Terraform AWS：如何引用for_each创建的子网ID以关联路由表？

在Terraform中，不需要通过输出引用子网ID，直接在同一配置文件中引用子网资源的实例即可。以下是完整的实现示例，包含变量定义、子网创建、路由表创建及动态关联的代码：

1. variables.tf 子网变量定义 #

variable "subnets" {
  type = map(object({
    cidr_block        = string
    availability_zone = string
    is_public         = bool # 标记子网类型（公有/私有）
  }))
  default = {
    public-subnet-1 = {
      cidr_block        = "10.0.1.0/24"
      availability_zone = "us-east-1a"
      is_public         = true
    }
    public-subnet-2 = {
      cidr_block        = "10.0.2.0/24"
      availability_zone = "us-east-1b"
      is_public         = true
    }
    private-subnet-1 = {
      cidr_block        = "10.0.3.0/24"
      availability_zone = "us-east-1a"
      is_public         = false
    }
    private-subnet-2 = {
      cidr_block        = "10.0.4.0/24"
      availability_zone = "us-east-1b"
      is_public         = false
    }
  }
}

variable "vpc_cidr" {
  type    = string
  default = "10.0.0.0/16"
}

2. main.tf 资源创建与关联 #

# 创建VPC
resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr
}

# 用for_each批量创建子网
resource "aws_subnet" "main" {
  for_each             = var.subnets
  vpc_id               = aws_vpc.main.id
  cidr_block           = each.value.cidr_block
  availability_zone    = each.value.availability_zone
  map_public_ip_on_launch = each.value.is_public # 公有子网自动分配公网IP

  tags = {
    Name = each.key
  }
}

# 创建Internet网关（用于公有子网）
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
}

# 公有子网路由表
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = "public-route-table"
  }
}

# 创建NAT网关（用于私有子网）
resource "aws_eip" "nat" {
  vpc = true
}

resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.main["public-subnet-1"].id # 部署在公有子网内
}

# 私有子网路由表
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main.id
  }

  tags = {
    Name = "private-route-table"
  }
}

# 动态关联公有子网与公有路由表
resource "aws_route_table_association" "public" {
  for_each       = { for k, subnet in aws_subnet.main : k => subnet if subnet.map_public_ip_on_launch }
  subnet_id      = each.value.id
  route_table_id = aws_route_table.public.id
}

# 动态关联私有子网与私有路由表
resource "aws_route_table_association" "private" {
  for_each       = { for k, subnet in aws_subnet.main : k => subnet if !subnet.map_public_ip_on_launch }
  subnet_id      = each.value.id
  route_table_id = aws_route_table.private.id
}

核心逻辑说明 #

• 子网引用方式：aws_subnet.main是一个map类型的资源实例集合，key对应var.subnets中的键名，value包含子网的所有属性（包括id），直接通过each.value.id即可获取子网ID。
• 动态筛选关联：使用for表达式筛选出公有/私有子网，再通过for_each批量创建路由表关联资源，避免手动逐个关联。
• 依赖自动处理：Terraform会自动识别资源间的依赖关系，确保子网创建完成后再执行路由表关联操作，无需额外配置。

可选筛选方式 #

如果你的子网命名规则包含明确标识（如key中包含public/private），也可以通过字符串匹配筛选：

# 按子网名称关键字筛选公有子网
resource "aws_route_table_association" "public" {
  for_each       = { for k, subnet in aws_subnet.main : k => subnet if contains(k, "public") }
  subnet_id      = each.value.id
  route_table_id = aws_route_table.public.id
}

内容的提问来源于stack exchange，提问作者Poro