Terraform

エンジニアのためのWebチートシート

バージョン制約、プロバイダ設定、バックエンド設定の基本です。

terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {
    bucket = "my-tf-state"
    key    = "terraform.tfstate"
    region = "ap-northeast-1"
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

モジュールの入力パラメータを定義します。型、デフォルト値、バリデーションを設定できます。

variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"
  sensitive   = false

  validation {
    condition     = contains(["t3.micro", "t3.small"], var.instance_type)
    error_message = "Must be t3.micro or t3.small."
  }
}

# Types: string, number, bool,
#   list(type), set(type), map(type),
#   object({...}), tuple([...]), any

# Set variables via:
#   terraform.tfvars / *.auto.tfvars
#   -var="key=value" / -var-file="file.tfvars"
#   TF_VAR_<name> environment variable

output（外部公開値）とlocals（内部計算値）の定義です。

output "instance_ip" {
  description = "Public IP of the instance"
  value       = aws_instance.web.public_ip
  sensitive   = false
}

locals {
  common_tags = {
    Environment = var.environment
    Project     = "my-project"
    ManagedBy   = "terraform"
  }
  name_prefix = "${var.project}-${var.env}"
}

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/*"]
  }
}

インフラリソースの作成と既存リソースの参照です。

# Create a resource
resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type

  tags = local.common_tags

  depends_on = [aws_security_group.web]
}

# Reference: <type>.<name>.<attribute>
# aws_instance.web.public_ip

# Data source reference
# data.<type>.<name>.<attribute>
# data.aws_ami.ubuntu.id

count

resource "aws_instance" "web" {
  count         = 3
  ami           = "ami-12345"
  instance_type = "t3.micro"
  tags = { Name = "web-${count.index}" }
}
# Ref: aws_instance.web[0].id

for_each

resource "aws_instance" "web" {
  for_each      = toset(["app", "api", "worker"])
  ami           = "ami-12345"
  instance_type = "t3.micro"
  tags = { Name = each.key }
}
# Ref: aws_instance.web["app"].id

for_each (map)

resource "aws_instance" "servers" {
  for_each = {
    app    = "t3.small"
    worker = "t3.medium"
  }
  ami           = "ami-12345"
  instance_type = each.value
  tags = { Name = each.key }
}

ステートファイルをリモートストレージで管理する設定です。

# S3 backend
terraform {
  backend "s3" {
    bucket       = "my-terraform-state"
    key          = "prod/terraform.tfstate"
    region       = "ap-northeast-1"
    encrypt      = true
    use_lockfile = true  # v1.10+
  }
}

# GCS backend
terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
    prefix = "prod"
  }
}

import (v1.5+)

import {
  to = aws_instance.example
  id = "i-1234567890abcdef0"
}

moved / removed

moved {
  from = aws_instance.old_name
  to   = aws_instance.new_name
}

removed {
  from = aws_instance.example
  lifecycle { destroy = false }
}

Registry module

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"
  name = "my-vpc"
  cidr = "10.0.0.0/16"
  azs  = ["ap-northeast-1a", "ap-northeast-1c"]
}

Local module

module "app" {
  source        = "./modules/app"
  name          = "my-app"
  instance_type = var.instance_type
  vpc_id        = module.vpc.vpc_id
}
# Output ref: module.vpc.vpc_id

Conditional / For / Splat

# Conditional
instance_type = var.env == "prod" ? "t3.large" : "t3.micro"

# For expression
upper_names = [for n in var.names : upper(n)]
adults = [for p in var.people : p.name if p.age >= 18]
name_map = {for s in var.servers : s.name => s.ip}

# Splat
instance_ids = aws_instance.web[*].id

Dynamic block

dynamic "ingress" {
  for_each = var.ingress_rules
  content {
    from_port   = ingress.value.from_port
    to_port     = ingress.value.to_port
    protocol    = ingress.value.protocol
    cidr_blocks = ingress.value.cidr_blocks
  }
}

String / Heredoc

name = "web-${var.environment}"

policy = <<-EOT
  { "Version": "2012-10-17" }
EOT

lifecycle

lifecycle {
  create_before_destroy = true
  prevent_destroy       = true
  ignore_changes        = [tags]  # or = all
  replace_triggered_by  = [aws_security_group.web.id]
}

precondition / postcondition

precondition {
  condition     = var.env != ""
  error_message = "env must not be empty."
}

postcondition {
  condition     = self.public_ip != ""
  error_message = "Must have a public IP."
}

local-exec / file

provisioner "local-exec" {
  command = "echo ${self.private_ip}"
}

provisioner "file" {
  source      = "conf/app.conf"
  destination = "/etc/app.conf"
}

remote-exec

provisioner "remote-exec" {
  inline = [
    "sudo apt-get update",
    "sudo apt-get install -y nginx"
  ]
  connection {
    type        = "ssh"
    user        = "ubuntu"
    private_key = file("~/.ssh/id_rsa")
    host        = self.public_ip
  }
}

terraform_data

resource "terraform_data" "run" {
  triggers_replace = [aws_instance.web.id]
  provisioner "local-exec" {
    command = "echo 'Instance recreated'"
  }
}

terraform.workspace で環境を切り替える使用例です。

resource "aws_instance" "example" {
  instance_type = (
    terraform.workspace == "prod" ? "t3.large" : "t3.micro"
  )
  tags = { Environment = terraform.workspace }
}

locals {
  env_config = {
    dev  = { count = 1, type = "t3.micro" }
    stg  = { count = 2, type = "t3.small" }
    prod = { count = 3, type = "t3.large" }
  }
  config = local.env_config[terraform.workspace]
}

Terraformプロジェクトの標準的なファイル構成です。

project/
  main.tf            # Main resources
  variables.tf       # Input variables
  outputs.tf         # Output values
  providers.tf       # Provider config
  terraform.tf       # terraform block
  terraform.tfvars   # Variable values
  modules/
    app/
      main.tf
      variables.tf
      outputs.tf
    network/
      main.tf
      variables.tf
      outputs.tf

Terraformプロジェクトでバージョン管理から除外すべきファイルです。

# .gitignore
.terraform/
*.tfstate
*.tfstate.*
crash.log
override.tf
override.tf.json

# Keep lock file in Git
# .terraform.lock.hcl