Question

我有一个Terraform脚本，非常适合type=A记录DNS。因此，当我执行此操作时：

data "aws_acm_certificate" "this" {
  domain = "*.${var.CERTIFICATE_DOMAIN}"
}

resource "aws_security_group" "this" {
  name        = "${var.SERVICE}-${var.ENV}-${var.REGION}-allow_all"
  description = "Allow all inbound traffic"
  vpc_id      = "${data.aws_vpc.this.id}"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

data "aws_subnet_ids" "this" {
  vpc_id = "${data.aws_vpc.this.id}"

  tags {
    Service = "external"
  }
}

data "aws_security_groups" "ecs" {
  tags {
    Environment = "${var.VPC_ENV}"
    Region      = "${var.REGION}"
  }

  filter {
    name   = "vpc-id"
    values = ["${data.aws_vpc.this.id}"]
  }

  filter {
    name   = "group-name"
    values = ["${var.ENV}-api-internal-ecs-host*-sg"]
  }
}

resource "aws_security_group_rule" "lb2ecs" {
  from_port                = 32768
  to_port                  = 65535
  protocol                 = "tcp"
  security_group_id        = "${data.aws_security_groups.ecs.ids[0]}"
  source_security_group_id = "${aws_security_group.this.id}"
  type                     = "ingress"
}

resource "aws_alb" "https" {
  name               = "${var.SERVICE}-${var.ENV}-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = ["${aws_security_group.this.id}"]
  subnets            = ["${data.aws_subnet_ids.this.ids}"]
}

data "aws_route53_zone" "this" {
  name         = "${var.CERTIFICATE_DOMAIN}."
  private_zone = false
}

resource "aws_route53_record" "www" {
  zone_id = "${data.aws_route53_zone.this.zone_id}"
  name    = "${var.SERVICE}-${var.ENV}-${var.REGION}.${var.CERTIFICATE_DOMAIN}"
  type    = "A"

  alias {
    name                   = "${aws_alb.https.dns_name}"
    zone_id                = "${aws_alb.https.zone_id}"
    evaluate_target_health = true
  }
}

resource "aws_alb_target_group" "https" {
  name     = "${var.SERVICE}-${var.ENV}-https"
  port     = 3000
  protocol = "HTTP"
  vpc_id   = "${data.aws_vpc.this.id}"

  health_check {
    path = "/health"
  }
}

resource "aws_alb_listener" "https" {
  load_balancer_arn = "${aws_alb.https.arn}"
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2015-05"
  certificate_arn   = "${data.aws_acm_certificate.this.arn}"

  default_action {
    type             = "forward"
    target_group_arn = "${aws_alb_target_group.https.arn}"
  }
}

它可以正确创建新的HTTPS终结点，并且我可以轻松地在其后面放置服务（通过将aws_alb_target_group.https与ECS服务链接）

我需要添加IPv6支持，所以我在想-将resource "aws_route53_record" "www"中的A类型更改为AAAA怎么办？很好地执行了terraform声明，说明它已更改，在Route 53中，我可以看到记录看起来与以前完全相同，但是它具有AAAA类型，但是服务不再可用。

在Route 53中，我看到有一个看起来像这样的ALIAS：someservice-test-alb-1395527311.eu-central-1.elb.amazonaws.com。而且我可以通过HTTPS通过公共互联网使用该服务。但是，之前运行的“不错”的端点不再起作用了。此外，ping输入网址不会再收到任何IP。

我想念什么吗？

Answer 1

AAAA记录，您需要首先启用具有IPV6支持的VPC。默认情况下未启用。完成后，您可以按照下面博客中的指南为Teraform启用IPV6。

https://medium.com/@mattias.holmlund/setting-up-ipv6-on-amazon-with-terraform-e14b3bfef577

路线53-将类型更改为AAAA

1 个答案: