Terraform とは

# macOS
>brew tap hashicorp/tap
>brew install hashicorp/tap/terraform

# Linux（CentOS）
>yum install -y yum-utils
>yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
>yum -y install terraform

terraform {
	required_version = ">= 1.5.6" # Terraformのバージョン（1.5.6以上）

	required_providers {
		aws = {
			version = "~> 5.15.0" # hashicorp/awsバージョン（5.15.0 ～ 5.16.0）
			source = "hashicorp/aws" # awsならこれ
		}
	}

	backend "s3" {
		bucket = "OPW" # stateファイルを格納するバケット名（任意）
		key = "Staging/terraform.tfstate" # stateファイル名（任意）
		region = "ap-northeast-1" # リージョン
	}
}

>terraform init

Initializing the backend...

│ Error: error configuring S3 Backend: error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid.
│       status code: 403, request id: e3748067-f3e7-49e3-a189-63433391ddd9
│
│

	backend "s3" {
		bucket = "OPW" # stateファイルを格納するバケット名
		key = "Staging/terraform.tfstate" # stateファイル名
		region = "ap-northeast-1" # リージョン
		shared_credentials_file = "~/.aws/credentials" # クレデンシャルファイルの場所
		profile = "OPWDeveloper" # 利用するプロファイル
	}

>terraform init

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.

・・・

Terraform has been successfully initialized!

>terraform init -reconfigure

provider "aws" {
	region  = "ap-northeast-1" # リージョン
}

provider "aws" {
	region  = "ap-northeast-1" # リージョン
	access_key = "${var.aws_access_key}" # アクセスキー
	secret_key = "${var.aws_secret_key}" # シークレットアクセスキー
	#token = "${var.aws_session_token}" # MFA（多要素認証）を利用する場合のセショントークン
}

# 入力変数
variable "aws_access_key" {} # アクセスキー
variable "aws_secret_key" {} # シークレットアクセスキー
variable "aws_session_token" {} # MFA（多要素認証）を利用する場合のセショントークン
variable "aws_account_id" {} # アカウントID

variable "env" {
	default = "staging"
}

# ローカル変数
locals {
	aws_region = "ap-northeast-1"
	environment = {
		staging = {
			prefix = "Staging",
			timeout = 30,
			memory_size = 64
		},
		production = {
			prefix = "Prod",
			timeout = 60,
			memory_size = 128
		}
	}
	env = local.environment[var.env]
}

"arn:aws:lambda:${local.aws_region}:${var.aws_account_id}:function:OPW_${local.env.prefix}_*"

export TF_VAR_aws_access_key="XXXXXXXXXXXX" # アクセスキー
export TF_VAR_aws_secret_key="XXXXXXXXXXXX" # シークレットアクセスキー
#export TF_VAR_aws_session_token="XXXXXXXXXXXX" # MFA（多要素認証）を利用する場合のセショントークン
export TF_VAR_aws_account_id="XXXXXXXXXXXX" # アカウントID

>terraform plan -var 'env=staging' # ステージング環境用
>terraform plan -var 'env=production' # 本番環境用

>terraform plan -var-file=staging.tfvars # ステージング環境用
>terraform plan -var-file=production.tfvars # 本番環境用

# ラムダ関数
resource "aws_lambda_function" "OPW_lambda_InventoryCheck" { # 1
	function_name = "OPW_${local.env.prefix}_lambda_InventoryCheck" # 2
	role          = aws_iam_role.OPW_role_lambda.arn # 3

	s3_bucket = "OPW_lambda" # 4
	s3_key    = "${local.env.prefix}/OPW_lambda.zip" # 5

	handler = "inventoryCheck.start" # 6
	runtime = "nodejs18.x" # 7

	environment { # 8
		variables = {
			foo = "bar"
		}
	}
	timeout = 60 # 9
	memory_size = 128 # 10

	tags = {
		env = "OPW_${local.env.prefix}" # 11
	}
}

# arn:aws:iam::${アカウントID}:role/ロール名
arn:aws:iam::${var.aws_account_id}:role/OPW_${local.env.prefix}_role_lambda

# ラムダ関数の実行ロール
resource "aws_iam_role" "OPW_role_lambda" { # 1
	name = "OPW_${local.env.prefix}_role_lambda" # 2
	path = "/OPW/${local.env.prefix}/" # 3

	assume_role_policy = jsonencode({ # 4
		Version = "2012-10-17", # 5
		Statement = [{
			Action = "sts:AssumeRole", # 6
			Effect = "Allow",
			Principal = {
				Service = "lambda.amazonaws.com" # 7
			}
		}]
	})
}

# S3へのアクセスを許可するポリシー
resource "aws_iam_policy" "OPW_policy_S3" { # 1
	name = "OPW_${local.env.prefix}_policy_S3" # 2
	path = "/OPW/${local.env.prefix}/" # 3
	description = "Policy for S3 access" # 4

	policy = jsonencode({ # 5
		Version = "2012-10-17", # 6
    	Statement = [{
			Effect = "Allow",
			Action = [ # 7
				"s3:PutObject",
				"s3:GetObject",
				"s3:ListBucket"
			],
			Resource = "arn:aws:s3:::OPW/${local.env.prefix}/*" # 8
		}]
	})
}

# ラムダ関数の実行ロールへのアタッチ
resource "aws_iam_role_policy_attachment" "OPW_policy_lambda_attachment" { # 9
  role       = aws_iam_role.OPW_role_lambda.name # 10
  policy_arn = aws_iam_policy.OPW_policy_S3.arn # 11
}

# arn:aws:iam::${アカウントID}:policy/ポリシー名
arn:aws:iam::${var.aws_account_id}:policy/OPW_${local.env.prefix}_policy_S3

# ステップファンクション
resource "aws_sfn_state_machine" "OPW_sfn_OrderProcessing" { # 1
	name     = "OPW_${local.env.prefix}_sfn_OrderProcessing" # 2
	role_arn = aws_iam_role.OPW_role_sfn.arn # 3

	definition = <<EOF # 4
{
	"Comment": "Automates an OPW", # 5
	"StartAt": "1_InventoryCheck", # 6
	"States": { # 7
		"1_InventoryCheck": {
			"Type": "Task", # 8
			"Resource": "${aws_lambda_function.OPW_lambda_InventoryCheck.arn}", # 9
			"Next": "2_ProcessPayment" # 10
		},
		"2_ProcessPayment": {
			"Type": "Task",
			"Resource": "${aws_lambda_function.OPW_lambda_ProcessPayment.arn}",
			"Next": "3_SendNotification"
		},
		"3_SendNotification": {
			"Type": "Task",
			"Resource": "${aws_lambda_function.OPW_lambda_SendNotification.arn}",
			"End": true # 11
		}
	}
}
EOF
}

# arn:aws:iam::${アカウントID}:role/ロール名
arn:aws:iam::${var.aws_account_id}:role/OPW_${local.env.prefix}_role_sfn

# arn:aws:lambda:${リージョン}:${アカウントID}:function:ラムダ関数名
arn:aws:lambda:${local.aws_region}:${var.aws_account_id}:function:OPW_${var.env.prefix}_lambda_InventoryCheck

# ステップファンクション実行ロール
resource "aws_iam_role" "OPW_role_sfn" {
	name = "OPW_${local.env.prefix}_role_sfn"
	path = "/OPW/${local.env.prefix}/"

	assume_role_policy = jsonencode({
		Version = "2012-10-17",
		Statement = [{
			Effect    = "Allow",
			Action    = "sts:AssumeRole",
			Principal = {
				Service = "states.amazonaws.com"
			}
		}]
	})
}

# ステップファンクション実行ロール用ポリシードキュメント
data "aws_iam_policy_document" "OPW_policyDoc_sfn" {
	statement {
		effect  = "Allow"
		actions = ["sts:AssumeRole"]
		principals {
			type        = "Service"
			identifiers = ["states.amazonaws.com"]
		}
	}
}

# ステップファンクション実行ロール
resource "aws_iam_role" "OPW_role_sfn" {
	name = "OPW_${local.env.prefix}_role_sfn"
	path = "/OPW/${local.env.prefix}/"
	assume_role_policy = "${data.aws_iam_policy_document.OPW_policyDoc_sfn.json}"
}

# ラムダ関数の実行を許可するポリシー
resource "aws_iam_policy" "OPW_policy_executeLambda" {
	name = "OPW_${local.env.prefix}_policy_executeLambda"
	path = "/OPW/${local.env.prefix}/"
	description = "Policy for executing specific Lambda functions from Step Functions"

	policy = jsonencode({
		Version = "2012-10-17",
		Statement = [{
			Effect = "Allow",
			Action = [
				"lambda:InvokeFunction"
			],
			Resource = "arn:aws:lambda:${local.aws_region}:${var.aws_account_id}:function:OPW_${local.env.prefix}_*"
		}]
	})
}

# ステップファンクションの実行ロールへのアタッチ
resource "aws_iam_role_policy_attachment" "OPW_policy_sfn_attachment" {
	role       = aws_iam_role.OPW_role_sfn.name
	policy_arn = aws_iam_policy.OPW_policy_executeLambda.arn
}

# ステップファンクションの実行ロールへのアタッチ
resource "aws_iam_role_policy_attachment" "OPW_policy_sfn_attachment2" {
	role       = aws_iam_role.OPW_role_sfn.name
	policy_arn = "arn:aws:iam::aws:policy/CloudWatchFullAccess"
}

# デプロイユーザー用ポリシー
resource "aws_iam_policy" "OPW_policy_Deployer" { # 1
	name = "OPW_${local.env.prefix}_policy_Deployer"
	path = "/OPW/${local.env.prefix}/"
	description = "Policy for the OPW deployer"

	policy = jsonencode({
		Version = "2012-10-17"
		Statement = [
			{
				Effect = "Allow"
				Action = [ # 2
					"lambda:*",
					"states:*"
				]
				Resource = [ # 3
					"arn:aws:lambda:${local.aws_region}:${var.aws_account_id}:function:OPW_${local.env.prefix}_*",
					"arn:aws:states:${local.aws_region}:${var.aws_account_id}:stateMachine:OPW_${local.env.prefix}_*"
				]
			},{
				Effect = "Allow"
				Action = [ # 4
					"iam:CreateRole",
					"iam:DeleteRole",
					"iam:AttachRolePolicy",
					"iam:DetachRolePolicy",
					"iam:PutRolePolicy",
					"iam:DeleteRolePolicy",
					"iam:GetPolicy",
					"iam:CreatePolicy",
					"iam:DeletePolicy",
					"iam:AttachUserPolicy",
					"iam:DetachUserPolicy"
				]
				Resource = [ # 5
					"arn:aws:iam::*:role/OPW_${local.env.prefix}_*",
					"arn:aws:iam::*:policy/OPW_${local.env.prefix}_*"
				]
			}
		]
	})
}

# テスター用ロール
resource "aws_iam_role" "OPW_role_Tester" {
	name = "OPW_Staging_role_Tester"
	path = "/OPW/Staging/"

	assume_role_policy = jsonencode({
		Version = "2012-10-17",
		Statement = [{
			Action = "sts:AssumeRole",
			Effect = "Allow",
			Principals = {
				type = "Service"
				identifiers = ["lambda.amazonaws.com", "states.amazonaws.com"]
			}
		}]
	})
}

# ステートマシン実行ポリシー
resource "aws_iam_policy" "OPW_policy_executeSfn" {
	name = "OPW_Staging_policy_executeSfn"
	path = "/OPW/Staging/"

	policy = jsonencode({
		Version = "2012-10-17",
    	Statement = [{
			Effect = "Allow",
			Action = [
				"states:StartExecution",
				"states:StopExecution"
			],
			Resource = "arn:aws:states:${local.aws_region}:${var.aws_account_id}:stateMachine:OPW_Staging_*"
		}]
	})
}

# テスター用ロールへのアタッチ
resource "aws_iam_role_policy_attachment" "OPW_policy_Tester_attachment" {
	role       = aws_iam_role.OPW_role_Tester.name
	policy_arn = aws_iam_policy.OPW_policy_executeLambda.arn
}
resource "aws_iam_role_policy_attachment" "OPW_policy_Tester_attachment2" {
	role       = aws_iam_role.OPW_role_Tester.name
	policy_arn = aws_iam_policy.OPW_policy_executeSfn.arn
}

>terraform validate
Success! The configuration is valid.

>terraform plan -var 'env=staging'

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
-/+ destroy and then create replacement

Terraform will perform the following actions:

・・・

plan 4 to add, 0 to change, 1 to destroy.

>terraform apply -var 'env=staging'

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
-/+ destroy and then create replacement

Terraform will perform the following actions:

・・・

Plan: 4 to add, 0 to change, 1 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value:

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

aws_iam_policy.OPW_Staging_S3FullAccess: Creating...

│ Error: creating IAM Policy (OPW_Staging_S3FullAccess): AccessDenied: User: arn:aws:iam::XXXXXX:user/OPWDeployer is not authorized to perform: iam:CreatePolicy on resource: policy OPW_Staging_S3FullAccess because no identity-based policy allows the iam:CreatePolicy action
│       status code: 403, request id: c40efeed-db67-4e2c-8ba0-312efdgc7f30
│
│   with aws_iam_policy.OPW_Staging_S3FullAccess,
│   on etl_crm_staging.tf line 5, in resource "aws_iam_policy" "OPW_Staging_S3FullAccess":
│    5: resource "aws_iam_policy" "OPW_Staging_S3FullAccess" {
│

# テスターアカウント
resource "aws_iam_user" "OPW_user_TestUser" {
	name = "OPWTestUser"
}

# terraform import [リソース種別].[リソース名] [AWS上に登録されている名称]
>terraform import aws_iam_user.OPW_user_TestUser OPWTestUser

Import successful!

>terraform destroy -var 'env=staging'

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

・・・

Plan: 0 to add, 0 to change, 13 to destroy.

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value:

Destroy complete! Resources: 13 destroyed.