entityMap|blocks|key|emgjl|text|我们不希望从我们的AWS账户中释放EIP。|type|blockquote|depth|inlineStyleRanges|entityRanges|data|1dhes|是的，你可以阻止它。设置prevent_destroy为true|unstyled|offset|length|style|CODE|1r72l|resource+"aws_eip"+"bastion_eip"+{
++++count+++++++++++=+"${var.num_bastion}"
++++lifecycle+{
++++++prevent_destroy+=+true
++++}
}|code-block|syntax|javascript|448cg|关于分配的弹性公网EIP，请参考@ydaetskcoR的回复^0|0|C|F|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|Q|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|R|9|@$F|S|G|T|H|I]]|A|@]|B|$]]|$2|J|4|K|6|L|8|U|9|@]|A|@]|B|$M|N]]|$2|O|4|P|6|E|8|V|9|@]|A|@]|B|$]]]]

<blockquote>
 we don't want EIPs to be deallocated from our AWS account.
</blockquote>

yes, you can block it. set <code>prevent_destroy</code> to true

<pre><code>resource "aws_eip" "bastion_eip" {
 count = "${var.num_bastion}"
 lifecycle {
 prevent_destroy = true
 }
}
</code></pre>

Regarding EIP assigned, please refer @ydaetskcoR's reply

entityMap|0|type|LINK|mutability|MUTABLE|data|url|https://www.terraform.io/docs/providers/aws/r/eip.html|1|https://www.terraform.io/docs/providers/aws/r/nat_gateway.html|2|https://www.terraform.io/docs/providers/aws/r/instance.html|3|https://github.com/hashicorp/terraform/issues/1273|4|https://www.terraform.io/docs/state/remote.html|5|https://stackoverflow.com/users/498256/bmw|6|https://stackoverflow.com/a/36076669/2291321|blocks|key|4moq5|text|目前，Terraform仅支持在EC2实例上附加弹性IP创建EIP当您可以选择将其附加到实例或弹性网络接口时。NAT网关目前允许您在创建NAT网关时关联弹性公网it，但这是一个稍微特殊的情况。|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|9qdpa|The+实例module它本身只允许对实例是否获得正常的公共IP地址进行布尔选择。有一个GitHub+issue允许实例与预先存在的弹性公网it关联，但在编写时没有拉取请求来支持它。|bs63h|如果这只是一个简单的案例，想要在公司防火墙上打开一个端口，而不必为了一个定期拆除的堡垒盒子而接触它，并且您愿意允许Terraform为您创建和管理EIP，那么您可以执行类似以下操作：|fsv6v|resource+"aws_instance"+"bastion"+{
++ami+++++++++++=+"ami-abcdef12"
++instance_type+=+"t2.micro"
++tags+{
++++Name+=+"bastion"
++}
}

output+"bastion_id"+{
++value+=+"${aws_instance.bastion.id}"
}|code-block|syntax|javascript|4d3d1|在一个单独的文件夹中，您可以拥有自己的EIP定义，还可以从远程状态文件用于堡垒主机，并在应用弹性公网EIP时使用：|djsaj|resource+"terraform_remote_state"+"remote_state"+{
++backend+=+"s3"
++config+{
++++bucket+=+"mybucketname"
++++key++++=+"name_of_key_file"
++}
}

resource+"aws_eip"+"bastion_eip"+{
++vpc++++++=+true
++instance+=+"${terraform_remote_state.remote_state.output.bastion_id}"
++lifecycle+{
++++prevent_destroy+=+true
++}
}|9ogj7|在上面的例子中，我使用了@BMW‘sapproach因此，在任何试图破坏弹性公网EIP的计划中都会出现错误，因为这是一种安全措施。|4fmrs|这至少应该允许您使用Terraform来构建和销毁生命周期较短的实例，但每次都对实例应用相同的EIP，这样您就不必在防火墙上进行任何更改。|8tphu|仅使用Terraform的一种稍微简单的方法是将EIP定义放在相同的.tf文件/文件夹作为堡垒实例，但如果您将文件/文件夹作为堡垒实例，您将无法使用Terraform销毁该文件夹中的任何内容(包括堡垒实例本身)。lifecycle配置块，因为它只是在计划期间导致错误。每次销毁实例时，移除封堵只会让您重新销毁弹性公网EIP。|style|CODE^0|S|5|0|1J|5|1|0|4|8|2|18|C|3|0|0|0|T|6|4|0|0|C|5|5|I|8|6|0|0|Y|3|2Y|9^^$0|$1|$2|3|4|5|6|$7|8]]|9|$2|3|4|5|6|$7|A]]|B|$2|3|4|5|6|$7|C]]|D|$2|3|4|5|6|$7|E]]|F|$2|3|4|5|6|$7|G]]|H|$2|3|4|5|6|$7|I]]|J|$2|3|4|5|6|$7|K]]]|L|@$M|N|O|P|2|Q|R|1H|S|@]|T|@$U|1I|V|1J|M|1K]|$U|1L|V|1M|M|1N]]|6|$]]|$M|W|O|X|2|Q|R|1O|S|@]|T|@$U|1P|V|1Q|M|1R]|$U|1S|V|1T|M|1U]]|6|$]]|$M|Y|O|Z|2|Q|R|1V|S|@]|T|@]|6|$]]|$M|10|O|11|2|12|R|1W|S|@]|T|@]|6|$13|14]]|$M|15|O|16|2|Q|R|1X|S|@]|T|@$U|1Y|V|1Z|M|20]]|6|$]]|$M|17|O|18|2|12|R|21|S|@]|T|@]|6|$13|14]]|$M|19|O|1A|2|Q|R|22|S|@]|T|@$U|23|V|24|M|25]|$U|26|V|27|M|28]]|6|$]]|$M|1B|O|1C|2|Q|R|29|S|@]|T|@]|6|$]]|$M|1D|O|1E|2|Q|R|2A|S|@$U|2B|V|2C|1F|1G]|$U|2D|V|2E|1F|1G]]|T|@]|6|$]]]]

Currently Terraform only supports attaching Elastic IPs to EC2 instances upon <a href="https://www.terraform.io/docs/providers/aws/r/eip.html" rel="nofollow noreferrer">EIP creation</a> when you can choose to optionally attach it to an instance or an Elastic Network Interface. <a href="https://www.terraform.io/docs/providers/aws/r/nat_gateway.html" rel="nofollow noreferrer">NAT Gateways</a> currently allow you to associate an EIP with it upon the NAT Gateway being created but that's a slightly special case.

The <a href="https://www.terraform.io/docs/providers/aws/r/instance.html" rel="nofollow noreferrer">instance module</a> itself only allows a boolean choice of whether the instance gets a normal public IP address or not. There's a <a href="https://github.com/hashicorp/terraform/issues/1273" rel="nofollow noreferrer">GitHub issue</a> around allowing instances to be associated with pre-existing EIPs but at the time of writing no pull request to support it.

If it's simply a case of wanting to open up a port on your corporate firewall once and not having to touch it for a bastion box that is torn down regularly and you're open to allowing Terraform to create and manage the EIP for you then you could do something like the following:

<pre><code>resource "aws_instance" "bastion" {
 ami = "ami-abcdef12"
 instance_type = "t2.micro"
 tags {
 Name = "bastion"
 }
}

output "bastion_id" {
 value = "${aws_instance.bastion.id}"
}
</code></pre>

And in a separate folder altogether you could have your EIP definition and also lookup the outputted instance ID from a <a href="https://www.terraform.io/docs/state/remote.html" rel="nofollow noreferrer">remote state file</a> for the bastion host and use that when applying the EIP:

<pre><code>resource "terraform_remote_state" "remote_state" {
 backend = "s3"
 config {
 bucket = "mybucketname"
 key = "name_of_key_file"
 }
}

resource "aws_eip" "bastion_eip" {
 vpc = true
 instance = "${terraform_remote_state.remote_state.output.bastion_id}"
 lifecycle {
 prevent_destroy = true
 }
}
</code></pre>

In the above example I've used <a href="https://stackoverflow.com/users/498256/bmw">@BMW</a>'s <a href="https://stackoverflow.com/a/36076669/2291321">approach</a> so that you should get an error in any plan that attempts to destroy the EIP just as a fail safe.

This at least should allow you to use Terraform to build and destroy short lived instances but apply the same EIP to the instance each time so you don't have to change anything on your firewall.

A slightly simpler approach using just Terraform would be to put the EIP definition in the same <code>.tf</code> file/folder as the bastion instance but you would be unable to use Terraform to destroy anything in that folder (including the bastion instance itself) if you kept the <code>lifecycle</code> configuration block as it simply causes an error during the plan. Removing the block simply gets you back to destroying the EIP everytime you destroy the instance.

entityMap|0|type|LINK|mutability|MUTABLE|data|url|https://github.com/hashicorp/terraform/pull/5236|1|https://www.terraform.io/docs/providers/aws/r/eip_association.html|blocks|key|4ps6g|text|现有答案已过时。现在可以关联现有的弹性IP，这要归功于此更改：https://github.com/hashicorp/terraform/pull/5236|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|eai1o|文档：https://www.terraform.io/docs/providers/aws/r/eip\_association.html|1r7rr|摘录：|4dacc|aws_弹性公网eip_协会|blockquote|atsug|提供AWS+EIP关联作为顶级资源，以将弹性IP与AWS实例和网络接口关联和取消关联。|2n7cb|注意:+aws_弹性公网eip_当弹性公网in已经存在或分发给客户或用户，因此无法更改时，关联非常有用。^0|V|1C|0|0|3|1V|1|0|0|0|0^^$0|$1|$2|3|4|5|6|$7|8]]|9|$2|3|4|5|6|$7|A]]]|B|@$C|D|E|F|2|G|H|X|I|@]|J|@$K|Y|L|Z|C|10]]|6|$]]|$C|M|E|N|2|G|H|11|I|@]|J|@$K|12|L|13|C|14]]|6|$]]|$C|O|E|P|2|G|H|15|I|@]|J|@]|6|$]]|$C|Q|E|R|2|S|H|16|I|@]|J|@]|6|$]]|$C|T|E|U|2|S|H|17|I|@]|J|@]|6|$]]|$C|V|E|W|2|S|H|18|I|@]|J|@]|6|$]]]]

Existing answer is outdated. Associating existing Elastic IPs is now possible thanks to this change: <a href="https://github.com/hashicorp/terraform/pull/5236" rel="noreferrer">https://github.com/hashicorp/terraform/pull/5236</a>

Docs: <a href="https://www.terraform.io/docs/providers/aws/r/eip_association.html" rel="noreferrer">https://www.terraform.io/docs/providers/aws/r/eip_association.html</a>

Excerpt:

<blockquote>
 aws_eip_association 
 
 Provides an AWS EIP Association as a top level
 resource, to associate and disassociate Elastic IPs from AWS Instances
 and Network Interfaces.
 
 NOTE: aws_eip_association is useful in scenarios where EIPs are either
 pre-existing or distributed to customers or users and therefore cannot
 be changed.
</blockquote>

entityMap|blocks|key|7ms74|text|我花了一些时间解决这个问题，发现其他答案很有帮助，但不完整。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|aca74|对于那些尝试使用Terraform重新分配AWS弹性IP的用户，我们可以使用terraform_remote_state和aws_eip_association。让我解释一下。|offset|length|style|CODE|7afpq|我们应该使用两个独立的根模块，它们位于父文件夹中：|6r8f4|parent_folder
├--elasticip
%7C+++└main.tf
└--server
++++└main.tf|code-block|syntax|javascript|b003i|在elasticip/main.tf您可以使用以下代码创建一个弹性IP，并将状态存储在本地后台，以便您可以从服务器模块访问其输出。输出变量名不能是'+id+'，因为这将与远程状态变量id冲突，它将无法工作。只需使用不同的名称，例如eip_id。|8johe|terraform+{+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++backend+"local"+{+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++path+=+"../terraform-eip.tfstate"+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++}+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
}+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

resource+"aws_eip"+"main"+{
++vpc+=+true
++lifecycle+{
++++prevent_destroy+=+true
++}
}

output+"eip_id"+{
++value+=+"${aws_eip.main.id}"
}|eq8aq|然后在server/main.tf以下代码将创建一台服务器，并将弹性IP与其关联。|d8nsa|data+"terraform_remote_state"+"eip"+{
++backend+=+"local"

++config+{
++++path+=+"../terraform-eip.tfstate"
++}
}

resource+"aws_eip_association"+"eip_assoc"+{
++instance_id+++=+"${aws_instance.web.id}"
++allocation_id+=+"${data.terraform_remote_state.eip.eip_id}"
}

resource+"aws_instance"+"web"+{
++ami+=+"insert-your-AMI-ref"
}|739p9|所有这些都设置好后，您可以进入elasticip文件夹，运行terraform+init，以及terraform+apply获取您的弹性IP。然后进入server文件夹，然后运行相同的两个命令来获取您的服务器及其关联的弹性IP。在服务器文件夹中，您可以运行terraform+destroy和terraform+apply新服务器将获得相同的弹性IP。^0|0|12|M|1P|J|0|0|0|1|H|37|6|0|0|3|E|0|0|F|9|U|E|1B|F|23|6|3K|H|42|F^^$0|$]|1|@$2|3|4|5|6|7|8|Z|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|10|9|@$E|11|F|12|G|H]|$E|13|F|14|G|H]]|A|@]|B|$]]|$2|I|4|J|6|7|8|15|9|@]|A|@]|B|$]]|$2|K|4|L|6|M|8|16|9|@]|A|@]|B|$N|O]]|$2|P|4|Q|6|7|8|17|9|@$E|18|F|19|G|H]|$E|1A|F|1B|G|H]]|A|@]|B|$]]|$2|R|4|S|6|M|8|1C|9|@]|A|@]|B|$N|O]]|$2|T|4|U|6|7|8|1D|9|@$E|1E|F|1F|G|H]]|A|@]|B|$]]|$2|V|4|W|6|M|8|1G|9|@]|A|@]|B|$N|O]]|$2|X|4|Y|6|7|8|1H|9|@$E|1I|F|1J|G|H]|$E|1K|F|1L|G|H]|$E|1M|F|1N|G|H]|$E|1O|F|1P|G|H]|$E|1Q|F|1R|G|H]|$E|1S|F|1T|G|H]]|A|@]|B|$]]]]

I spent some time working through this problem and found the other answers helpful, but incomplete.
For those people trying to reallocate an AWS elastic IP using Terraform, we can do so using a combination of <code>terraform_remote_state</code> and the <code>aws_eip_association</code>. Let me explain.
We should use two separate root modules, themselves within a parent folder:
<pre><code>parent_folder
├--elasticip
| └main.tf
└--server
 └main.tf
</code></pre>
In <code>elasticip/main.tf</code> you can use the following code which will create an elastic IP, and store the state in a local backend so that you can access its output from the server module. The output variable name cannot be 'id', as this will clash with the remote state variable id and it will not work. Just use a different name, such as <code>eip_id</code>.
<pre><code>terraform { 
 backend &quot;local&quot; { 
 path = &quot;../terraform-eip.tfstate&quot; 
 } 
} 
 
resource &quot;aws_eip&quot; &quot;main&quot; {
 vpc = true
 lifecycle {
 prevent_destroy = true
 }
}

output &quot;eip_id&quot; {
 value = &quot;${aws_eip.main.id}&quot;
}
</code></pre>
Then in <code>server/main.tf</code> the following code will create a server and associate the elastic IP with it.
<pre><code>data &quot;terraform_remote_state&quot; &quot;eip&quot; {
 backend = &quot;local&quot;

 config = {
 path = &quot;../terraform-eip.tfstate&quot;
 }
}

resource &quot;aws_eip_association&quot; &quot;eip_assoc&quot; {
 instance_id = &quot;${aws_instance.web.id}&quot;
 allocation_id = &quot;${data.terraform_remote_state.eip.eip_id}&quot;
 #For &gt;= 0.12
 #allocation_id = &quot;${data.terraform_remote_state.eip.outputs.eip_id}&quot;
}

resource &quot;aws_instance&quot; &quot;web&quot; {
 ami = &quot;insert-your-AMI-ref&quot;
}
</code></pre>
With that all set up, you can go into the <code>elasticip</code> folder, run <code>terraform init</code>, and <code>terraform apply</code> to get your elastic IP. Then go into the <code>server</code> folder, and run the same two commands to get your server with its associated elastic IP. From within the server folder you can run <code>terraform destroy</code> and <code>terraform apply</code> and the new server will get the same elastic IP.

entityMap|0|type|LINK|mutability|MUTABLE|data|url|https://forums.aws.amazon.com/thread.jspa?threadID=52601|blocks|key|863v5|text|如果您使用的是自动伸缩组，则可以在用户数据中执行此操作。https://forums.aws.amazon.com/thread.jspa?threadID=52601|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|10p2l|#!/bin/bash
+
#+configure+AWS
aws+configure+set+aws_access_key_id+{MY_ACCESS_KEY}
aws+configure+set+aws_secret_access_key+{MY_SECRET_KEY}
aws+configure+set+region+{MY_REGION}
+
#+associate+Elastic+IP
INSTANCE_ID=$(curl+-s+http://169.254.169.254/latest/meta-data/instance-id)
ALLOCATION_ID={MY_EIP_ALLOC_ID}
aws+ec2+associate-address+--instance-id+$INSTANCE_ID+--allocation-id+$ALLOCATION_ID+--allow-reassociation|code-block|syntax|javascript^0|S|1K|0|0^^$0|$1|$2|3|4|5|6|$7|8]]]|9|@$A|B|C|D|2|E|F|P|G|@]|H|@$I|Q|J|R|A|S]]|6|$]]|$A|K|C|L|2|M|F|T|G|@]|H|@]|6|$N|O]]]]

If you're using an autoscaling group you can do it in the user data. <a href="https://forums.aws.amazon.com/thread.jspa?threadID=52601" rel="nofollow noreferrer">https://forums.aws.amazon.com/thread.jspa?threadID=52601</a>
<pre><code>#!/bin/bash
 
# configure AWS
aws configure set aws_access_key_id {MY_ACCESS_KEY}
aws configure set aws_secret_access_key {MY_SECRET_KEY}
aws configure set region {MY_REGION}
 
# associate Elastic IP
INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
ALLOCATION_ID={MY_EIP_ALLOC_ID}
aws ec2 associate-address --instance-id $INSTANCE_ID --allocation-id $ALLOCATION_ID --allow-reassociation
</code></pre>

We need to whitelist some Elastic IPs from the corporate firewall as allowed destination IPs for SSH. Is there a way to configure a bastion instance with Terraform and assign it a specific Elastic IP? And, likewise, have it return that EIP to the provisioned pool when the bastion is destroyed? Obviously, we don't want EIPs to be deallocated from our AWS account.

Can a bastion be assigned a specific AWS Elastic IP with Terraform?

 我们需要将企业防火墙中的一些弹性IP列入白名单，作为SSH允许的目的IP。有没有办法通过Terraform配置堡垒实例，并为其分配特定的弹性IP？同样，当堡垒被摧毁时，它会将该EIP返回到配置的池中吗？显然，我们不希望EIP从我们的AWS账户中被释放。

问可以使用Terraform为堡垒分配特定的AWS弹性IP吗？
EN

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问可以使用Terraform为堡垒分配特定的AWS弹性IP吗？EN