Terraform入門 ── AWSにEC2+RDSを作ってaws loginの認証エラーとドリフトを確かめる

resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr
  # ...
}

resource "aws_subnet" "private_ec2" {
  vpc_id            = aws_vpc.main.id   # ← VPCのIDを参照
  cidr_block        = var.private_subnet_ec2_cidr
  availability_zone = var.az_primary
}

# SSM Session ManagerはEC2上のSSMエージェントがアウトバウンドでSSMに接続する方式のため、インバウンドルールは一切不要。
resource "aws_security_group" "ec2" {
  name        = "${var.project_name}-ec2-sg"
  description = "EC2 instance security group (SSM only, no inbound)"
  vpc_id      = aws_vpc.main.id

  egress {
    description = "Allow all outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress = []

  tags = {
    Name = "${var.project_name}-ec2-sg"
  }
}

  ingress {
    description     = "PostgreSQL from EC2"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.ec2.id]
  }

resource "aws_db_subnet_group" "rds" {
  name       = "${var.project_name}-rds-subnet-group"
  subnet_ids = [aws_subnet.private_rds.id, aws_subnet.private_rds_secondary.id]
}

resource "aws_db_instance" "main" {
  # ...
  db_subnet_group_name = aws_db_subnet_group.rds.name
  availability_zone    = var.az_primary
  # ...
}

resource "random_password" "rds_master" {
  length  = 20
  special = true
  # RDSのマスターパスワードで使用できない文字（/, ', ", @, スペース）を除外
  override_special = "!#$%&*()-_=+[]{}<>:?"
}

$ git clone https://github.com/yuudee/terraform_handson.git
$ cd terraform_handson

$ terraform init
Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/random versions matching "~> 3.0"...
- Finding hashicorp/aws versions matching "~> 5.0"...
- Installing hashicorp/random v3.9.1...
- Installed hashicorp/random v3.9.1 (signed by HashiCorp)
- Installing hashicorp/aws v5.100.0...
- Installed hashicorp/aws v5.100.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

$ terraform fmt -check -recursive
$ terraform validate
Success! The configuration is valid.

$ terraform plan

Terraform planned the following actions, but then encountered a problem:

  # random_password.rds_master will be created
  + resource "random_password" "rds_master" {
      ...
    }

Plan: 1 to add, 0 to change, 0 to destroy.
╷
│ Error: No valid credential sources found
│
│   with provider["registry.terraform.io/hashicorp/aws"],
│   on versions.tf line 16, in provider "aws":
│   16: provider "aws" {
│
│ Please see https://registry.terraform.io/providers/hashicorp/aws
│ for more information about providing credentials.
│
│ Error: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, exceeded maximum number of attempts, 3, request send failed, Get
│ "http://169.254.169.254/latest/meta-data/iam/security-credentials/": dial tcp 169.254.169.254:80: i/o timeout

    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"   # 5.0 から変更
    }

$ terraform init -upgrade
Initializing provider plugins...
- Finding hashicorp/random versions matching "~> 3.0"...
- Finding hashicorp/aws versions matching "~> 6.0"...
- Using previously-installed hashicorp/random v3.9.1
- Installing hashicorp/aws v6.65.0...
- Installed hashicorp/aws v6.65.0 (signed by HashiCorp)

Terraform has made some changes to the provider dependency selections recorded
in the .terraform.lock.hcl file. Review those changes and commit them to your
version control system if they represent changes you intended to make.

$ terraform plan

（リソースごとの詳細は省略）

Plan: 23 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + ec2_instance_id       = (known after apply)
  + ec2_private_ip        = (known after apply)
  + nat_gateway_public_ip = (known after apply)
  + rds_address           = (known after apply)
  + rds_db_name           = "appdb"
  + rds_master_password   = (sensitive value)
  + rds_master_username   = "dbadmin"
  + rds_port              = (known after apply)
  + vpc_id                = (known after apply)

$ terraform apply

Terraform planned the following actions, but then encountered a problem:

（省略）

╷
│ Error: No valid credential sources found
│
│   with provider["registry.terraform.io/hashicorp/aws"],
│   on versions.tf line 16, in provider "aws":
│   16: provider "aws" {
│
│ Error: failed to refresh cached credentials, create oauth2 token: operation error Signin: CreateOAuth2Token, https response error StatusCode: 400, RequestID:
│ ...
│ ValidationException: The provided authorization grant is invalid, expired, revoked, or malformed

$ terraform apply

（省略）

Apply complete! Resources: 23 added, 0 changed, 0 destroyed.

Outputs:

ec2_instance_id = "i-0xxxxxxxxxxxxxxxx"
ec2_private_ip = "10.0.1.162"
nat_gateway_public_ip = "xx.xx.xx.xx"
rds_address = "simple-vpc-handson-db.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com"
rds_db_name = "appdb"
rds_master_password = <sensitive>
rds_master_username = "dbadmin"
rds_port = 5432
vpc_id = "vpc-0xxxxxxxxxxxxxxxx"

.terraform/
*.tfstate
*.tfstate.*
*.tfvars
tfplan

$ terraform output -raw rds_address
simple-vpc-handson-db.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com
$ terraform output -raw rds_master_password
（パスワードが表示される）

$ aws ssm start-session --target "$(terraform output -raw ec2_instance_id)" --region us-east-1

Starting session with SessionId: xxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxx
sh-5.2$

sh-5.2$ which psql
/usr/bin/psql

sh-5.2$ psql -h simple-vpc-handson-db.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com -U dbadmin -d appdb
Password for user dbadmin:
psql (15.19, server 15.17)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, compression: off)
Type "help" for help.

appdb=> SELECT version();
                                                     version
------------------------------------------------------------------------------------------------------------------
 PostgreSQL 15.17 on x86_64-pc-linux-gnu, compiled by x86_64-pc-linux-gnu-gcc (GCC) 12.4.0, 64-bit
(1 row)

appdb=> \q
sh-5.2$

$ INSTANCE_ID=$(terraform output -raw ec2_instance_id)
$ aws ec2 create-tags --resources "$INSTANCE_ID" --tags Key=Name,Value=manually-renamed --region us-east-1

$ terraform plan

Terraform will perform the following actions:

  # aws_instance.app will be updated in-place
  ~ resource "aws_instance" "app" {
        id                                   = "i-0xxxxxxxxxxxxxxxx"
      ~ tags                                 = {
          ~ "Name" = "manually-renamed" -> "simple-vpc-handson-ec2"
        }
      ~ tags_all                             = {
          ~ "Name" = "manually-renamed" -> "simple-vpc-handson-ec2"
        }
        # (40 unchanged attributes hidden)

        # (9 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

$ terraform apply
（plan と同じ内容が表示される）

  Enter a value: yes

aws_instance.app: Modifying... [id=i-0xxxxxxxxxxxxxxxx]
aws_instance.app: Modifications complete after 4s [id=i-0xxxxxxxxxxxxxxxx]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

$ RDS_SG_ID=$(echo 'aws_security_group.rds.id' | terraform console | tr -d '"')
$ EC2_SG_ID=$(echo 'aws_security_group.ec2.id' | terraform console | tr -d '"')

$ aws ec2 authorize-security-group-ingress --group-id "$RDS_SG_ID" --protocol tcp --port 5432 --cidr 10.0.0.0/16 --region us-east-1
{
    "Return": true,
    "SecurityGroupRules": [
        {
            "SecurityGroupRuleId": "sgr-0xxxxxxxxxxxxxxxx",
            "GroupId": "sg-0xxxxxxxxxxxxxxxx",
            "IsEgress": false,
            "IpProtocol": "tcp",
            "FromPort": 5432,
            "ToPort": 5432,
            "CidrIpv4": "10.0.0.0/16",
            ...
        }
    ]
}

$ terraform plan

Terraform will perform the following actions:

  # aws_security_group.rds will be updated in-place
  ~ resource "aws_security_group" "rds" {
        id                     = "sg-0xxxxxxxxxxxxxxxx"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "10.0.0.0/16",
                ]
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 5432
                # (1 unchanged attribute hidden)
            },
            # (1 unchanged element hidden)
        ]
        name                   = "simple-vpc-handson-rds-sg"
        # (9 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

$ terraform apply
（省略）
aws_security_group.rds: Modifying... [id=sg-0xxxxxxxxxxxxxxxx]
aws_security_group.rds: Modifications complete after 2s [id=sg-0xxxxxxxxxxxxxxxx]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

$ aws ec2 authorize-security-group-ingress --group-id "$EC2_SG_ID" --protocol tcp --port 22 --cidr 10.0.0.0/16 --region us-east-1
{
    "Return": true,
    "SecurityGroupRules": [
        {
            "SecurityGroupRuleId": "sgr-0yyyyyyyyyyyyyyyy",
            "GroupId": "sg-0yyyyyyyyyyyyyyyy",
            "IsEgress": false,
            "IpProtocol": "tcp",
            "FromPort": 22,
            "ToPort": 22,
            "CidrIpv4": "10.0.0.0/16",
            ...
        }
    ]
}

$ terraform plan

No changes. Your infrastructure matches the configuration.

$ aws ec2 describe-security-groups --group-ids "$EC2_SG_ID" --region us-east-1 --query 'SecurityGroups[0].IpPermissions'
[
    {
        "IpProtocol": "tcp",
        "FromPort": 22,
        "ToPort": 22,
        "UserIdGroupPairs": [],
        "IpRanges": [
            {
                "CidrIp": "10.0.0.0/16"
            }
        ],
        "Ipv6Ranges": [],
        "PrefixListIds": []
    }
]

resource "aws_security_group" "ec2" {
  # ...
  ingress = []   # インバウンドは空、ということまで管理する
  # ...
}

$ terraform plan

Terraform will perform the following actions:

  # aws_security_group.ec2 will be updated in-place
  ~ resource "aws_security_group" "ec2" {
        id                     = "sg-0yyyyyyyyyyyyyyyy"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "10.0.0.0/16",
                ]
              - from_port        = 22
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 22
                # (1 unchanged attribute hidden)
            },
        ]
        name                   = "simple-vpc-handson-ec2-sg"
        # (9 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

$ terraform apply
（省略）
aws_security_group.ec2: Modifying... [id=sg-0yyyyyyyyyyyyyyyy]
aws_security_group.ec2: Modifications complete after 1s [id=sg-0yyyyyyyyyyyyyyyy]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

$ aws ec2 describe-security-groups --group-ids "$EC2_SG_ID" --region us-east-1 --query 'SecurityGroups[0].IpPermissions'
[]

$ terraform apply -refresh-only

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # aws_instance.app has changed
  ~ resource "aws_instance" "app" {
        id                                   = "i-0xxxxxxxxxxxxxxxx"
      ~ tags                                 = {
          ~ "Name" = "simple-vpc-handson-ec2" -> "manually-renamed"
        }
      ~ tags_all                             = {
          ~ "Name" = "simple-vpc-handson-ec2" -> "manually-renamed"
        }
        # (40 unchanged attributes hidden)

        # (9 unchanged blocks hidden)
    }


This is a refresh-only plan, so Terraform will not take any actions to undo
these. If you were expecting these changes then you can apply this plan to
record the updated values in the Terraform state without changing any remote
objects.

Would you like to update the Terraform state to reflect these detected changes?
  Terraform will write these changes to the state without modifying any real infrastructure.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes


Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

$ terraform plan

Terraform will perform the following actions:

  # aws_instance.app will be updated in-place
  ~ resource "aws_instance" "app" {
        id                                   = "i-0xxxxxxxxxxxxxxxx"
      ~ tags                                 = {
          ~ "Name" = "manually-renamed" -> "simple-vpc-handson-ec2"
        }
      ~ tags_all                             = {
          ~ "Name" = "manually-renamed" -> "simple-vpc-handson-ec2"
        }
        # (40 unchanged attributes hidden)

        # (9 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

$ terraform destroy
（省略）
Destroy complete! Resources: 23 destroyed.