Terraform, 테라 폼 미쳤다

# "S3 버킷이 하나 있어야 한다"고 선언
resource "aws_s3_bucket" "my_bucket" {
  bucket = "my-awesome-bucket"
}

# AWS Provider 설정
provider "aws" {
  region = "ap-northeast-2"  # 서울 리전
}

resource "aws_s3_bucket" "frontend_assets" {
  bucket = "my-frontend-assets"

  tags = {
    Environment = "production"
    Team        = "frontend"
  }
}

# variables.tf
variable "environment" {
  description = "배포 환경"
  type        = string
  default     = "dev"
}

variable "bucket_name" {
  description = "S3 버킷 이름"
  type        = string
}

# main.tf
resource "aws_s3_bucket" "assets" {
  bucket = "${var.bucket_name}-${var.environment}"

  tags = {
    Environment = var.environment
  }
}

# outputs.tf
output "bucket_arn" {
  description = "생성된 S3 버킷의 ARN"
  value       = aws_s3_bucket.assets.arn
}

# modules/s3-static-site/main.tf
resource "aws_s3_bucket" "this" {
  bucket = var.bucket_name
}

resource "aws_cloudfront_distribution" "this" {
  origin {
    domain_name = aws_s3_bucket.this.bucket_regional_domain_name
    origin_id   = "S3-${var.bucket_name}"
  }
  # ... CloudFront 설정
}

# 사용하는 쪽
module "production_site" {
  source      = "./modules/s3-static-site"
  bucket_name = "my-prod-site"
}

module "staging_site" {
  source      = "./modules/s3-static-site"
  bucket_name = "my-staging-site"
}

infra/
├── main.tf          # 메인 리소스 정의
├── variables.tf     # 변수 정의
├── outputs.tf       # 출력값 정의
├── provider.tf      # Provider 설정
└── terraform.tfvars # 변수 값 (Git ignore)

# provider.tf
terraform {
  required_version = ">= 1.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

# main.tf

# 정적 파일을 저장할 S3 버킷
resource "aws_s3_bucket" "frontend" {
  bucket = var.bucket_name
}

# 버킷 퍼블릭 액세스 차단 (CloudFront 통해서만 접근)
resource "aws_s3_bucket_public_access_block" "frontend" {
  bucket = aws_s3_bucket.frontend.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# CloudFront에서 S3에 접근할 수 있도록 OAC 설정
resource "aws_cloudfront_origin_access_control" "frontend" {
  name                              = "${var.bucket_name}-oac"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

# CloudFront 배포
resource "aws_cloudfront_distribution" "frontend" {
  origin {
    domain_name              = aws_s3_bucket.frontend.bucket_regional_domain_name
    origin_id                = "S3-${var.bucket_name}"
    origin_access_control_id = aws_cloudfront_origin_access_control.frontend.id
  }

  enabled             = true
  default_root_object = "index.html"

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "S3-${var.bucket_name}"

    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }

  # SPA 라우팅을 위한 커스텀 에러 응답
  custom_error_response {
    error_code         = 403
    response_code      = 200
    response_page_path = "/index.html"
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}

# variables.tf
variable "aws_region" {
  description = "AWS 리전"
  type        = string
  default     = "ap-northeast-2"
}

variable "bucket_name" {
  description = "S3 버킷 이름"
  type        = string
}

# outputs.tf
output "cloudfront_domain" {
  description = "CloudFront 배포 도메인"
  value       = aws_cloudfront_distribution.frontend.domain_name
}

output "s3_bucket_name" {
  description = "S3 버킷 이름"
  value       = aws_s3_bucket.frontend.id
}

# 초기화 (Provider 플러그인 다운로드)
terraform init

# 변경 사항 미리 확인
terraform plan -var="bucket_name=my-frontend-site"

# 실제 적용
terraform apply -var="bucket_name=my-frontend-site"

# 삭제하고 싶을 때
terraform destroy

# .github/workflows/terraform.yml
name: Terraform

on:
  pull_request:
    paths:
      - 'infra/**'
  push:
    branches:
      - main
    paths:
      - 'infra/**'

env:
  AWS_REGION: ap-northeast-2
  TF_WORKING_DIR: infra

jobs:
  plan:
    name: Terraform Plan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.7.0

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Terraform Init
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform init

      - name: Terraform Plan
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform plan -no-color
        id: plan

      - name: PR에 Plan 결과 코멘트
        uses: actions/github-script@v7
        with:
          script: |
            const output = `#### Terraform Plan 📋
            \`\`\`
            ${{ steps.plan.outputs.stdout }}
            \`\`\`
            `;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            });

  apply:
    name: Terraform Apply
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'

    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.7.0

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Terraform Init
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform init

      - name: Terraform Apply
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform apply -auto-approve

# backend.tf
terraform {
  backend "s3" {
    bucket         = "my-team-terraform-state"
    key            = "frontend/terraform.tfstate"
    region         = "ap-northeast-2"
    dynamodb_table = "terraform-lock"
    encrypt        = true
  }
}

# Workspace 생성
terraform workspace new staging
terraform workspace new production

# Workspace 전환
terraform workspace select staging

# 현재 Workspace 확인
terraform workspace show

resource "aws_s3_bucket" "frontend" {
  bucket = "my-site-${terraform.workspace}"
  # staging이면 "my-site-staging"
  # production이면 "my-site-production"
}