Cloud Shell:Use Terraform in Cloud Shell to manage ECS instances

Prerequisites

For security, use a Resource Access Management (RAM) user with the principle of least privilege. Create a custom policy with the following JSON and attach it to your RAM user. This policy grants only the permissions necessary for this tutorial. For more information, see Grant permissions to a RAM user.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudshell:StartSession",
        "cloudshell:StopSession",
        "cloudshell:GetSession",
        "cloudshell:ListSessions",
        "ecs:CreateInstance",
        "ecs:RunInstances",
        "ecs:StartInstance",
        "ecs:StopInstance",
        "ecs:RebootInstance",
        "ecs:TerminateInstance",
        "ecs:ModifyInstanceAttribute",
        "ecs:DescribeInstances",
        "ecs:AllocatePublicIpAddress",
        "ecs:AssignPrivateIpAddresses",
        "ecs:UnassignPrivateIpAddresses",
        "ecs:ModifyInstanceVpcAttribute",
        "ecs:ResetInstance",
        "ecs:AttachKeyPair",
        "ecs:DetachKeyPair",
        "ecs:CreateSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:RevokeSecurityGroup",
        "ecs:CreateVpc",
        "ecs:DeleteVpc",
        "ecs:CreateVSwitch",
        "ecs:DeleteVSwitch",
        "ecs:CreateDisk",
        "ecs:DeleteDisk",
        "ecs:AttachDisk",
        "ecs:DetachDisk",
        "ecs:CreateSnapshot",
        "ecs:DeleteSnapshot",
        "ecs:CreateImage",
        "ecs:DeleteImage"
      ],
      "Resource": "*"
    }
  ]
}

Resources used

• alicloud_vpc: Creates a virtual private cloud (VPC) to provide an isolated network environment.

• alicloud_vswitch: Creates a vSwitch (subnet) within a VPC to connect cloud resources.

• alicloud_security_group: Creates a security group to act as a virtual firewall for your ECS instances.

• alicloud_instance: Provisions an ECS instance to provide computing capacity.

• alicloud_security_group_rule: Defines a rule to control inbound or outbound traffic for a security group.

Procedure

Create cloud resources

1. Create a Terraform configuration file in Cloud Shell.

   Run the following commands to create a project directory and a configuration file named main.tf:

   mkdir terraform-project
   cd terraform-project 
   touch main.tf

   Use a text editor like vim to add the following code to the main.tf file. This configuration defines the necessary resources: a VPC, a vSwitch, a security group, and an ECS instance.

   provider "alicloud" {
     region = var.region_id
   }
   
   variable "region_id" {
     default = "cn-shanghai"
   }
   
   variable "available_disk_category" {
     default = "cloud_efficiency"
   }
   
   variable "available_resource_creation" {
     default = "VSwitch"
   }
   
   variable "vpc_name" {
     default = "tf_test_fofo"
   }
   
   variable "vpc_cidr_block" {
     default = "172.16.0.0/12"
   }
   
   variable "vswitch_cidr_block" {
     default = "172.16.0.0/21"
   }
   
   variable "security_group_name" {
     default = "default"
   }
   
   variable "instance_type" {
     default = "ecs.n4.large"
   }
   
   variable "image_id" {
     default = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
   }
   
   variable "instance_name" {
     default = "test_fofo"
   }
   
   variable "internet_max_bandwidth_out" {
     default = 10
   }
   
   variable "port_range" {
     default = "1/65535"
   }
   
   variable "priority" {
     default = 1
   }
   
   variable "cidr_ip" {
     default = "0.0.0.0/0"
   }
   
   data "alicloud_zones" "default" {
     available_disk_category     = var.available_disk_category
     available_resource_creation = var.available_resource_creation
   }
   
   resource "alicloud_vpc" "vpc" {
     vpc_name   = var.vpc_name
     cidr_block = var.vpc_cidr_block
   }
   
   resource "alicloud_vswitch" "vsw" {
     vpc_id     = alicloud_vpc.vpc.id
     cidr_block = var.vswitch_cidr_block
     zone_id    = data.alicloud_zones.default.zones[0].id
   }
   
   resource "alicloud_security_group" "default" {
     name   = var.security_group_name
     vpc_id = alicloud_vpc.vpc.id
   }
   
   resource "alicloud_instance" "instance" {
     availability_zone          = data.alicloud_zones.default.zones[0].id
     security_groups            = [alicloud_security_group.default.id]
     instance_type              = var.instance_type
     system_disk_category       = var.available_disk_category
     image_id                   = var.image_id
     instance_name              = var.instance_name
     vswitch_id                 = alicloud_vswitch.vsw.id
     internet_max_bandwidth_out = var.internet_max_bandwidth_out
   }
   
   resource "alicloud_security_group_rule" "allow_all_tcp" {
     type              = "ingress"
     ip_protocol       = "tcp"
     nic_type          = "intranet"
     policy            = "accept"
     port_range        = var.port_range
     priority          = var.priority
     security_group_id = alicloud_security_group.default.id
     cidr_ip           = var.cidr_ip
   }

2. Initialize your Terraform working directory.

   terraform init

   Expected output:

3. Run terraform apply to create the ECS instance. When prompted, enter yes and press Enter.

   terraform apply

   Expected output:

Verify the deployment

You can verify that the resources were created in two ways:

terraform show

Clean up resources

To avoid incurring future charges, release the resources you created. When prompted, confirm by typing yes.

terraform destroy

For more information about the terraform destroy command, see the Common commands.

Complete sample code

provider "alicloud" {
  region = var.region_id
}

variable "region_id" {
  default = "cn-shanghai"
}

variable "available_disk_category" {
  default = "cloud_efficiency"
}
variable "available_resource_creation" {
  default = "VSwitch"
}
variable "vpc_name" {
  default = "tf_test_fofo"
}
variable "vpc_cidr_block" {
  default = "172.16.0.0/12"
}
variable "vswitch_cidr_block" {
  default = "172.16.0.0/21"
}
variable "security_group_name" {
  default = "default"
}
variable "instance_type" {
  default = "ecs.n4.large"
}
variable "image_id" {
  default = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
}
variable "instance_name" {
  default = "test_fofo"
}
variable "internet_max_bandwidth_out" {
  default = 10
}
variable "port_range" {
  default = "1/65535"
}
variable "priority" {
  default = 1
}
variable "cidr_ip" {
  default = "0.0.0.0/0"
}

data "alicloud_zones" "default" {
  available_disk_category     = var.available_disk_category
  available_resource_creation = var.available_resource_creation
}

resource "alicloud_vpc" "vpc" {
  vpc_name   = var.vpc_name
  cidr_block = var.vpc_cidr_block
}

resource "alicloud_vswitch" "vsw" {
  vpc_id     = alicloud_vpc.vpc.id
  cidr_block = var.vswitch_cidr_block
  zone_id    = data.alicloud_zones.default.zones.0.id
}

resource "alicloud_security_group" "default" {
  name   = var.security_group_name
  vpc_id = alicloud_vpc.vpc.id
}

resource "alicloud_instance" "instance" {
  availability_zone = data.alicloud_zones.default.zones.0.id
  security_groups   = [alicloud_security_group.default.id]
  instance_type     = var.instance_type
  system_disk_category = var.available_disk_category
  image_id          = var.image_id
  instance_name     = var.instance_name
  vswitch_id        = alicloud_vswitch.vsw.id
  internet_max_bandwidth_out = var.internet_max_bandwidth_out
}

resource "alicloud_security_group_rule" "allow_all_tcp" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = var.port_range
  priority          = var.priority
  security_group_id = alicloud_security_group.default.id
  cidr_ip           = var.cidr_ip
}

Switch Terraform versions

Cloud Shell uses tfenv to manage multiple installed versions of Terraform. You can switch from the default version if your project requires a different one. The default Terraform version in Cloud Shell is 0.12.31.

1. List the Terraform versions available in Cloud Shell.

tfenv list

2. Switch to a different version for the current session.

tfenv use <terraform_version>

References

• What is Alibaba Cloud Terraform?