#### Git Hub Repo : https://github.com/ashokitschool/Terraform_Projects.
git
===========
Terraform
===========
=> Developed by Hashicorp
=> To create/provision infrastructure in cloud platform
=> IAC software (infrastructure as code)
=> Supports all most all cloud platforms
=> Terraform will use HCL language to provision infrastructure
HCL : Hashicorp configuration language
=> We can install terraform in mulitple Operating Systems
Ex: Windows, Linux....
==============================
Terraform Vs Cloud Formation
==============================
=> Cloud Formation is used to create infrastructure only in aws cloud
=> Terraform supports all cloud platforms available in the market.
====================================
Terraform Installation in Windows
====================================
Step-1 : Download terraform for windows & extract zip file
Note: We can see terraform.exe file
Step-2 : Set path for terraform s/w in System environment variables
Step-3 : Verify terraform setup using cmd
$ terraform -v
Step-4 : Download and install VS CODE IDE to write terraform scripts
URL : https://code.visualstudio.com/download
=========================
Terraform Architecture
=========================
=> Terraform will use HCL script to provision infrastructure in cloud platforms.
=> We need to write HCL script and save it in .tf file
.tf => init => fmt => validate => plan => apply => destroy
=> Below are the terraform commands
terraform init : Initialize terraform script (.tf file)
terraform fmt : Format terraform script indent spacing (optinal)
terraform validate : Verify terraform script syntax is valid or not (optional)
terraform plan : Create execution plan for terraform script
terraform apply : Create actual resources in cloud based on plan
Note: tfstate file will be created to track the resources created with our script.
terraform destroy : It is used to delete the resources created with our script.
### Terraform AWS Documentation :
https://registry.terraform.io/providers/hashicorp/aws/latest/docs
==========================================
Terraform Script To create EC2 Instance
==========================================
provider "aws" {
region = "ap-south-1"
access_key = "AKIATCKAMNKD6R2YIMPM"
secret_key = "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"
}
resource "aws_instance" "ashokit_linux_vm" {
ami = "ami-0e53db6fd757e38c7"
instance_type = "t2.micro"
key_name = "awslab"
security_groups = ["default"]
tags = {
Name = "LinuxVM"
}
}
---------------------------------------
$ terraform init
$ terraform validate
$ terraform fmt
$ terraform plan
$ terraform apply --auto-approve
$ terraform destory --auto-approve
=========================
Variables in Terraform
=========================
=> Variables are used to store data in key-value format
id = 101
name = ashok
=> We can remove hard coded values from resources script using variables
=> Variables we can maintain in seperate .tf file
Ex : input-vars.tf
variable "ami" {
description = "Amazon machine image id"
default = "ami-0e53db6fd757e38c7"
}
variable "instance_type" {
description = "Represens EC2 instance type"
default = "t2.micro"
}
variable "key_name" {
description = ""
default = "awslab"
}
=> We can access variables in our resources script like below
resource "aws_instance" "ashokit_ec2_vm" {
ami = "${var.ami}"
instance_type = "${var.instance_type}"
key_name = "${var.key_name}"
security_groups = ["default"]
tags = {
Name = "AIT-Linux-VM
}
}
=================================
Types of variables in terraform
=================================
1) Input Variables
2) Output Variables
=> Input variables are used to supply values to the terraform script.
Ex : ami, instance_type, keyname, securitygrp
=> Output variables are used to get the values from terraform script after
execution.
Ex-1 : After EC2 VM created, print ec2-vm public ip
Ex-2 : After S3 bucket got created, print bucket info
Ex-3 : After RDS instance got created, print DB endpoint
Ex-4 : After IAM user got created print IAM user info
-------------------input-vars.tf------------------
variable "ami" {
description = "Amazon machine image id"
default = "ami-0e53db6fd757e38c7"
}
variable "instance_type" {
description = "Represens EC2 instance type"
default = "t2.micro"
}
variable "key_name" {
description = ""
default = "awslab"
}
--------------------main.tf-------------------
resource "aws_instance" "ashokit_ec2_vm" {
ami = var.ami
instance_type = var.instance_type
key_name = var.key_name
security_groups = ["default"]
tags = {
Name = "AIT-Linux-VM"
}
}
---------------output-vars.tf--------------------
output "ec2_vm_public_ip" {
value = aws_instance.ashokit_ec2_vm.public_ip
}
output "ec2_private_ip" {
value = aws_instance.ashokit_ec2_vm.private_ip
}
output "ec2_subnet_id"{
value = aws_instance.ashokit_ec2_vm.subnet_id
}
output "ec2_complete_info"{
value = aws_instance.ashokit_ec2_vm
}
===================================================
Create Multiple EC2 Instances with Diff Tag names
===================================================
locals {
instances_count = 3
instances_tags = [
{
Name = "Dev-Server"
},
{
Name = "QA-Server"
},
{
Name = "UAT-Server"
}
]
}
resource "aws_instance" "ashokit_ec2_vm" {
count = locals.instances_count
ami = var.ami
instance_type = var.instance_type
key_name = var.key_name
security_groups = ["default"]
tags = locals.instances_tags[count.index]
}
output "instance_ids" {
value = aws_instance.ashokit_ec2_vm[*].pubic_ip
}
=============
Assignment
=============
1) Create S3 Bucket
2) Create RDS instance
3) Create IAM user
4) Create Custom VPC
5) Create Ec2 Instance using Custom VPC
===================
Terraform Modules
===================
=> A Terraform module is a set of terraform configuration files available in a
single directory.
=> One module can contain one or more .tf files
01-Project
- main.tf
- inputs.tf
- outputs.tf
=> One module can have any no.of child modules in terraform
Ex: inside project we can take ec2, s3, rds as child modules
ashokit
- ec2
- main.tf
- inputs.tf
- outputs.tf
- s3
- main.tf
- inputs.tf
- outputs.tf
- provider.tf
- main.tf
- outputs.tf
Note : Using terraform modules we can achieve re-usability
Note: We will run terraform commands from root module and root module will invoke
child modules for execution.
======================================
Terraform project setup with Modules
======================================
### Step-1 : Create Project directory
Ex: 03-App
### Step-2 : Create "modules" directory inside project directory
Ex: 03-App
- modules
### Step-3 : Create "ec2" & "s3" directories inside "modules" directory
Ex : 03-App
- modules
- ec2
- s3
### Step-4 : Create terraform scripts inside "ec2" directory
inputs.tf
main.tf
outputs.tf
### Step-5 : Create terraform scripts inside "s3" directory
inputs.tf
main.tf
outputs.tf
### Step-6 : create "provider.tf" file in root module
### Step-7 : create "main.tf" file in root module and invoke child modules from
root module.
module "my_ec2"{
source = "./modules/ec2"
}
module "my_s3" {
source = "./modules/s3"
}
### Step-8: Create "ouputs.tf" in project root module and access child modules
related outputs.
output "ait_vm_public_ip"{
value = module.my_ec2.a1
}
output "ait_vm_private_ip" {
value = module.my_ec2.a2
}
Note: here a1 and a2 are ouput variables declared in ec2 module ouputs.tf file
================================
Environments of the project
===============================
=> Env means the platform that is required to run our application
Ex: Servers, Database, Storage, Network....
=> One project contains multiple envs
Ex: DEV, SIT or QA, UAT, PILOT, PROD env
Dev Env : Developers will use it for code integration testing
SIT / QA Env : Testers will use it for System Integration Testing
UAT Env: Client will use it for Acceptance testing.
Pilot Env : Pre-Prod testing and Performance testing.
Prod Env : Live Environment.
===============================================
Non-PROD Env (DEV, SIT, UAT and PILOT)
PROD Env (Very important & critical)
Note: In real-time from environment to environment infrastructure resources
configuration might be different
Ex : For Non-PROD : t2.medium instances required
For PROD : t2.xlarge instances required
=> In order to achieve this requirement we will maintain environment specific input
variable file like below
===============================================
inputs-dev.tf : input variables for dev env
inputs-sit.tf : input variables for SIT env
inputs-uat.tf : input variables for UAT env
inputs-pilot.tf : input variables for PILOT env
inputs-prod.tf : input variables for PROD env
=================================================
=> When we are executing terraform apply command we can pass inputs variable file
like below.
# create infrastructure for DEV env
$ terraform apply --var-file=inputs-dev.tf
# create infrastructure for PROD env
$ terraform apply --var-file=inputs-prod.tf
Note: With this approach we can achieve loosely coupling and we can achieve script
re-usability.
=========================
Workspace in terraform
=========================
=> To manage infrastructure for multiple environments we will use Terraform
workspace concept.
=> When we use workspace, it will maintain seperate state file for every
environment/workspace.
Note: We can execute same script for multiple environments.
$ terraform workspace show
$ terraform workspace new dev
$ terraform workspace new qa
$ terraform workspace new uat
$ terraform workspace new prod
$ terraform worksapce list
$ terraform workspace select dev
==================================
Working with terraform workspaces
==================================
Step-1: Create Terraform Project
Step-2: Create provider.tf file and configure provider details
Step-3: Create input variables files based on environments and configure variable
values.
Ex :
dev.tfvars
qa.tfvars
prod.tfvars
Step-4 : Create main resources script file
Step-6 : Create outputs variable file
Step-7 : Create Workspaces
$ terraform workspace new dev
$ terraform workspace new qa
Step-8 : Select workspace
$ terraform workspace select dev
Step-9 : Run script and check state files
$ terraform apply --var-file=dev.tfvars
Note: When we use workspaces concept, it will maintain seperate state file for
every environment.
Step-9 : switch to qa workspace and run the script
$ terraform workspace select qa
$ terraform apply --var-file=qa.tfvars
=======================================
What is taint and untaint in terraform
=======================================
=> Terraform "taint" is used to replace the resource when we apply the script next
time.
=> For example we have created two resources like below
resource "aws_instance" "vm1"{
// configuration
}
resource "aws_s3_bucket" "abt1"{
// configuration
}
=> After sometime we realized that ec2 vm got damaged then we can taint that ec2 vm
using below command.
$ terraform taint aws_instance.vm1
$ terraform apply --auto-approve
Note: The alternate for "taint" is "replace"
$ terraform apply -replace="aws_instance.vm1"
=========================
What is Terraform Vault
=========================
=> Provided by Hashicorp org.
=> It is used to manage secrets such as passwords, tokens, any sensitive inform
Ex:
====
1) While creating RDS instance we need to specify username and pwd
2) While creating iAM user we need to specify username and pwd
Note: IT is not recommended to configure those credentials in script directley.
=> Vault allows you to store and manage secrets securely, reducing the risk of
exposing sensitive data in your Terraform configurations.
===================
Vault Server Setup
===================
Documentation :
https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-
install
@@ Step-1 :: Create EC2 Instance (Ubuntu AMI) and connect with that
@@ Step-2 :: Install Vault on the EC2 instance
# Install gpg
sudo apt update && sudo apt install gpg
# Download the signing key to a new keyring
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o
/usr/share/keyrings/hashicorp-archive-keyring.gpg
# Verify the key's fingerprint
gpg --no-default-keyring --keyring /usr/share/keyrings/hashicorp-archive-
keyring.gpg --fingerprint
# add Hashicorp repo to pkg manager
echo "deb [arch=$(dpkg --print-architecture)
signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee
/etc/apt/sources.list.d/hashicorp.list
# update packages
sudo apt update
# install vault
sudo apt install vault
@@ Step-3 :: Start the vault server (It runs on port number 8200)
$ vault server -dev -dev-listen-address="0.0.0.0:8200"
@@ Step-4 :: Access Vault server UI dashboard (enable 8200 port in inbound rules)
@@ Step-5 : Enable Secret Engine (KV) & create secret and store the data
@@ Step-6 : Connect with Vault server from different ssh terminal
@@ Step-7 : Export Vault addr & Enable approle
$ export VAULT_ADDR='http://0.0.0.0:8200'
$ vault auth enable approle
@@ Step-8 : Create Policy
---------------------------------------------
vault policy write terraform - <<EOF
path "*" {
capabilities = ["list", "read"]
}
path "secrets/data/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "kv/data/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/data/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "auth/token/create" {
capabilities = ["create", "read", "update", "list"]
}
EOF
------------------------------------------
@@ Step-9 : Create Role
-----------------------------------------
vault write auth/approle/role/terraform \
secret_id_ttl=10m \
token_num_uses=10 \
token_ttl=20m \
token_max_ttl=30m \
secret_id_num_uses=40 \
token_policies=terraform
----------------------------------------
@@ Step-10 : Generate Role_ID and Secret_ID and copy them
$ vault read auth/approle/role/terraform/role-id
$ vault write -f auth/approle/role/terraform/secret-id
@@ Step-11 : Write terraform script and read data from terraform vault server
------------------------------------------------------
provider "aws" {
region = "ap-south-1"
access_key = ""
secret_key = ""
}
provider "vault" {
address = "http://public-ip:8200"
skip_child_token = true
auth_login {
path = "auth/approle/login"
parameters = {
role_id = "<>"
secret_id = "<>"
}
}
}
data "vault_kv_secret_v2" "example" {
mount = "kv"
name = "test-secret"
}
resource "aws_instance" "ashokit_vm" {
ami = "ami-08718895af4dfa033"
instance_type = "t2.micro"
tags = {
Secret = data.vault_kv_secret_v2.example.data["tagname"]
}
}
-----------------------------------------------------------------------------------
---
Assignment : Create AWS RDS instance by reading db_username and db_pwd from Vault
Server.
-----------------------------------------------------------------------------------
---
========================
Terraform Summary
========================
1) Infrastructure as code (IAC)
2) Terraform Introduction
3) Terraform Setup (Windows)
4) Terraform Architecture
5) Terraform Scripts using HCL
6) Variables (input & output)
7) Terraform modules
8) Project Environments
9) Terraform Workspaces
10) Resource taint or replace
11) Terraform Vault
