Terraform 반복문, Lifecycle, Import, CI/CD 자동화 — 심화 패턴

resource "aws_instance" "web" {
  count         = 3
  ami           = "ami-0abcdef1234567890"
  instance_type = "t3.micro"

  tags = {
    Name = "web-${count.index}"  # web-0, web-1, web-2
  }
}

variable "instances" {
  default = {
    web  = "t3.micro"
    api  = "t3.small"
    worker = "t3.medium"
  }
}

resource "aws_instance" "server" {
  for_each      = var.instances
  ami           = "ami-0abcdef1234567890"
  instance_type = each.value

  tags = {
    Name = each.key  # web, api, worker
  }
}

resource "aws_security_group" "web" {
  name = "web-sg"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

variable "ingress_rules" {
  default = [
    { port = 80,  cidr = "0.0.0.0/0" },
    { port = 443, cidr = "0.0.0.0/0" },
    { port = 8080, cidr = "10.0.0.0/16" },
  ]
}

resource "aws_security_group" "web" {
  name = "web-sg"

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.port
      to_port     = ingress.value.port
      protocol    = "tcp"
      cidr_blocks = [ingress.value.cidr]
    }
  }
}

dynamic "<블록이름>" {
  for_each = <컬렉션>
  content {
    # 블록 내용 (<블록이름>.value로 접근)
  }
}

dynamic "ingress" {
  for_each = var.ingress_rules
  iterator = rule          # iterator 이름을 "rule"로 변경
  content {
    from_port   = rule.value.port   # rule.value로 접근
    to_port     = rule.value.port
    protocol    = "tcp"
    cidr_blocks = [rule.value.cidr]
  }
}

# 조건 ? true일 때 값 : false일 때 값
instance_type = var.environment == "prod" ? "t3.large" : "t3.micro"

# 리소스를 조건부로 생성
resource "aws_cloudwatch_metric_alarm" "cpu" {
  count = var.enable_alarm ? 1 : 0  # true면 1개 생성, false면 0개 (안 만듦)
  # ...
}

# 리스트 → 리스트 (대문자 변환)
upper_names = [for name in var.names : upper(name)]

# 리스트 → 맵
instance_ids = { for inst in aws_instance.web : inst.tags.Name => inst.id }

# 필터링
prod_instances = [for inst in var.instances : inst if inst.env == "prod"]

resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = "t3.micro"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_db_instance" "main" {
  # ...

  lifecycle {
    prevent_destroy = true
  }
}

resource "aws_instance" "web" {
  # ...

  lifecycle {
    ignore_changes = [tags, ami]
  }
}

resource "aws_appautoscaling_target" "ecs" {
  # ...

  lifecycle {
    replace_triggered_by = [aws_ecs_service.main.id]
  }
}

# Workspace 목록
terraform workspace list

# 새 Workspace 생성
terraform workspace new dev
terraform workspace new prod

# Workspace 전환
terraform workspace select prod

# 현재 Workspace 확인
terraform workspace show

resource "aws_instance" "web" {
  instance_type = terraform.workspace == "prod" ? "t3.large" : "t3.micro"

  tags = {
    Environment = terraform.workspace
  }
}

# S3 버킷 이름에 환경 포함
resource "aws_s3_bucket" "data" {
  bucket = "myapp-${terraform.workspace}-data"
}

# 형식: terraform import <리소스주소> <실제ID>
terraform import aws_instance.web i-0abc123def456

# VPC
terraform import aws_vpc.main vpc-0abc123

# S3 버킷
terraform import aws_s3_bucket.data my-bucket-name

# import 블록 작성
import {
  to = aws_instance.web
  id = "i-0abc123def456"
}

# 리소스 블록도 작성 (또는 plan -generate-config-out으로 자동 생성)
resource "aws_instance" "web" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t3.micro"
  # ...
}

# 코드 자동 생성 (리소스 블록을 자동으로 만들어줌)
terraform plan -generate-config-out=generated.tf

# AWS 전체 리소스를 Terraform 코드로 변환
terraformer import aws --resources=ec2_instance,vpc,subnet --regions=ap-northeast-2

# 특정 리소스만
terraformer import aws --resources=s3 --regions=ap-northeast-2

# 최신 Amazon Linux AMI 조회
data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}

# 조회한 AMI로 인스턴스 생성
resource "aws_instance" "web" {
  ami           = data.aws_ami.amazon_linux.id
  instance_type = "t3.micro"
}

# 현재 AWS 계정 정보
data "aws_caller_identity" "current" {}
# 사용: data.aws_caller_identity.current.account_id

# 현재 리전
data "aws_region" "current" {}
# 사용: data.aws_region.current.name

# 기존 VPC 조회
data "aws_vpc" "existing" {
  filter {
    name   = "tag:Name"
    values = ["main-vpc"]
  }
}

# 다른 State 참조 (Remote State)
data "terraform_remote_state" "network" {
  backend = "s3"
  config = {
    bucket = "my-terraform-state"
    key    = "network/terraform.tfstate"
    region = "ap-northeast-2"
  }
}

# 사용
resource "aws_instance" "web" {
  subnet_id = data.terraform_remote_state.network.outputs.public_subnet_id
}

PR 생성 → terraform plan (결과를 PR 코멘트로) → 리뷰 → Merge → terraform apply

name: Terraform

on:
  pull_request:
    paths: ['infra/**']
  push:
    branches: [main]
    paths: ['infra/**']

env:
  TF_VERSION: "1.9.0"
  AWS_REGION: "ap-northeast-2"

jobs:
  plan:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # OIDC 토큰 발급에 필요
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Terraform Init
        run: terraform init
        working-directory: infra

      - name: Terraform Plan
        run: terraform plan -no-color -out=tfplan
        working-directory: infra

  apply:
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Terraform Init
        run: terraform init
        working-directory: infra

      - name: Terraform Apply
        run: terraform apply -auto-approve
        working-directory: infra

stages:
  - validate
  - plan
  - apply

variables:
  TF_VERSION: "1.9.0"
  TF_ROOT: "infra"

image:
  name: hashicorp/terraform:$TF_VERSION
  entrypoint: [""]

before_script:
  - cd $TF_ROOT
  - terraform init

validate:
  stage: validate
  script:
    - terraform validate
    - terraform fmt -check

plan:
  stage: plan
  script:
    - terraform plan -out=tfplan
  artifacts:
    paths:
      - $TF_ROOT/tfplan
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

apply:
  stage: apply
  script:
    - terraform apply tfplan
  dependencies:
    - plan
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual  # 수동 승인 후 apply
  environment:
    name: production