第17章 基础设施即代码（Infrastructure as Code）¶

# 配置Terraform和Provider
terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# 配置Provider
provider "aws" {
  region = var.aws_region
}

# 变量定义
variable "aws_region" {
  description = "AWS区域"
  type        = string
  default     = "us-east-1"
}

variable "instance_type" {
  description = "EC2实例类型"
  type        = string
  default     = "t3.micro"

  validation {
    condition     = contains(["t3.micro", "t3.small", "t3.medium"], var.instance_type)
    error_message = "实例类型必须是t3.micro/small/medium之一"
  }
}

variable "environment" {
  description = "环境名称"
  type        = string
}

# VPC
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true

  tags = {
    Name        = "${var.environment}-vpc"
    Environment = var.environment
  }
}

# 子网（基础示例使用 count，生产环境推荐使用 for_each，见 3.1 节）
resource "aws_subnet" "public" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index + 1}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = {
    Name = "${var.environment}-public-${count.index + 1}"
  }
}

# EC2实例
resource "aws_instance" "web" {
  ami           = data.aws_ami.amazon_linux.id
  instance_type = var.instance_type
  subnet_id     = aws_subnet.public[0].id

  tags = {
    Name = "${var.environment}-web-server"
  }

  lifecycle {
    create_before_destroy = true
  }
}

# 输出
output "instance_ip" {
  description = "Web服务器公网IP"
  value       = aws_instance.web.public_ip
}

output "vpc_id" {
  description = "VPC ID"
  value       = aws_vpc.main.id
}

# 查询最新的Amazon Linux 2 AMI
data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

# 查询可用区
data "aws_availability_zones" "available" {
  state = "available"
}

# 查询当前账户信息
data "aws_caller_identity" "current" {}

# 条件表达式
resource "aws_instance" "web" {
  instance_type = var.environment == "production" ? "t3.large" : "t3.micro"
}

# for_each（推荐替代count，避免索引偏移导致资源重建）
variable "services" {
  type = map(object({
    port     = number
    replicas = number
  }))
  default = {
    "frontend" = { port = 80, replicas = 2 }
    "backend"  = { port = 8080, replicas = 3 }
    "worker"   = { port = 9090, replicas = 1 }
  }
}

resource "aws_ecs_service" "services" {
  for_each     = var.services
  name         = each.key
  desired_count = each.value.replicas

  # ...
}

# 常用内建函数
locals {
  common_tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
    Project     = var.project_name
  }

  # 合并映射
  all_tags = merge(local.common_tags, var.extra_tags)

  # 字符串处理
  bucket_name = lower("${var.project_name}-${var.environment}-assets")

  # 列表处理
  public_subnets = [for s in aws_subnet.public : s.id]
}

resource "aws_security_group" "web" {
  name   = "${var.environment}-web-sg"
  vpc_id = aws_vpc.main.id

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.port
      to_port     = ingress.value.port
      protocol    = "tcp"
      cidr_blocks = ingress.value.cidr_blocks
      description = ingress.value.description
    }
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.amazon_linux.id
  instance_type = "t3.micro"

  # 仅在创建时执行（推荐使用user_data替代）
  provisioner "remote-exec" {
    inline = [
      "sudo yum update -y",
      "sudo yum install -y docker",
      "sudo systemctl start docker"
    ]
  }

  # 最佳实践：使用user_data
  user_data = <<-EOF
    #!/bin/bash
    yum update -y
    yum install -y docker
    systemctl start docker
  EOF
}

# S3 + DynamoDB后端（推荐用于AWS）
terraform {
  backend "s3" {
    bucket         = "mycompany-terraform-state"
    key            = "production/vpc/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"  # 状态锁
  }
}

# Azure Blob Storage后端
terraform {
  backend "azurerm" {
    resource_group_name  = "terraform-state-rg"
    storage_account_name = "tfstatesa"
    container_name       = "tfstate"
    key                  = "production.terraform.tfstate"
  }
}

# 使用本地Module
module "vpc" {
  source = "./modules/vpc"

  environment = var.environment
  cidr_block  = "10.0.0.0/16"
  az_count    = 3
}

# 使用远程Module（Terraform Registry）
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 19.0"

  cluster_name    = "${var.environment}-cluster"
  cluster_version = "1.28"
  vpc_id          = module.vpc.vpc_id
  subnet_ids      = module.vpc.private_subnet_ids
}

# Module输出引用
resource "aws_ecs_service" "app" {
  cluster = module.ecs.cluster_id
  # ...
}