Terraformで始めるIaC：AWSの基本構成（VPC・EC2）をコードで管理する

# Terraform：HashiCorpのaptリポジトリ（執筆時点の公式手順）
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install -y terraform
terraform version

# AWS CLI v2 は公式のzipインストーラーで導入したうえで、SSOプロファイルを作る
aws configure sso --profile tf-lab
export AWS_PROFILE=tf-lab
aws sts get-caller-identity

terraform {
  required_version = "~> 1.10"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
  default_tags {
    tags = {
      Project   = "tf-lab"
      ManagedBy = "terraform"
    }
  }
}

resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  tags                 = { Name = "tf-lab-vpc" }
}

resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "${var.aws_region}a"
  map_public_ip_on_launch = true
}

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
}

resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

resource "aws_security_group" "web" {
  name   = "tf-lab-web"
  vpc_id = aws_vpc.main.id

  ingress {
    description = "SSH from admin"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.admin_cidr]
  }
  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"] # Canonical
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]
  }
}

resource "aws_key_pair" "admin" {
  key_name   = "tf-lab-admin"
  public_key = file("~/.ssh/id_ed25519.pub")
}

resource "aws_instance" "web" {
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = var.instance_type
  subnet_id              = aws_subnet.public.id
  vpc_security_group_ids = [aws_security_group.web.id]
  key_name               = aws_key_pair.admin.key_name
  user_data              = <<-EOT
    #!/bin/bash
    apt-get update && apt-get install -y nginx
  EOT
  tags                   = { Name = "tf-lab-web" }
}

variable "aws_region" {
  type    = string
  default = "ap-northeast-1"
}

variable "instance_type" {
  type    = string
  default = "t3.micro"
}

variable "admin_cidr" {
  type        = string
  description = "SSHを許可する自分のグローバルIP（/32）"
  validation {
    condition     = can(cidrhost(var.admin_cidr, 0)) && endswith(var.admin_cidr, "/32")
    error_message = "admin_cidr は x.x.x.x/32 の形式で指定してください。"
  }
}

output "public_ip" {
  value = aws_instance.web.public_ip
}

terraform init                       # provider取得、backend初期化、.terraform.lock.hcl生成
terraform fmt -recursive && terraform validate
terraform plan -out=tfplan           # 差分を計算してファイルに保存
terraform apply tfplan               # 保存したplanどおりに適用（再計算しない）
terraform output -raw public_ip
terraform destroy                    # 検証が終わったら全削除

terraform {
  backend "s3" {
    bucket       = "example-tfstate-123456789012"
    key          = "lab/network/terraform.tfstate"
    region       = "ap-northeast-1"
    encrypt      = true
    use_lockfile = true   # Terraform 1.10以降。S3だけでロックできる
  }
}

resource "aws_instance" "web" {
  # ...
  lifecycle {
    prevent_destroy = true     # destroy や再作成を伴う plan をエラーにする
    ignore_changes  = [ami]    # AMIが更新されても再作成しない
  }
}

# リソース名を変えるときは state 上の名前も一緒に移す
moved {
  from = aws_instance.web
  to   = aws_instance.web_a
}

$ terraform apply tfplan
（中略）
Apply complete! Resources: 8 added, 0 changed, 0 destroyed.

Outputs:

public_ip = "54.xxx.xxx.xxx"

$ terraform plan
No changes. Your infrastructure matches the configuration.

$ curl -sI "http://$(terraform output -raw public_ip)" | head -n 2
HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)

$ terraform state list | head -n 3
aws_instance.web
aws_internet_gateway.igw
aws_key_pair.admin

name: terraform
on:
  pull_request:
    paths: ["infra/**"]
  push:
    branches: [main]
    paths: ["infra/**"]

permissions:
  id-token: write
  contents: read

jobs:
  plan:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-terraform
          aws-region: ap-northeast-1
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "1.10.0"   # required_version と合わせて固定
      - run: terraform init -input=false
      - run: terraform plan -input=false -no-color -out=tfplan
      # PRにはplanの結果をコメントとして残し、mainでは environment の承認後に
      # 別ジョブで terraform apply tfplan を実行する