Google cloud platform 谷歌云NAT网关

我想通过terraform连接我的“专用”网络（没有外部IP的实例）

• google_compute_router_nat.advanced-nat:修补路由器us-west2/my-router1时出错：googleapi:错误400:字段'resource.nats[0]的值无效。子网[0]。名称'：'test-us-west2-private-subnet'。URL的格式不正确。 更多详情： 原因：无效，消息：字段'resource.nats[0]的值无效。子网[0]。名称'：'test-us-west2-private-subnet'。URL的格式不正确。 原因：无效，消息：字段“resource.nats[0].natIps[0]”的值无效：“10.0.0.0/16”。URL的格式不正确

任务：将经典方案从AWS迁移到GCP：一个VPC网络，公共网络中的堡垒主机，私有网络中的所有机器都没有外部IP。对专用网络使用NAT网关

resource "google_compute_router" "router" {
  name    = "my-router1"
  network = "${var.gcp_project_name}-net"
  bgp {
    asn = 64514
  }
}

resource "google_compute_router_nat" "advanced-nat" {
  name                               = "nat-1"
  router                             = "${google_compute_router.router.name}"
  region                             = "us-west2"
  nat_ip_allocate_option             = "MANUAL_ONLY"
  nat_ips                            = ["10.0.0.0/16"]
  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
  subnetwork {
    name = "${var.gcp_project_name}-${var.gcp_region_name}-private-subnet"
  }
}

---

你好，亚历山大·斯凯兹。请分享您的terraform私有和公共子网的防火墙和路由配置。我想配置一个具有公共和私有子网的网络，看起来您已经完成了相同的目标。

# VPC
resource "google_compute_network" "gcp_project_name" {
  name    = "${var.gcp_project_name}-net"
  auto_create_subnetworks = "false"
}

# PRIVATE SUBNET
resource "google_compute_subnetwork" "gcp_project_name_private_subnet" {
  name          = "${var.gcp_project_name}-${var.gcp_region_name}-private-subnet"
  ip_cidr_range = "10.0.0.0/16"
  network       = "${google_compute_network.gcp_project_name.self_link}"
  region        = "${var.gcp_region_name}"
}

# PUBLIC SUBNET
resource "google_compute_subnetwork" "gcp_project_name_public_subnet" {
  name          = "${var.gcp_project_name}-${var.gcp_region_name}-public-subnet"
  ip_cidr_range = "10.8.0.0/16"
  network       = "${google_compute_network.gcp_project_name.self_link}"
  region        = "${var.gcp_region_name}"
}

resource "google_compute_router" "router" {
  name    = "${var.gcp_router_name}"
  network = "${var.gcp_project_name}-net"
  region  = "${var.gcp_region_name}"
}


resource "google_compute_router_nat" "advanced-nat" {
  name                               = "${var.gcp_nat_name}"
  router                             = "${var.gcp_router_name}"
  region                             = "${var.gcp_region_name}"
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
  subnetwork {
    name = "${google_compute_subnetwork.gcp_project_name_private_subnet.self_link}"
  }
}