Create an ECS instance by using Terraform - Terraform - Alibaba Cloud Documentation Center

Create an ECS instance with a public IP address inside a VPC. This guide defines the network, security group, and compute resources step by step.

Run this code in your browser — no local setup required.

Complete code

The following configuration creates a VPC, a vSwitch, a security group, and an ECS instance. To follow the step-by-step walkthrough instead, skip to Prerequisites.

variable "region" {
  default = "cn-beijing"
}

variable "instance_type" {
  default = "ecs.n4.large"
}

variable "image_id" {
  default = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
}

provider "alicloud" {
  region = var.region
}

data "alicloud_zones" "default" {
  available_disk_category     = "cloud_efficiency"
  available_resource_creation = "VSwitch"
  available_instance_type     = var.instance_type
}

resource "alicloud_vpc" "vpc" {
  vpc_name   = "tf_test_foo"
  cidr_block = "172.16.0.0/12"
}

resource "alicloud_vswitch" "vsw" {
  vpc_id     = alicloud_vpc.vpc.id
  cidr_block = "172.16.0.0/21"
  zone_id    = data.alicloud_zones.default.zones.0.id
}

resource "alicloud_security_group" "default" {
  security_group_name = "default"
  vpc_id              = alicloud_vpc.vpc.id
}

resource "alicloud_security_group_rule" "allow_all_tcp" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "1/65535"
  priority          = 1
  security_group_id = alicloud_security_group.default.id
  cidr_ip           = "0.0.0.0/0"
}

resource "alicloud_instance" "instance" {
  # cn-beijing
  availability_zone = data.alicloud_zones.default.zones.0.id
  security_groups   = alicloud_security_group.default.*.id
  # series III
  instance_type              = var.instance_type
  system_disk_category       = "cloud_efficiency"
  image_id                   = var.image_id
  instance_name              = "test_foo"
  vswitch_id                 = alicloud_vswitch.vsw.id
  internet_max_bandwidth_out = 10
}

output "public_ip" {
  value = alicloud_instance.instance.public_ip
}

Warning

The security group rule above opens all TCP ports (1/65535) to all IP addresses (0.0.0.0/0). This configuration is acceptable for testing but not for production. In production, restrict cidr_ip to specific IP ranges and limit port_range to only the ports your application requires (for example, 22/22 for SSH).

Prerequisites

Ensure that you have:

An Alibaba Cloud account with an AccessKey pair
Terraform installed and configured (see Install and configure Terraform in the local PC or Use Terraform in Cloud Shell)

Configure provider credentials

Set your credentials as environment variables so Terraform can authenticate automatically:

export ALICLOUD_ACCESS_KEY="your-access-key-id"
export ALICLOUD_SECRET_KEY="your-access-key-secret"
export ALICLOUD_REGION="cn-beijing"

Do not hardcode credentials in your Terraform files. Environment variables keep credentials out of version control.

Step 1: Create a VPC and vSwitch

A VPC provides an isolated network. A vSwitch defines a subnet within the VPC where your ECS instance runs.

Create terraform.tf with the following content. This configuration defines these resources:

Resource	Description
Variables (`region`, `instance_type`, `image_id`)	Reusable values. Override them at runtime with `-var` flags or a `terraform.tfvars` file.
Provider (`alicloud`)	Deploys resources to the `cn-beijing` region.
Data source (`alicloud_zones`)	Queries available zones that support ultra disks (`cloud_efficiency`) and the `ecs.n4.large` instance type. This avoids hardcoding a zone ID that might not support your resources.
VPC (`tf_test_foo`)	An isolated network with a `172.16.0.0/12` CIDR block.
vSwitch	A subnet with a `172.16.0.0/21` CIDR block inside the VPC, placed in the first available zone.

    variable "region" {
      default = "cn-beijing"
    }

    variable "instance_type" {
      default = "ecs.n4.large"
    }

    variable "image_id" {
      default = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
    }

    provider "alicloud" {
      region = var.region
    }

    data "alicloud_zones" "default" {
      available_disk_category     = "cloud_efficiency"
      available_resource_creation = "VSwitch"
      available_instance_type     = var.instance_type
    }

    resource "alicloud_vpc" "vpc" {
      vpc_name   = "tf_test_foo"
      cidr_block = "172.16.0.0/12"
    }

    resource "alicloud_vswitch" "vsw" {
      vpc_id     = alicloud_vpc.vpc.id
      cidr_block = "172.16.0.0/21"
      zone_id    = data.alicloud_zones.default.zones.0.id
    }

Run terraform init to download the Alicloud provider plugin.

    terraform init

    Initializing the backend...

    Initializing provider plugins...
    - Finding latest version of hashicorp/alicloud...
    - Installing hashicorp/alicloud...
    - Installed hashicorp/alicloud (...)

    Terraform has been successfully initialized!

Run terraform apply to create the VPC and vSwitch. Terraform shows an execution plan and prompts for confirmation.

    terraform apply

    data.alicloud_zones.default: Reading...
    data.alicloud_zones.default: Read complete after 1s

    Terraform used the selected providers to generate the following execution plan.
    Resource actions are indicated with the following symbols:
      + create

    Terraform will perform the following actions:

      # alicloud_vpc.vpc will be created
      + resource "alicloud_vpc" "vpc" {
          + cidr_block = "172.16.0.0/12"
          + vpc_name   = "tf_test_foo"
          ...
        }

      # alicloud_vswitch.vsw will be created
      + resource "alicloud_vswitch" "vsw" {
          + cidr_block = "172.16.0.0/21"
          ...
        }

    Plan: 2 to add, 0 to change, 0 to destroy.

    Do you want to perform these actions?
      Terraform will perform the actions described above.
      Only 'yes' will be accepted to approve.

      Enter a value: yes

    alicloud_vpc.vpc: Creating...
    alicloud_vpc.vpc: Creation complete after 6s
    alicloud_vswitch.vsw: Creating...
    alicloud_vswitch.vsw: Creation complete after 5s

    Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Run terraform show to inspect the VPC and vSwitch attributes. You can also verify them in the VPC console.
```
    terraform show
```

Step 2: Create a security group

A security group acts as a virtual firewall that controls inbound and outbound traffic for your ECS instance.

Add the following content to terraform.tf: This creates a security group named default bound to the VPC with a rule that allows all inbound TCP traffic (ports 1–65535). > Warning: cidr_ip = "0.0.0.0/0" opens all IP addresses. In production, restrict cidr_ip to your office CIDR and port_range to 22/22 for SSH-only access.

    resource "alicloud_security_group" "default" {
      security_group_name = "default"
      vpc_id              = alicloud_vpc.vpc.id
    }

    resource "alicloud_security_group_rule" "allow_all_tcp" {
      type              = "ingress"
      ip_protocol       = "tcp"
      nic_type          = "intranet"
      policy            = "accept"
      port_range        = "1/65535"
      priority          = 1
      security_group_id = alicloud_security_group.default.id
      cidr_ip           = "0.0.0.0/0"
    }

Run terraform apply to create the security group and its rule:
```
    terraform apply
```
Run terraform show to inspect the security group and its rule. You can also verify them in the ECS console.
```
    terraform show
```

Step 3: Create the ECS instance

With the network and security group in place, create the ECS instance.

Add the following content to terraform.tf: Key parameters (full reference: alicloud_instance resource documentation):

Parameter	Value	Description
`instance_type`	`ecs.n4.large`	Series III instance type (2 vCPUs, 4 GiB memory)
`system_disk_category`	`cloud_efficiency`	Ultra disk for the system disk
`image_id`	`ubuntu_18_04_64_20G_alibase_20190624.vhd`	Ubuntu 18.04 public image
`instance_name`	`test_foo`	Display name for the instance
`internet_max_bandwidth_out`	`10`	Maximum outbound bandwidth in Mbit/s. A value greater than 0 assigns a public IP address to the instance.

    resource "alicloud_instance" "instance" {
      # cn-beijing
      availability_zone = data.alicloud_zones.default.zones.0.id
      security_groups   = alicloud_security_group.default.*.id
      # series III
      instance_type              = var.instance_type
      system_disk_category       = "cloud_efficiency"
      image_id                   = var.image_id
      instance_name              = "test_foo"
      vswitch_id                 = alicloud_vswitch.vsw.id
      internet_max_bandwidth_out = 10
    }

    output "public_ip" {
        value = alicloud_instance.instance.public_ip
    }

Run terraform apply to create the ECS instance.

    terraform apply

    ...
    Plan: 1 to add, 0 to change, 0 to destroy.

    Changes to Outputs:
      + public_ip = (known after apply)

    Do you want to perform these actions?
      Only 'yes' will be accepted to approve.

      Enter a value: yes

    alicloud_instance.instance: Creating...
    alicloud_instance.instance: Still creating... [10s elapsed]
    alicloud_instance.instance: Creation complete after 25s

    Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

    Outputs:

    public_ip = "47.95.XX.XX"

Run terraform show to view the attributes of the ECS instance:
```
    terraform show
```

Verify the result

Verify that the instance is running:

Check the Terraform output for the public IP address:
```
    terraform output public_ip
```
Connect to the instance via SSH: Enter the configured password when prompted.
```
    ssh root@<Public IP address of the ECS instance>
```
Alternatively, check the ECS console and confirm that test_foo shows a Running status.

Clean up resources

To avoid ongoing charges, destroy all resources when they are no longer needed:

terraform destroy

Terraform lists the resources to destroy and prompts for confirmation. Type yes to proceed.

Expected output:

...
Plan: 0 to add, 0 to change, 4 to destroy.

Changes to Outputs:
  - public_ip = "47.95.XX.XX" -> null

Do you want to perform these actions?
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_instance.instance: Destroying...
alicloud_instance.instance: Destruction complete after 15s
alicloud_security_group.default: Destroying...
alicloud_security_group.default: Destruction complete after 5s
alicloud_vswitch.vsw: Destroying...
alicloud_vswitch.vsw: Destruction complete after 5s
alicloud_vpc.vpc: Destroying...
alicloud_vpc.vpc: Destruction complete after 3s

Destroy complete! Resources: 4 destroyed.