为什么在Terraform尝试auto_accept vpc对等时出现权限错误?
问题说明
我正在尝试在帐户之间创建一个VPC对等体并自动接受它,但是它失败并出现权限错误.
I am trying to create a VPC peer between accounts and auto accepting it but it fails with permissions error.
以下是 main.tf
provider "aws" {
region = "${var.region}"
shared_credentials_file = "/Users/<username>/.aws/credentials"
profile = "sandbox"
}
data "aws_caller_identity" "current" { }
这是 vpc_peer 模块:
resource "aws_vpc_peering_connection" "peer" {
peer_owner_id = "${var.peer_owner_id}"
peer_vpc_id = "${var.peer_vpc_id}"
vpc_id = "${var.vpc_id}"
auto_accept = "${var.auto_accept}"
accepter {
allow_remote_vpc_dns_resolution = true
}
requester {
allow_remote_vpc_dns_resolution = true
}
tags {
Name = "VPC Peering between ${var.peer_vpc_id} and ${var.vpc_id}"
}
}
这是maint.ft中的模块执行
Here is the module execution in the maint.ft
module "peering" {
source = "../modules/vpc_peer"
region = "${var.region}"
peer_owner_id = "<management account number>"
peer_vpc_id = "<vpc-********>"
vpc_id = "${module.network.vpc_id}"
auto_accept = "true"
}
现在,我从沙盒"提供程序中使用的IAM用户具有管理帐户中VPC中对VPC对等的权限.
Now the IAM user I am using from the "sandbox" provider has permissions for VPC peering in the VPC which is in the management account.
我从AWS使用了以下过程: http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html
I used the following procedure from AWS: http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html
不幸的是,我一直失败,并出现以下错误:
Unfortunately I keep failing with the following error:
1 error(s) occurred:
* aws_vpc_peering_connection.peer: Unable to accept VPC Peering Connection: OperationNotPermitted: User 651267440910 cannot accept peering pcx-f9c55290
status code: 400, request id: cfbe1163-241e-413b-a8de-d2bca19726e5
有什么想法吗?
正确答案
我设法运行了一个接受对等方的local_exec.
I managed to run a local_exec which accepts the peer.
这里是一个例子:
resource "aws_vpc_peering_connection" "peer" {
peer_owner_id = "${var.peer_owner_id}"
peer_vpc_id = "${var.peer_vpc_id}"
vpc_id = "${var.vpc_id}"
provisioner "local-exec" {
command = "aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id=${aws_vpc_peering_connection.peer.id} --region=${var.region} --profile=${var.profile}"
}
tags {
Name = "VPC Peering between ${var.peer_vpc_id} and ${var.vpc_id}"
}
}
这篇好文章是转载于:学新通技术网
- 版权申明: 本站部分内容来自互联网,仅供学习及演示用,请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系,请提供相关证据及您的身份证明,我们将在收到邮件后48小时内删除。
- 本站站名: 学新通技术网
- 本文地址: /reply/detail/tanhcffceh
-
YouTube API 不能在 iOS (iPhone/iPad) 工作,但在桌面浏览器工作正常?
it1352 07-30 -
iPhone,一张图像叠加到另一张图像上以创建要保存的新图像?(水印)
it1352 07-17 -
保持在后台运行的 iPhone 应用程序完全可操作
it1352 07-25 -
使用 iPhone 进行移动设备管理
it1352 07-23 -
在android同时打开手电筒和前置摄像头
it1352 09-28 -
检查邮件是否发送成功
it1352 07-25 -
扫描 NFC 标签时是否可以启动应用程序?
it1352 08-02 -
Android微调工具-删除当前选择
it1352 06-20 -
Android App 和三星 Galaxy S4 不兼容
it1352 07-20 -
希伯来语的空格句子标记化错误
it1352 06-22