如何通过Terraform为已有AWS EC2实例的安全组添加新规则

Got it, let's fix your issue first: the problem you're facing (creating duplicate security groups with the same name) usually happens when Terraform tries to manage a security group that already exists in AWS—either because you accidentally defined an aws_security_group resource for it, or your state has leftover entries from previous attempts.

Here's the correct approach to add rules to your existing security group without creating duplicates:

Step 1: Reference the Existing Security Group with a Data Source #

Instead of hardcoding the security group ID directly (which works but is less maintainable), use a data block to fetch the existing security group. This tells Terraform you're only reading its details, not trying to create or replace it.

Add this to your configuration:

data "aws_security_group" "existing_sg" {
  id = "sg-061e#####8"  # Replace with your actual security group ID
}

Step 2: Update Security Group Rules to Use the Data Source #

Modify your aws_security_group_rule resources to reference the security group ID from the data source. Also, note that in Terraform 0.12+, you don't need ${} interpolation for variables anymore:

resource "aws_security_group_rule" "rule1" {
  count       = var.count
  type        = "ingress"
  from_port   = var.portNumber
  to_port     = var.toPort
  protocol    = var.protocol
  cidr_blocks = var.cidr_blocks
  security_group_id = data.aws_security_group.existing_sg.id
}

resource "aws_security_group_rule" "rule2" {
  type        = "ingress"
  from_port   = var.portNumber2
  to_port     = var.toPort2
  protocol    = var.protocol2
  cidr_blocks = var.cidr_blocks2
  security_group_id = data.aws_security_group.existing_sg.id
}

Step 3: Clean Up Any Accidental Security Group Resources #

If you previously had an aws_security_group resource defined for this existing SG (even if you commented it out), Terraform might still track it in its state. To fix this:

• Check your configuration and delete any aws_security_group resource that tries to create an SG with the same name/ID as your existing one.
• Run terraform state rm aws_security_group.your_sg_name (replace with the resource name you used) to remove it from Terraform's state if it's still tracked.

Step 4: Verify with Terraform Plan #

Run terraform plan to confirm the changes. You should only see Terraform planning to add the new security group rules, not create a new security group. If you still see a plan to create an SG, double-check your configuration for leftover aws_security_group resources.

Optional: Update Your EC2 Instance Configuration #

For consistency, you can update your EC2 instance to use the data source's SG ID:

resource "aws_instance" "example" {
  ami                         = "ami-0375ca3842950ade6"
  instance_type               = "t2.micro"
  key_name                    = aws_key_pair.deployer.id
  associate_public_ip_address = true
  vpc_security_group_ids      = [data.aws_security_group.existing_sg.id]
}

Key Notes #

• Never define an aws_security_group resource for an SG that already exists in AWS unless you want Terraform to take over full management of it (which would replace the existing SG if not configured correctly).
• Using data sources ensures Terraform respects the existing resource's lifecycle while allowing you to add rules to it.

内容的提问来源于stack exchange，提问作者MeghP