调试Terraform AWS Application Load Balancer验证错误的最佳方法是什么?

本文介绍了调试Terraform AWS Application Load Balancer验证错误的最佳方法是什么?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述

我正在尝试使用Terraform在AWS上提供一个演示Web服务，并且遇到以下错误.

I am trying to provision a demo web service on AWS with Terraform, and am encountering the following error.

Error: Error applying plan: 2 error(s) occurred: * module.prod.module.web.module.web.aws_alb_listener.frontend: 1 error(s) occurred: * aws_alb_listener.frontend: Error creating LB Listener: ValidationError: 'arn:aws:elasticloadbalancing:us-west-2:114416042199:loadbalancer/app/demo-svc-prod-alb/2a5f486a7b9d265a' is not a valid target group ARN status code: 400, request id: e3819755-799c-11e8-ac82-43dfdd4e44d1 * module.prod.module.web.module.web.aws_autoscaling_group.backend: 1 error(s) occurred: * aws_autoscaling_group.backend: Error creating AutoScaling Group: ValidationError: Provided Load Balancers may not be valid. Please ensure they exist and try again. status code: 400, request id: e37efee9-799c-11e8-955a-c50a9e447dfa

我不明白的是为什么ARN无效，因为它属于Terraform创建的资源. ARN引用elasticloadbalancing似乎令人怀疑.在使用AWS应用程序负载平衡器和ASG时是否需要了解一些陷阱?使用经典ELB时，我没有看到此问题.有什么方法可以从Terraform中获取更多有用的信息?

What I don't understand is why the ARN is invalid, as it belongs to a resource created by Terraform. It seems perhaps suspicious that the ARN refers to elasticloadbalancing. Are there any gotchas to be aware of when working with an AWS application load balancer and an ASG? When using a classic ELB I didn't see this problem. Is there any way to get more useful information out of Terraform?

引发错误的相关资源是:

The relevant resources that throw the errors are:

resource "aws_alb_listener" "frontend" { load_balancer_arn = "${aws_alb.frontend.arn}" port = "${local.https_port}" protocol = "HTTPS" ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01" default_action { target_group_arn = "${aws_alb.frontend.arn}" type = "forward" } }

和

resource "aws_autoscaling_group" "backend" { name = "${local.cluster_name}-asg" launch_configuration = "${aws_launch_configuration.backend.id}" availability_zones = ["${data.aws_availability_zones.all.names}"] load_balancers = ["${aws_alb.frontend.name}"] health_check_type = "ELB" min_size = "${var.min_size}" max_size = "${var.max_size}" // This resource type uses different tags specification format. // A list comp over the locals tags map would sure come in handy to keep // things DRY. tags = [ { key = "System" value = "${var.tags["System"]}" propagate_at_launch = true }, { key = "Environment" value = "${local.tags["Environment"]}" propagate_at_launch = true }, { key = "Owner" value = "${local.tags["Owner"]}" propagate_at_launch = true }, { key = "Description" value = "${local.tags["Description"]}" propagate_at_launch = true } ] }

完整的代码可在 github上找到./mojochao/terraform-aws-web-stack/commit/a4bfe5d6362fddfb2934dc9a89344c304e59cef7 .

推荐答案

在两种情况下，您指的都是错误的资源.

You're referring to the wrong resources in both cases.

在出现第一个错误时，您的侦听器定义为:

With the first error your listener is defined as:

resource "aws_alb_listener" "frontend" { load_balancer_arn = "${aws_alb.frontend.arn}" port = "${local.https_port}" protocol = "HTTPS" ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01" default_action { target_group_arn = "${aws_alb.frontend.arn}" type = "forward" } }

请注意， default_action需要target_group_arn ，因此您需要将其指向目标组，而不是负载均衡器本身.

Note that the default_action takes a target_group_arn so you need to point it to your target group, not the load balancer itself.

因此，您应该使用:

resource "aws_alb_listener" "frontend" { load_balancer_arn = "${aws_alb.frontend.arn}" port = "${local.https_port}" protocol = "HTTPS" ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01" default_action { target_group_arn = "${aws_alb_target_group.frontend.arn}" type = "forward" } }

因为只定义了一个侦听器规则，所以您也可以删除 aws_alb_listener_rule资源，因为它无论如何都与对侦听器的默认操作相同.仅当您希望不同的流量(按主机或按路径)进入不同的目标组时，才单独定义规则.

Because you only have a single listener rule defined you can also remove the aws_alb_listener_rule resource because it's doing the same thing as the default action on the listener anyway. You would only define rules separately if you wanted different traffic (either by host or by path) to go to different target groups.

您的第二个错误来自尝试通过使用load_balancers参数.正如 aws_autoscaling_group资源文档所述，您应该使用 target_group_arns 代替:

Your second error comes from trying to attach the autoscaling group to an ELB classic by using the load_balancers parameter. As the aws_autoscaling_group resource docs mention you should use target_group_arns instead:

resource "aws_autoscaling_group" "backend" { name = "${local.cluster_name}-asg" launch_configuration = "${aws_launch_configuration.backend.id}" availability_zones = ["${data.aws_availability_zones.all.names}"] target_group_arns = ["${aws_alb_target_group.frontend.arn}"] health_check_type = "ELB" min_size = "${var.min_size}" max_size = "${var.max_size}" // This resource type uses different tags specification format. // A list comp over the locals tags map would sure come in handy to keep // things DRY. tags = [ { key = "System" value = "${var.tags["System"]}" propagate_at_launch = true }, { key = "Environment" value = "${local.tags["Environment"]}" propagate_at_launch = true }, { key = "Owner" value = "${local.tags["Owner"]}" propagate_at_launch = true }, { key = "Description" value = "${local.tags["Description"]}" propagate_at_launch = true } ] }

这将自动缩放组附加到ALB目标组，因此您也可以摆脱 aws_autoscaling_attachment资源正在做同样的事情.通常，如果分别定义了ALB目标组和自动缩放组并需要在它们之间进行链接，则通常只使用aws_autoscaling_attachment资源.

This will automatically attach the autoscaling group to the ALB target group so you can also get rid of the aws_autoscaling_attachment resource which is doing the same thing. You would only normally use the aws_autoscaling_attachment resource if you defined your ALB target group and your autoscaling group separately and needed to link across them.