使用Terraform创建的EC2实例无法访问

Question

我一直在跟随这个 Youtube 教程 学习 Terraform，并按照每个步骤进行操作。在运行 `terraform apply` 后，一切都像预期的那样设置好了。我已经在 AWS 控制台上验证过了。但是在尝试访问公共 IP 时，它显示连接被拒绝。

下面是我的 main.tf 文件的内容。

provider "aws" {
  region     = "us-east-1"
  access_key = "ACCESS-KEY"
  secret_key = "SECERT-KEY"
}

# VPC
resource "aws_vpc" "prod-vpc" {
  cidr_block = "10.0.0.0/16"
  tags = {
      Name = "production"
  }
}

# create internet gateway 
resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.prod-vpc.id
  tags = {
    Name : "Prod gateway"
  }
}

# create custom route table 

resource "aws_route_table" "prod-route-table" {
  vpc_id = aws_vpc.prod-vpc.id

  route {
      cidr_block = "0.0.0.0/0"
      gateway_id = aws_internet_gateway.gw.id
  }

  route {
      ipv6_cidr_block        = "::/0"
      gateway_id = aws_internet_gateway.gw.id
  }

  tags = {
    Name = "Prod"
  }
}

# Create a subnet 

resource "aws_subnet" "subnet-1" {
    vpc_id = aws_vpc.prod-vpc.id
    cidr_block = "10.0.1.0/24"
    availability_zone = "us-east-1a"
    map_public_ip_on_launch = true

    tags = {
        Name = "prod-subnet"
    }
}

# Associate subnet with Route Table 

resource "aws_route_table_association" "a" {
  subnet_id      = aws_subnet.subnet-1.id
  route_table_id = aws_route_table.prod-route-table.id
}

# Create Security Group to allow port 22, 80, 443

resource "aws_security_group" "allow_web" {
  name        = "allow_web_traffic"
  description = "Allow Web traffic"
  vpc_id      = aws_vpc.prod-vpc.id

  ingress {
      description      = "HTTPS"
      from_port        = 443
      to_port          = 443
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]
    }

  ingress {
      description      = "HTTP"
      from_port        = 80
      to_port          = 80
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]
    }
  ingress {
      description      = "SSH"
      from_port        = 2
      to_port          = 2
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]
    }

  egress {
      from_port        = 0
      to_port          = 0
      protocol         = "-1"
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = ["::/0"]
    }

  tags = {
    Name = "allow_web"
  }
}

# Create a network interface with an ip in the subnet that was created earlier 

resource "aws_network_interface" "web-server-nic" {
  subnet_id       = aws_subnet.subnet-1.id
  private_ips     = ["10.0.1.50"]
  security_groups = [aws_security_group.allow_web.id]

  tags = {
    Name : "prod-network-interface"
  }
}

# Assign an elastic ip to the network interface created in previous step

resource "aws_eip" "one" {
  vpc                       = true
  network_interface         = aws_network_interface.web-server-nic.id
  associate_with_private_ip = "10.0.1.50"
  depends_on = [aws_internet_gateway.gw, aws_instance.web-server-instance]

  tags = {
    Name : "Prod-Elastic-ip"
  }
}

# Create Ubuntu server and install/enable apache2

resource "aws_instance" "web-server-instance" {
    ami = "ami-0747bdcabd34c712a"
    instance_type = "t2.micro"
    availability_zone = "us-east-1a"
    key_name = "main-key"

    network_interface {
        device_index = 0
        network_interface_id = aws_network_interface.web-server-nic.id
    }

    user_data = <<-EOF
        #! /bin/bash
        sudo apt update -y 
        sudo apt install apache2
        sudo bash -c 'echo your very first web server > /var/www/html/index.html'
        EOF

    tags = {
      Name : "Web-Server"
    }    
}

- kanhaiyakumar

---

SSH端口是22，而不是2。 - 30thh

Web服务器是否正在运行并侦听指定端口？请使用“curl”或“wget”在服务器控制台上进行检查。 - 30thh

如果您配置了VPC以分配公共IP，那么为什么还需要弹性IP？ - 30thh

感谢您的建议和帮助@30thh。我仍在学习和探索这些东西，所以我只是按照教程进行操作。但我会更深入地探索您所建议的内容。 - kanhaiyakumar

Answer 1

你的用户数据中缺少了 -y，所以你的用户数据将会停留在确认阶段。正确的格式应该是：

sudo apt install -y apache2

- Marcin

---

感谢@Marcin的快速帮助。 如果其他人正在遵循相同的教程并遇到问题，我会提到我遇到的问题。在编写弹性IP脚本时出现错误，我搜索并发现最好也将依赖项放在AWS实例上。您可以在我的脚本中参考此小更改。 `resource "aws_eip" "one" { ... depends_on = [aws_internet_gateway.gw, aws_instance.web-server-instance] tags = { Name : "Prod-Elastic-ip" } }` - kanhaiyakumar

Answer 2

您错过了另一个命令需要在安装完apache2后启动它。

sudo systemctl start apache2

- Buddhika dananjaya

Answer 3

看起来安全组上的SSH端口配置不正确。from_port和to_port都应该是22而不是2。

- Gregor Zurowski

Answer 4

这里的主要问题在于安全组。针对SSH配置，您应该打开端口22，即默认的SSH端口。

  ingress {
      description      = "SSH"
      from_port        = 22
      to_port          = 22
      protocol         = "tcp"
      cidr_blocks      = ["0.0.0.0/0"]
    }

此外，您应该使用以下代码修复您的用户数据：

        #! /bin/bash
        sudo apt update -y 
        sudo apt install apache2 -y
        sudo systemctl start apache2
        sudo bash -c 'echo your very first web server > /var/www/html/index.html'

我希望这可以帮助你和其他遇到相同或类似问题的人。

- Nuno Oliveira