Terraform:Gunakan Terraform di Linux

Mengelola infrastruktur Anda sebagai kode (IaC) dengan Terraform mencakup langkah-langkah utama berikut.

1. Instal Terraform.

2. Konfigurasikan Terraform. Siapkan otentikasi identitas untuk provider Alibaba Cloud.

3. Buat file konfigurasi Terraform. Definisikan sumber daya yang akan dibuat, seperti RAM user dan kebijakan.

4. Inisialisasi dan buat sumber daya. Unduh plug-in provider dan terapkan sumber daya yang dideklarasikan.

5. Tampilkan dan kelola sumber daya. Periksa, modifikasi, atau perbarui sumber daya yang telah diterapkan sesuai perubahan kebutuhan.

6. Hapus sumber daya. Hapus sumber daya yang tidak lagi diperlukan.

1. Instal Terraform

Terraform adalah alat infrastructure as code (IaC) untuk mengelola sumber daya cloud melalui file konfigurasi deklaratif. Instal Terraform sebelum menjalankan perintah Terraform apa pun. Untuk informasi lebih lanjut tentang langkah instalasi, lihat Instal Terraform.

2. Konfigurasikan Terraform

Terraform melakukan autentikasi dengan Alibaba Cloud melalui provider Alibaba Cloud. Beberapa metode autentikasi didukung. Untuk informasi lebih lanjut, lihat Autentikasi Terraform.

Contoh berikut menggunakan pasangan AccessKey RAM user yang dikonfigurasi dalam variabel lingkungan:

export ALICLOUD_ACCESS_KEY="<yourAccessKeyID>"
export ALICLOUD_SECRET_KEY="<yourAccessKeySecret>"
export ALICLOUD_REGION="cn-beijing"

3. Buat file konfigurasi Terraform

File konfigurasi mendefinisikan sumber daya infrastruktur yang akan diterapkan, seperti RAM user, instance ECS, dan bucket OSS.

1. Buat direktori kerja bernama ram dan file konfigurasi bernama main.tf.

   # Buat direktori kerja dan masuk ke direktori tersebut.
   mkdir ram && cd ram
   # Buat dan edit file konfigurasi.
   touch main.tf && vim main.tf
   

   Direktori kerja terpisah untuk setiap proyek menjaga file state tetap terisolasi dan menyederhanakan kontrol versi.

2. Buat file konfigurasi Terraform. Contoh ini membuat RAM user dan memberikan izin manajemen ECS kepada user tersebut.

   Contoh ini menggunakan sumber daya berikut:

   Penting

   Hindari mengaktifkan login konsol dan akses pasangan AccessKey secara bersamaan untuk RAM user yang sama agar tanggung jawab tetap jelas dan mencegah penyalahgunaan.

   Resource	Description
   alicloud_ram_user	Create a RAM user
   alicloud_ram_login_profile	Allow a RAM user to log on to the console
   alicloud_ram_access_key	Create an AccessKey pair for a RAM user
   alicloud_ram_policy	Create an access policy
   alicloud_ram_user_policy_attachment	Grant permissions to a RAM user

   Salin kode berikut ke main.tf. Tekan Esc untuk keluar dari mode insert, ketik :wq, lalu tekan Enter untuk menyimpan.

   variable "user_name" {
     default = "terraform_user_test"
   }
   variable "user_password" {
     default = "!Test@123456"
   }
   variable "user_display_name" {
     default = "TestAccount"
   }
   variable "user_mobile" {
     default = "86-18688888888"
   }
   variable "user_email" {
     default = "example@example.com"
   }
   resource "alicloud_ram_user" "user" {
     name         = var.user_name
     display_name = var.user_display_name
     mobile       = var.user_mobile
     email        = var.user_email
     comments     = "Created by Terraform"
     force        = true                   
   }
   resource "alicloud_ram_login_profile" "profile" {
     user_name = alicloud_ram_user.user.name
     password  = var.user_password
   }
   resource "alicloud_ram_access_key" "ak" {
     user_name   = alicloud_ram_user.user.name
     secret_file = "accesskey.txt"
   }
   resource "alicloud_ram_policy" "policy" {
     policy_name     = "tf-example-policy"
     policy_document = <<EOF
     {
       "Statement": [
         {
           "Action": "ecs:*",
           "Effect": "Allow",
           "Resource":"*"
         }
       ],
         "Version": "1"
     }
     EOF
     description     = "This is a policy test."
   }
   resource "alicloud_ram_user_policy_attachment" "attach" {
     policy_name = alicloud_ram_policy.policy.policy_name
     policy_type = alicloud_ram_policy.policy.type
     user_name   = alicloud_ram_user.user.name
   }

4. Inisialisasi dan buat sumber daya

Inisialisasi direktori kerja sebelum membuat sumber daya.

4.1 Inisialisasi Terraform

Jalankan terraform init untuk menginisialisasi direktori kerja. terraform init mengunduh plug-in provider Alibaba Cloud dan harus dijalankan sebelum perintah Terraform lainnya.

4.2 Buat sumber daya

1. Jalankan terraform plan untuk melihat pratinjau sumber daya yang akan dibuat, dimodifikasi, atau dihapus oleh terraform apply.

   # alicloud_ram_user.user will be created
   + resource "alicloud_ram_user" "user" {
       + comments     = "Created by Terraform"
       + display_name = "TestAccount"
       + email        = "example@example.com"
       + force        = true
       + id           = (known after apply)
       + mobile       = "86-18688888888"
       + name         = "terraform_user_test"
     }
   # alicloud_ram_user_policy_attachment.attach will be created
   + resource "alicloud_ram_user_policy_attachment" "attach" {
       + id          = (known after apply)
       + policy_name = "tf-example-policy"
       + policy_type = (known after apply)
       + user_name   = "terraform_user_test"
     }
   Plan: 5 to add, 0 to change, 0 to destroy.

2. Saat menjalankan terraform apply, sumber daya akan dibuat berdasarkan rencana eksekusi yang dihasilkan oleh terraform plan. Selama proses pembuatan, Anda perlu memasukkan yes pada prompt untuk melanjutkan. Untuk informasi tentang cara meneruskan nilai ke variabel, lihat Variable.

   Plan: 5 to add, 0 to change, 0 to destroy.
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
     Enter a value: yes
   alicloud_ram_user.user: Creating...
   alicloud_ram_policy.policy: Creating...
   alicloud_ram_policy.policy: Creation complete after 0s [id=tf-example-policy]
   alicloud_ram_user.user: Creation complete after 1s [id=20xxx18]
   alicloud_ram_login_profile.profile: Creating...
   alicloud_ram_access_key.ak: Creating...
   alicloud_ram_user_policy_attachment.attach: Creating...
   alicloud_ram_user_policy_attachment.attach: Creation complete after 0s [id=user:tf-example-policy:Custom:terraform_user_test]
   alicloud_ram_login_profile.profile: Creation complete after 0s [id=terraform_user_test]
   alicloud_ram_access_key.ak: Creation complete after 1s [id=LTxxxGr]
   Apply complete! Resources: 5 added, 0 changed, 0 destroyed.

5. Tampilkan dan kelola sumber daya

Setelah penerapan, kelola dan pelihara infrastruktur Anda.

5.1 Tampilkan sumber daya

1. Jalankan terraform show untuk melihat detail sumber daya.

   [root@iZ2***tZ ram]# terraform show
   # alicloud_ram_access_key.ak:
   resource "alicloud_ram_access_key" "ak" {
       id          = "LTAxxxxxxxxxxxxxxxxxxxiGr"
       secret      = (sensitive value)
       secret_file = "accesskey.txt"
       status      = "Active"
       user_name   = "terraform_user_test"
   }
   # alicloud_ram_login_profile.profile:
   resource "alicloud_ram_login_profile" "profile" {
       id                     = "terraform_user_test"
       mfa_bind_required      = true
       password               = (sensitive value)
       password_reset_required = false
       user_name              = "terraform_user_test"
   }
   # alicloud_ram_policy.policy:
   resource "alicloud_ram_policy" "policy" {
       attachment_count = 0
       default_version  = "v1"
       description      = "This is a policy test."
       document         = <<-EOT
           {
               "Statement": [
                   {
                       "Action": "ecs:*",
                       "Effect": "Allow",
                       "Resource":"*"
                   }
               ],
               "Version": "1"
           }
       EOT
   }

2. Jalankan terraform state list untuk menampilkan daftar semua sumber daya yang telah dibuat.

   [root@iZxxxmtZ ram]# terraform state list
   alicloud_ram_access_key.ak
   alicloud_ram_login_profile.profile
   alicloud_ram_policy.policy
   alicloud_ram_user.user
   alicloud_ram_user_policy_attachment.attach

3. Jalankan terraform state show <resource type>.<resource name> untuk melihat detail sumber daya tertentu.

   [root@iZxxx          tZ ram]# terraform state show alicloud_ram_user.user
   # alicloud_ram_user.user:
   resource "alicloud_ram_user" "user" {
       comments     = "Created by Terraform"
       display_name = "TestAccount"
       email        = "example@example.com"
       force        = true
       id           = "208475129836212018"
       mobile       = "86-18688888888"
       name         = "terraform_user_test"
   }

4. Verifikasi sumber daya di Alibaba Cloud Management Console.

5.2 Kelola sumber daya

Terraform menyimpan status dan properti sumber daya dalam file terraform.tfstate. Gunakan perintah terraform state untuk mengelola state. Untuk informasi selengkapnya, lihat Pengenalan mekanisme state.

5.3 Modifikasi sumber daya

1. Edit definisi sumber daya di main.tf. Misalnya, batasi izin RAM user menjadi akses ECS read-only.

   1. Jalankan perintah vim main.tf dan tekan tombol i untuk memasuki mode edit.

   2. Salin kode berikut dan gunakan untuk menggantikan bagian alicloud_ram_policy dalam file main.tf.

      resource "alicloud_ram_policy" "policy" {
        policy_name     = "tf-example-policy"
        policy_document = <<EOF
        {
          "Statement": [
            {
              "Action": [
                "ecs:Get*",
                "ecs:List*",
                "ecs:Describe*"
              ],
              "Effect": "Allow",
              "Resource":"*"
            }
          ],
            "Version": "1"
        }
        EOF
        description     = "This is a policy test."
      }

   3. Tekan Esc dan masukkan :wq untuk menyimpan file.

2. Jalankan terraform plan untuk melihat pratinjau perubahan.

   Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the follow
     ~ update in-place
   Terraform will perform the following actions:
     # alicloud_ram_policy.policy will be updated in-place
     ~ resource "alicloud_ram_policy" "policy" {
           id                = "tf-example-policy"
           name              = "tf-example-policy"
         ~ policy_document   = <<-EOT
               {
                   "Statement": [
                       {
             -             "Action": "ecs:*",
             +             "Action": [
             +         "ecs:Get*",
             +         "ecs:List*",
             +         "ecs:Describe*"
             +             ],
                           "Effect": "Allow",
                           "Resource":"*"
                       }
                   ],
                       "Version": "1"
               }
           EOT
           # (8 unchanged attributes hidden)
           # (1 unchanged block hidden)
       }
   Plan: 0 to add, 1 to change, 0 to destroy.

3. Jika rencana sudah benar, jalankan terraform apply. Saat diminta, ketik yes untuk menerapkan perubahan.

   Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the follow
     ~ update in-place
   Terraform will perform the following actions:
     # alicloud_ram_policy.policy will be updated in-place
     ~ resource "alicloud_ram_policy" "policy" {
           id               = "tf-example-policy"
           name             = "tf-example-policy"
         ~ policy_document  = <<-EOT
               {
                   "Statement": [
                       {
             -             "Action": "ecs:*",
             +             "Action": [
             +   "ecs:Get*",
             +   "ecs:List*",
             +   "ecs:Describe*"
             +             ],
                           "Effect": "Allow",
                           "Resource":"*"
                       }
                   ],
                   "Version": "1"
               }
           EOT
           # (8 unchanged attributes hidden)
           # (1 unchanged block hidden)
       }
   Plan: 0 to add, 1 to change, 0 to destroy.
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
     Enter a value: yes
   alicloud_ram_policy.policy: Modifying... [id-tf-example-policy]
   alicloud_ram_policy.policy: Modifications complete after 0s [id-tf-example-policy]
   Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

6. Hapus sumber daya

Jalankan terraform destroy untuk menghapus semua sumber daya yang dibuat dalam direktori kerja saat ini.

Plan: 0 to add, 0 to change, 5 to destroy.
Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.
  Enter a value: yes
alicloud_ram_access_key.ak: Destroying... [id=LTxxxGr]
alicloud_ram_login_profile.profile: Destroying... [id=terraform_user_test]
alicloud_ram_user_policy_attachment.attach: Destroying... [id=user:tf-example-policy:Custom:terraform_user_test]
alicloud_ram_user_policy_attachment.attach: Destruction complete after 0s
alicloud_ram_policy.policy: Destroying... [id=tf-example-policy]
alicloud_ram_login_profile.profile: Destruction complete after 0s
alicloud_ram_policy.policy: Destruction complete after 1s
alicloud_ram_access_key.ak: Destruction complete after 1s
alicloud_ram_user.user: Destroying... [id=2xxx18]
alicloud_ram_user.user: Destruction complete after 1s

Contoh lengkap

Kode lengkap berikut menggabungkan semua sumber daya dari tutorial ini. Salin dan jalankan langsung.

variable "user_name" {
  default = "terraform_user_test"
}
variable "user_password" {
  default = "!Test@123456"
}
variable "user_display_name" {
  default = "TestAccount"
}
variable "user_mobile" {
  default = "86-18688888888"
}
variable "user_email" {
  default = "example@example.com"
}
resource "alicloud_ram_user" "user" {
  name         = var.user_name
  display_name = var.user_display_name
  mobile       = var.user_mobile
  email        = var.user_email
  comments     = "Created by Terraform"
  force        = true                   
}
resource "alicloud_ram_login_profile" "profile" {
  user_name = alicloud_ram_user.user.name
  password  = var.user_password
}
resource "alicloud_ram_access_key" "ak" {
  user_name   = alicloud_ram_user.user.name
  secret_file = "accesskey.txt"
}
resource "alicloud_ram_policy" "policy" {
  policy_name     = "tf-example-policy"
  policy_document = <<EOF
  {
    "Statement": [
      {
        "Action": "ecs:*",
        "Effect": "Allow",
        "Resource":"*"
      }
    ],
      "Version": "1"
  }
  EOF
  description     = "This is a policy test."
}
resource "alicloud_ram_user_policy_attachment" "attach" {
  policy_name = alicloud_ram_policy.policy.policy_name
  policy_type = alicloud_ram_policy.policy.type
  user_name   = alicloud_ram_user.user.name
}

Referensi

• Common commands

• Resource

• Variable

• Output

• Resource dependencies