如何通过Terraform为AWS自动扩展组挂载共享EBS卷？

Hey there, let's break down your problem and figure out the right solutions for you!

First, a critical point to clarify: a standard EBS volume can't be attached to multiple EC2 instances at the same time (unless you use Multi-Attach enabled io2/io3 volumes, which have strict limitations—same AZ, specific instance types, can't be root volumes, etc. This is usually for specialized use cases like clustered databases, not general shared storage). So your initial approach of trying to mount the same aws_ebs_volume.shared_volume to all ASG instances won't work by default.

Below are two common scenarios and their corresponding Terraform implementations:

If your goal is to let all instances in the ASG access the same shared data, AWS EFS (Elastic File System) is the better choice—it supports simultaneous mounts across multiple instances and even across availability zones.

Modified Terraform Configuration #

# Create EFS file system
resource "aws_efs_file_system" "shared_efs" {
  creation_token = "${var.app_name}-shared-efs"
  tags = {
    Name = "${var.app_name}-shared-efs"
  }
}

# Create EFS mount targets for each private subnet
resource "aws_efs_mount_target" "efs_mount_target" {
  count             = length(data.aws_subnet_ids.private.ids)
  file_system_id    = aws_efs_file_system.shared_efs.id
  subnet_id         = element(data.aws_subnet_ids.private.ids, count.index)
  security_groups   = [var.app_security_group_id] # Ensure security group allows NFS traffic (port 2049)
}

# Replace Launch Configuration with Launch Template (AWS-recommended, more flexible)
resource "aws_launch_template" "flume-conf" {
  name_prefix   = "${var.app_name}-flume-"
  image_id      = var.app_ami_id
  instance_type = var.app_instance_type
  key_name      = var.ssh_key_name
  security_group_ids = [var.app_security_group_id]
  iam_instance_profile {
    name = var.app_iam_role
  }
  block_device_mappings {
    device_name = "/dev/sda1"
    ebs {
      volume_size = 50
      volume_type = "gp2"
    }
  }
  # Add EFS mount script to user data for automatic mounting on instance startup
  user_data = base64encode(data.template_file.config.rendered <<EOF
#!/bin/bash
# Install NFS client (adjust for your OS: use apt for Ubuntu, yum for Amazon Linux)
yum install -y nfs-utils
# Create mount directory
mkdir -p /mnt/shared-efs
# Mount EFS using its DNS name (automatically resolves to the correct AZ mount target)
mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport ${aws_efs_file_system.shared_efs.dns_name}:/ /mnt/shared-efs
# Add to fstab for automatic mount on reboot
echo "${aws_efs_file_system.shared_efs.dns_name}:/ /mnt/shared-efs nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0" >> /etc/fstab
EOF
  )
}

resource "aws_autoscaling_group" "ec2_asg" {
  name                      = "${var.app_name}"
  launch_template {
    id      = aws_launch_template.flume-conf.id
    version = "$Latest"
  }
  min_size                  = var.asg_min_size
  max_size                  = var.asg_max_size
  vpc_zone_identifier       = data.aws_subnet_ids.private.ids
  availability_zones        = var.availability_zones
  lifecycle {
    create_before_destroy = false
  }
}

Key Notes #

• EFS mount targets automatically associate with subnets, so instances can mount the correct AZ target via EFS's DNS name without manual instance ID configuration
• Adjust the NFS client installation command to match your AMI's OS (e.g., apt-get install nfs-common for Ubuntu)
• Ensure your security group allows inbound NFS (port 2049) traffic from the ASG instance security group

If you need each ASG instance to have its own dedicated EBS volume (not shared), you can configure a block device mapping directly in the Launch Template. This lets instances automatically create and attach the volume on startup, no manual aws_volume_attachment needed.

Modified Terraform Configuration #

resource "aws_launch_template" "flume-conf" {
  name_prefix   = "${var.app_name}-flume-"
  image_id      = var.app_ami_id
  instance_type = var.app_instance_type
  key_name      = var.ssh_key_name
  security_group_ids = [var.app_security_group_id]
  iam_instance_profile {
    name = var.app_iam_role
  }
  # Root volume configuration
  block_device_mappings {
    device_name = "/dev/sda1"
    ebs {
      volume_size = 50
      volume_type = "gp2"
    }
  }
  # Additional EBS volume: auto-created and attached to /dev/xvdb on instance startup
  block_device_mappings {
    device_name = "/dev/xvdb"
    ebs {
      volume_size = 2
      volume_type = "gp2"
      delete_on_termination = false # Optional: keep volume when instance terminates, adjust as needed
    }
  }
  user_data = data.template_file.config.rendered
}

resource "aws_autoscaling_group" "ec2_asg" {
  name                      = "${var.app_name}"
  launch_template {
    id      = aws_launch_template.flume-conf.id
    version = "$Latest"
  }
  min_size                  = var.asg_min_size
  max_size                  = var.asg_max_size
  vpc_zone_identifier       = data.aws_subnet_ids.private.ids
  availability_zones        = var.availability_zones
  lifecycle {
    create_before_destroy = false
  }
}

Key Notes #

• Each ASG instance will get its own 2GB EBS volume, automatically attached to /dev/xvdb
• Use delete_on_termination to control whether the volume is retained when the instance is terminated
• No separate aws_volume_attachment resource is needed—the Launch Template handles volume creation and attachment automatically

Your original aws_volume_attachment requires a fixed instance_id, but ASG instances are dynamically created and destroyed. There's no way to predict instance IDs in advance, so this approach can't work for ASGs. Plus, EBS volumes don't support multi-instance mounts by default, making this architecture invalid regardless of Terraform.

内容的提问来源于stack exchange，提问作者NRJ