Question

我希望看到这一点的每个人都做得很好。

我仍在使用Terraform和AWS学习绳子。

我创建了一个具有4个子网的VPC。 1个子网是公共的，其他3个是私有的。我的公共子网（堡垒盒/服务器）中目前有1个EC2实例。我还为该实例创建了一个安全组，并创建了一个NACL规则，该规则允许我仅通过IP通过ssh连接到该实例。由于某些原因，当我尝试ssh到该实例时，我的终端挂起，并且看到以下消息：

OpenSSH_8.2p1 Ubuntu-4ubuntu0.1，OpenSSL 1.1.1f 2020年3月31日

debug1：读取配置数据/ etc / ssh / ssh_config

debug1：/ etc / ssh / ssh_config第19行：包括/etc/ssh/ssh_config.d/*.conf没有文件匹配

debug1：/ etc / ssh / ssh_config第21行：为*应用选项

调试1：连接到'instance_public_ip [instance_public_ip]端口22

然后它告诉我连接超时。

我更改了规则，以允许从所有IP（即0.0.0.0/0）建立ssh连接，但仍然遇到相同的问题。基础结构的terraform代码如下：

# Elastic IP for bastion server
resource "aws_eip" "bastion_eip" {
  instance = aws_instance.Bastion.id
  vpc      = true
}

# EIP association for bastion server
resource "aws_eip_association" "eip_assoc" {
  instance_id   = aws_instance.Bastion.id
  allocation_id = aws_eip.bastion_eip.id
}

# Create internet gateway
resource "aws_internet_gateway" "main-gateway" {
  vpc_id = aws_vpc.main-vpc.id

  tags = {
    Name = "main"
  }
}

# Create route table for public subnet
resource "aws_route_table" "public-route-table" {
  vpc_id = aws_vpc.main-vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main-gateway.id
  }

  tags = {
    Name = "public-route-table"
  }
}

# Create subnet 4
resource "aws_subnet" "subnet-4" {
  vpc_id            = aws_vpc.main-vpc.id
  cidr_block        = "10.0.4.0/24"
  availability_zone = "eu-west-2a"
  tags = {
    Name = "subnet-public"
  }
}

# Associate subnet 4 with public route table
resource "aws_route_table_association" "subnet-4" {
  subnet_id      = aws_subnet.subnet-4.id
  route_table_id = aws_route_table.public-route-table.id
}

# Create bastion server security group (subnet 4)
resource "aws_security_group" "bastion-sg" {
  name        = "bastion-sg"
  description = "Allow web traffic from specific IPs"
  vpc_id      = aws_vpc.main-vpc.id

  # SSH Traffic
  ingress {
    description = "SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] #allow web traffic.
  }

  egress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "allow_access_bastion_server"
  }
}

# Create NACL for public subnet with Prod server & bastion server
resource "aws_network_acl" "public_nacl" {
  vpc_id     = aws_vpc.main-vpc.id
  subnet_ids = [aws_subnet.subnet-4.id]

  # Allow inbound http traffic from internet
  ingress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 80
    to_port    = 80
  }

  # Allow outbound http traffic to internet
  egress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 80
    to_port    = 80
  }

  # Allow inbound SSH traffic from specific IP
  ingress {
    protocol   = "tcp"
    rule_no    = 103
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 22
    to_port    = 22
  }

  # Allow outbound SSH traffic from specific IP
  egress {
    protocol   = "tcp"
    rule_no    = 103
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 22
    to_port    = 22
  }

  tags = {
    Name = "public NACL"
  }

}

# Create bastion box 
resource "aws_instance" "Bastion" {
  ami                    = var.ami-id
  instance_type          = var.instance-type
  key_name               = "aws_key_name"
  vpc_security_group_ids = ["security_group_id"]
  subnet_id              = "subnet_id"

  tags = {
    Name = "Bastion Server"
  }
}

我已经看了一段时间了，真的看不到我哪里出了问题。我的安全组，IGW或路由表是否存在问题？如果您还有其他需要的信息，请告诉我:)，并感谢您的提前帮助

Answer 1

我认为问题出在安全组上。

# SSH Traffic
ingress {
  description = "SSH"
  from_port   = 0  # SSH client port is not a fixed port
  to_port     = 22
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"] #allow web traffic. 46.64.73.251/32
}

egress {
  from_port   = 22
  to_port     = 0  # SSH client port is not a fixed port
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
}

我无法SSH到使用Terraform创建的EC2实例

1 个答案: