问Terraform和VPC对等

EN

# my_ops_stack.tf

provider "aws" {
  region = "eu-west-1"
}

module "ops_stack" {
  source = "/my/modules/ops_stack"
  cidr   = "10.1.0.0/16"
  // other vars probably
}

// the outputs which will be accessible 
// via the remote state data source:
output "routing_table_id" { 
  value = "${module.ops_stack.routing_table_id}"
}
output "vpc_id" {
  value = "${module.ops_stack.vpc_id}"
}
output "vpc_cidr" {
  value = "10.1.0.0/16"
}

# Run in the same folder as my_ops_stack.tf
terraform remote config \
  -backend=s3 \
  -backend-config="bucket=my-state-bucket" \
  -backend-config="key=ops-stack/terraform.tfstate" \
  -backend-config="region=eu-west-1"

terraform apply
# the usual stuff... but now synced with s3!

# my_dev_stack.tf

provider "aws" {
  region = "eu-west-1"
}

// Pull in your ops stack from the remote backend:
data "terraform_remote_state" "ops_stack" {
    backend = "s3"
    config {
        bucket = "my-state-bucket"
        key = "ops-stack/terraform.tfstate"
        region = "eu-west-1"
    }
}

// Create your dev stack
module "dev_stack" {
  source            = "/my/modules/dev_stack"
  cidr              = "10.2.0.0/16"
  // The ops_stack vpc id for creating the peering connection:
  ops_vpc_id        = "${data.terraform_remote_state.ops_stack.vpc_id}"
  // Maybe some security group rules you wanna setup
  allow_access_from = "${data.terraform_remote_state.ops_stack.vpc_cidr}"
  // other vars probably
}

// And use its outputs to add a route to the 
// ops vpc routing table from the dev stack!
resource "aws_route" "ops_to_dev" {
    route_table_id = "${data.terraform_remote_state.ops_stack.routing_table_id}" 
    destination_cidr_block = "10.2.0.0/16" // dev_stack's cidr
    vpc_peering_connection_id = "${module.dev_stack.vpcx_id}"
}

#!/bin/bash
region=$(find . -name "*vars.tf"|cut -d/ -f2|cut -d- -f1-3)
profile=$(find . -name "*vars.tf" -exec grep 'variable "profile"' {} \; |awk '{print $6}'|tr -d '"')
account=$(pwd|cut -d/ -f5|cut -d- -f1)

getData(){
    for id in ${ids[@]}; do
        output=$(aws ec2 describe-vpc-peering-connections --region $region --profile $account --vpc-peering-connection-ids $id)
        cidr=$(echo "$output"|jq '.VpcPeeringConnections[].RequesterVpcInfo.CidrBlock'|tr -d '"')
        if [[ $1 == cidr ]]; then
            echo $cidr
        elif [[ $1 == id ]]; then
            echo $id
        fi
    done
}
checkOps() {
    pwd|grep 'ops' &>/dev/null
}
populateRoutes() {
    if ! checkOps; then
        echo "Must be run from the ops directory"
        exit 1
    fi
    ids=($(aws ec2 describe-vpc-peering-connections --region $region --profile $account --filters "Name=status-code,Values=active"|jq '.VpcPeeringConnections[].VpcPeeringConnectionId'|tr -d '"'))
    if (( ${#ids[@]} == 0 )); then
        echo "No update necessary"
        exit 0
    fi

    cidr_list=($(getData cidr))
    cidr_format=$(echo "${cidr_list[@]}"|tr ' ' ',')
    echo $cidr_format

    id_list=($(getData id))
    id_format=$(echo "${id_list[@]}"|tr ' ' ',')
    echo $id_format

    if (( ${#cidr_list[@]} != ${#id_list[@]} )); then
        echo "CIDR List and ID List do not match"
        exit 1
    fi

    sed -i "/pcx_count/c\variable\ \"pcx_count\"\ \{\ default \=\ \"${#ids[@]}\" \}" ./variables.tf
    sed -i "/ops_cidrs/c\variable\ \"ops_cidrs\"\ \{\ default\ \=\ \"$cidr_format\"\ \}" ./variables.tf
    sed -i "/pcx_ids/c\variable\ \"pcx_ids\"\ \{\ default\ \=\ \"$id_format\"\ \}" ./variables.tf
}

populateRoutes