws_vpc" "main" {
    for_each = var.vpc
    cidr_block = each.value["cidr"]
    tags = each.value["tags"]
}


 
# Creting Privates and Public
resource "aws_subnet" "subnets" {
    vpc_id = aws_vpc.main["main"].id
    for_each = var.subnets
    cidr_block = each.value["cidr"]
    tags = each.value["tags"]

    depends_on = [
      aws_vpc.main
    ]
}

# Gateways and Elastic ip
resource "aws_internet_gateway" "igw" {
  for_each = aws_vpc.main
  vpc_id = aws_vpc.main["main"].id
}

resource "aws_eip" "elastic" {
  vpc = true
}

resource "aws_nat_gateway" "nat" {
  allocation_id = aws_eip.elastic.id
  subnet_id = aws_subnet.subnets["Public1"].id

  tags = {
    "Name" = "nat-gateway"
  }

  depends_on = [
    aws_internet_gateway.igw
  ]
}

# Route tables
resource "aws_route_table" "RT" {
  for_each = var.route-tables
  tags = each.value["tags"]
  vpc_id = aws_vpc.main["main"].id

  dynamic "route" {
    for_each = var.route-tables
    content {
      cidr_block = route.value.cidr_block
      gateway_id = aws_internet_gateway.igw["main"].id
    }
  }
}

问题解决 #

1. 修正gateway_id引用逻辑 #

报错核心是aws_internet_gateway.igw通过for_each创建，属于多实例资源，必须指定具体实例键才能访问属性。结合你的配置，aws_vpc.main的实例键为"main"，因此IGW的正确引用方式是aws_internet_gateway.igw["main"].id。

同时需要修正dynamic route块的逻辑：当前for_each = var.route-tables会为每个路由表生成4条重复路由，不符合预期，应改为针对当前路由表生成单条路由，并区分公网/私网路由的网关类型：

# Route tables
resource "aws_route_table" "RT" {
  for_each = var.route-tables
  tags = each.value["tags"]
  vpc_id = aws_vpc.main["main"].id

  dynamic "route" {
    for_each = [each.value]
    content {
      cidr_block = route.value.cidr_block
      # 公网路由表用IGW，私网路由表用NAT网关
      gateway_id = contains(["Public1", "Public2"], each.key) ? aws_internet_gateway.igw["main"].id : aws_nat_gateway.nat.id
    }
  }
}

2. 优化IGW配置的灵活性 #

你的IGW配置中硬编码了VPC ID，可改为通过each.value.id适配for_each循环，避免后续新增VPC时需要修改代码：

resource "aws_internet_gateway" "igw" {
  for_each = aws_vpc.main
  vpc_id   = each.value.id
}

IGW资源调试方法 #

• 查看单个实例状态：执行以下命令查看指定IGW实例的详细属性

  terraform state show aws_internet_gateway.igw["main"]
  

• 添加输出变量：在模块目录创建outputs.tf，定义全局输出查看所有IGW信息

  output "igw_details" {
    description = "所有互联网网关的详细信息"
    value       = aws_internet_gateway.igw
  }
  

  执行terraform apply或terraform refresh后，终端会输出IGW的完整属性列表。

内容的提问来源于stack exchange，提问作者Lachezar