使用 Terraform 实现自动化管理多个环境

# Install specific Terraform version
TF_VERSION=1.3.7
wget -O terraform.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip
unzip terraform.zip
rm terraform.zip
sudo mv terraform /usr/bin/terraform
sudo chmod +x /usr/bin/terraform

# Set up required resources for Terraform to use to bootstrap
mkdir -p _bootstrap
wget -P _bootstrap/ https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/_bootstrap/codecatalyst/main_branch_iam_role.tf
wget -P _bootstrap/ https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/_bootstrap/codecatalyst/pr_branch_iam_role.tf
wget -P _bootstrap/ https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/_bootstrap/codecatalyst/providers.tf
wget -P _bootstrap/ https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/_bootstrap/codecatalyst/state_file_resources.tf
wget -P _bootstrap/ https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/_bootstrap/codecatalyst/variables.tf

terraform init
terraform apply

wget -P _bootstrap/ https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/_bootstrap/codecatalyst/terraform.tf

terraform init -migrate-state

mkdir -p .codecatalyst/workflows

wget -P .codecatalyst/workflows https://raw.githubusercontent.com/build-on-aws/manage-multiple-environemnts-with-terraform/main/.codecatalyst/workflows/main_branch.yml
wget -P .codecatalyst/workflows https://raw.githubusercontent.com/build-on-aws/manage-multiple-environemnts-with-terraform/main/.codecatalyst/workflows/pr_branch.yml

wget https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/providers.tf
wget https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/terraform.tf
wget https://raw.githubusercontent.com/build-on-aws/bootstrapping-terraform-automation/main/variables.tf

terraform fmt

git add .
git commit -m "Setting main infra ci-cd workflows"
git push

variable "iam_account_role_name" {
 type = string
 default = "Org-Admin"
}

variable "account_emails" {
 type = map(any)
 default = {
 dev : "tf-demo+dev@example.com",
 test : "tf-demo+test@example.com",
 prod : "tf-demo+prod@example.com",
 }
}

# Set up the organization
resource "aws_organizations_organization" "org" {
 aws_service_access_principals = [
 "cloudtrail.amazonaws.com",
 "config.amazonaws.com",
 "sso.amazonaws.com",
 ]

 feature_set = "ALL"
}

# Create a new OU for environment accounts
resource "aws_organizations_organizational_unit" "environments" {
 name = "environments"
 parent_id = aws_organizations_organization.org.roots[0].id
}

# Create a new AWS account called "dev"
resource "aws_organizations_account" "dev" {
 name = "dev"
 email = lookup(var.account_emails, "dev")
 role_name = var.iam_account_role_name
 parent_id = aws_organizations_organizational_unit.environments.id

 depends_on = [aws_organizations_organization.org]
}

# Create a new AWS account called "test"
resource "aws_organizations_account" "test" {
 name = "test"
 email = lookup(var.account_emails, "test")
 role_name = var.iam_account_role_name
 parent_id = aws_organizations_organizational_unit.environments.id

 depends_on = [aws_organizations_organization.org]
}

# Create a new AWS account called "prod"
resource "aws_organizations_account" "prod" {
 name = "prod"
 email = lookup(var.account_emails, "prod")
 role_name = var.iam_account_role_name
 parent_id = aws_organizations_organizational_unit.environments.id

 depends_on = [aws_organizations_organization.org]
}

terraform init
terraform plan

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
 + create

Terraform will perform the following actions:

 # aws_organizations_account.dev will be created
 + resource "aws_organizations_account" "dev" {
 + arn = (known after apply)
 + close_on_deletion = false
 + create_govcloud = false
 + email = "tf-demo+dev@example.com"
 + govcloud_id = (known after apply)
 + id = (known after apply)
 + joined_method = (known after apply)
 + joined_timestamp = (known after apply)
 + name = "dev"
 + parent_id = (known after apply)
 + role_name = "Org-Admin"
 + status = (known after apply)
 + tags_all = (known after apply)
 }

 # aws_organizations_account.prod will be created
 + resource "aws_organizations_account" "prod" {
 + arn = (known after apply)
 + close_on_deletion = false
 + create_govcloud = false
 + email = "tf-demo+prod@example.com"
 + govcloud_id = (known after apply)
 + id = (known after apply)
 + joined_method = (known after apply)
 + joined_timestamp = (known after apply)
 + name = "prod"
 + parent_id = (known after apply)
 + role_name = "Org-Admin"
 + status = (known after apply)
 + tags_all = (known after apply)
 }

 # aws_organizations_account.test will be created
 + resource "aws_organizations_account" "test" {
 + arn = (known after apply)
 + close_on_deletion = false
 + create_govcloud = false
 + email = "tf-demo+test@example.com"
 + govcloud_id = (known after apply)
 + id = (known after apply)
 + joined_method = (known after apply)
 + joined_timestamp = (known after apply)
 + name = "test"
 + parent_id = (known after apply)
 + role_name = "Org-Admin"
 + status = (known after apply)
 + tags_all = (known after apply)
 }

 # aws_organizations_organization.org will be created
 + resource "aws_organizations_organization" "org" {
 + accounts = (known after apply)
 + arn = (known after apply)
 + aws_service_access_principals = [
 + "cloudtrail.amazonaws.com",
 + "config.amazonaws.com",
 + "sso.amazonaws.com",
 ]
 + feature_set = "ALL"
 + id = (known after apply)
 + master_account_arn = (known after apply)
 + master_account_email = (known after apply)
 + master_account_id = (known after apply)
 + non_master_accounts = (known after apply)
 + roots = (known after apply)
 }

 # aws_organizations_organizational_unit.environments will be created
 + resource "aws_organizations_organizational_unit" "environments" {
 + accounts = (known after apply)
 + arn = (known after apply)
 + id = (known after apply)
 + name = "environments"
 + parent_id = (known after apply)
 + tags_all = (known after apply)
 }

Plan: 5 to add, 0 to change, 0 to destroy.

terraform apply

provider "aws" {
 alias = "dev"
 region = var.aws_region
 assume_role {
 role_arn = "arn:aws:iam::${aws_organizations_account.dev.id}:role/${var.iam_account_role_name}"
 session_name = "dev-account-from-main"
 }
}

provider "aws" {
 alias = "test"
 region = var.aws_region
 assume_role {
 role_arn = "arn:aws:iam::${aws_organizations_account.test.id}:role/${var.iam_account_role_name}"
 session_name = "test-account-from-main"
 }
}

provider "aws" {
 alias = "prod"
 region = var.aws_region
 assume_role {
 role_arn = "arn:aws:iam::${aws_organizations_account.prod.id}:role/${var.iam_account_role_name}"
 session_name = "prod-account-from-main"
 }
}

wget https://raw.githubusercontent.com/build-on-aws/manage-multiple-environments-with-terraform/main/env_accounts_main_branch_iam_role.tf
wget https://raw.githubusercontent.com/build-on-aws/manage-multiple-environments-with-terraform/main/env_accounts_pr_branch_iam_role.tf
wget https://raw.githubusercontent.com/build-on-aws/manage-multiple-environments-with-terraform/main/env_accounts_users_read_only_iam_role.tf

 statement {
 actions = ["sts:AssumeRole"]
 effect = "Allow"
 principals {
 type = "AWS"
 identifiers = [
 "arn:aws:iam::${data.aws_organizations_organization.org.master_account_id}:root"
 ]
 }
 }

terraform apply
# accept changes with "yes"

git add .
git commit -m "Adding providers and IAM roles for workflows for environment accounts"
git push

# Ensure to replace the URL with your one without the "<>" brackets.
git clone<Your clone URL>

Cloning into 'environments-infra'...
remote: Counting objects: 4, done.
Unpacking objects: 100% (4/4), 1.11 KiB | 567.00 KiB/s, done.

terraform {
 backend "s3" {
 bucket = "tf-state-files"
 key = "terraform-environments-state-file/terraform.tfstate"
 region = "us-east-1"
 dynamodb_table = "TerraformMainStateLock"
 kms_key_id = "alias/s3" # Optionally change this to the custom KMS alias you created - "alias/terraform"
 }

 required_providers {
 aws = {
 source = "hashicorp/aws"
 version = "~> 4.33"
 }
 }

 required_version = "= 1.3.7"
}

$ terraform init

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.33"...
- Installing hashicorp/aws v4.57.0...
- Installed hashicorp/aws v4.57.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

variable "aws_region" {
 default = "us-east-1"
}

variable "tf_caller" {
 default = "User"
}

# Configuring the main account AWS provider
provider "aws" {
 alias = "main"
 region = var.aws_region
}

# Look up environment account using main account provider
data "aws_organizations_organization" "org" {
 provider = aws.main
}

# Retrieve the caller identity to append it to the assume role session name.
data "aws_caller_identity" "current" {
 provider = aws.main
}

locals {
 # Set environment account ID as local value based on selected Terraform
 # workspace.
 account_id = data.aws_organizations_organization.org.accounts[
 index(data.aws_organizations_organization.org.accounts.*.name, terraform.workspace)
 ].id
 
 # Sets the role to assume based on the calling identity, if it is a user,
 # default to read-only, otherwise use the role passed by the environment
 # variable (this should only be the CI runner).
 iam_role_name = startswith(var.tf_caller, "User") ? "Users-Read-Only" : var.tf_caller
}

provider "aws" {
 region = var.aws_region
 
 assume_role {
 role_arn = "arn:aws:iam::${local.account_id}:role/${local.iam_role_name}"
 session_name = "dev-account-from-main-${local.iam_role_name}"
 }
}

terraform workspace new dev
terraform workspace new test
terraform workspace new prod

terraform workspace select dev

$ terraform workspace new dev
Created and switched to workspace "dev"!

You're now on a new, empty workspace. Workspaces isolate their state,
so if you run "terraform plan" Terraform will not see any existing state
for this configuration.

$ terraform workspace new test
Created and switched to workspace "test"!

You're now on a new, empty workspace. Workspaces isolate their state,
so if you run "terraform plan" Terraform will not see any existing state
for this configuration.

$ terraform workspace new prod
Created and switched to workspace "prod"!

You're now on a new, empty workspace. Workspaces isolate their state,
so if you run "terraform plan" Terraform will not see any existing state
for this configuration.

$ terraform workspace select dev 
Switched to workspace "dev".

mkdir -p env_accounts_vars

touch env_accounts_vars/dev.tfvars
touch env_accounts_vars/test.tfvars
touch env_accounts_vars/prod.tfvars

# Example, do not run
terraform plan -var-file="env_accounts_vars/dev.tfvars"

# Example, do not run
terraform workspace select dev
terraform plan -var-file="env_accounts_vars/dev.tfvars"

# Example, do not run
terraform workspace select dev
terraform plan -var-file="env_accounts_vars/prod.tfvars"

wget https://raw.githubusercontent.com/build-on-aws/manage-multiple-environments-with-terraform-environment-infra/main/Makefile

.PHONY: default validate plan apply destroy

default:
 @echo ""
 @echo "Runs Terraform validate, plan, and apply wrapping the workspace to use"
 @echo ""
 @echo "The following commands are available:"
 @echo " - plan : runs terraform plan for an environment"
 @echo " - apply : runs terraform apply for an environment"
 @echo " - destroy : will delete the entire project's infrastructure"
 @echo ""
 @echo "The "ENV" environment variable needs to be set to dev, test, or prod."
 @echo ""
 @echo "Exmple usage:"
 @echo " EVN=dev make plan"
 @echo ""

validate:
 $(call check_defined, ENV, Please set the ENV to plan for. Values should be dev, test, or prod)

 @echo "Initializing Terraform ..."
 @terraform init
 
 @echo 'Creating the $(value ENV) workspace ...'
 @-terraform workspace new $(value ENV)

 @echo 'Switching to the [$(value ENV)] environment ...'
 @terraform workspace select $(value ENV)

 @terraform validate -no-color

plan:
 $(call check_defined, ENV, Please set the ENV to plan for. Values should be dev, test, or prod)

 @echo "Initializing Terraform ..."
 @terraform init
 
 @echo 'Creating the $(value ENV) workspace ...'
 @-terraform workspace new $(value ENV)

 @echo 'Switching to the [$(value ENV)] workspace ...'
 @terraform workspace select $(value ENV)

 @terraform plan \
 -var-file="env_accounts_vars/$(value ENV).tfvars" -no-color -input=false \
 -out $(value ENV).plan


apply:
 $(call check_defined, ENV, Please set the ENV to apply. Values should be dev, test, or prod)

 @echo 'Creating the $(value ENV) workspace ...'
 @-terraform workspace new $(value ENV)

 @echo 'Switching to the [$(value ENV)] workspace ...'
 @terraform workspace select $(value ENV)

 @terraform apply -auto-approve -no-color -input=false \
 -var-file="env_accounts_vars/$(value ENV).tfvars"


destroy:
 $(call check_defined, ENV, Please set the ENV to apply. Values should be dev, test, or prod)

 @echo "Initializing Terraform ..."
 @terraform init
 
 @echo 'Creating the $(value ENV) workspace ...'
 @-terraform workspace new $(value ENV)

 @echo 'Switching to the [$(value ENV)] workspace ...'
 @terraform workspace select $(value ENV)

 @echo "## ##"
 @echo "Are you really sure you want to completely destroy [$(value ENV)] environment ?"
 @echo "## ##"
 @read -p "Press enter to continue"
 @terraform destroy \
 -var-file="env_vars/$(value ENV).tfvars"


# Check that given variables are set and all have non-empty values,
# die with an error otherwise.
#
# Params:
# 1. Variable name(s) to test.
# 2. (optional) Error message to print.
check_defined = \
 $(strip $(foreach 1,$1, \
 $(call __check_defined,$1,$(strip $(value 2)))))
__check_defined = \
 $(if $(value $1),, \
 $(error Undefined $1$(if $2, ($2))))

ENV=dev make plan

$ ENV=dev make plan

Initializing Terraform ...
Initializing modules...

Initializing the backend...

Initializing provider plugins...
- Reusing previous version of hashicorp/aws from the dependency lock file
- Using previously-installed hashicorp/aws v4.57.0

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
Creating the dev workspace ...
Workspace "dev" already exists
make: [plan] Error 1 (ignored)
Switching to the [dev] workspace ...

# Example of error output

Creating the dev workspace ...
Workspace "dev" already exists
make: [plan] Error 1 (ignored)
Switching to the [dev] workspace ...

mkdir -p .codecatalyst/workflows

wget https://raw.githubusercontent.com/build-on-aws/manage-multiple-environments-with-terraform-environment-infra/main/.codecatalyst/workflows/main_branch.yml
wget https://raw.githubusercontent.com/build-on-aws/manage-multiple-environments-with-terraform-environment-infra/main/.codecatalyst/workflows/pr_branch.yml

git add -f env_accounts_vars/*.tfvars

git add .
git commit -m "Base workflows and bootstrapping added"
git push

git checkout -b add-vpc

module "vpc" {
 source = "terraform-aws-modules/vpc/aws"

 name = "CodeCatalyst-Terraform"
 cidr = var.vpc_cidr

 azs = ["${var.aws_region}a", "${var.aws_region}b", "${var.aws_region}c"]
 public_subnets = var.public_subnet_ranges

 enable_nat_gateway = false
 enable_vpn_gateway = false
}

variable "vpc_cidr" {
 type = string
}

variable "public_subnet_ranges" {
 type = list
}

git add .
git commit -m "Add new VPC"
git push --set-upstream origin add-vpc

resource "aws_s3_bucket" "state_file" {
 bucket = var.state_file_bucket_name

 force_destroy = true

 lifecycle {
 prevent_destroy = false
 }
}