Terraform reference

Basic features of Terraform

Terraform is a tool that supports the automated orchestration of IT infrastructure. Terraform allows you to use code to manage and maintain IT resources. For more information, see What is Terraform?

• Terraform provides an easy-to-use CLI that allows you to deploy configuration files on Alibaba Cloud or third-party clouds and manage the versions of the configuration files. Terraform allows you to define the infrastructure resources that are required to build cloud topologies in configuration files. The resources include virtual machines (VMs), storage accounts, and network interfaces.

• Terraform can be integrated with the Alibaba Cloud provider to support new infrastructure. You can use a template to configure the Alibaba Cloud provider to define, preview, and deploy cloud infrastructure on Alibaba Cloud.

• You can use Terraform to create, modify, and delete the resources of multiple Alibaba Cloud services.

For information about how to integrate Alibaba Cloud services with Terraform, see Alibaba Cloud Provider.

Install Terraform

terraform

echo $PATH

mv ~/Downloads/terraform /usr/local/bin/

git clone https://github.com/hashicorp/terraform.git

cd terraform

go install

echo $PATH

mv ~/Downloads/terraform /usr/local/bin/

brew tap hashicorp/tap

brew install hashicorp/tap/terraform

brew update

brew upgrade hashicorp/tap/terraform

yum install -y dnf-plugin-releasever-adapter
yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
yum install terraform

choco install terraform

Authenticate Terraform

You can store access credentials in specific environment variables and use the environment variables to authenticate Terraform. When you run a Terraform command, if no access credential is explicitly declared in the configuration template, Terraform can obtain access credentials from environment variables. Configure the environment variables based on the operating system.

# Access Key Id
$ export ALICLOUD_ACCESS_KEY="yourAccessKeyID"
# Access Key Secret
$ export ALICLOUD_SECRET_KEY="yourAccessKeySecret"
# If you use an STS token, set the ALICLOUD_SECURITY_TOKEN environment variable to the STS token.
$ export ALICLOUD_SECURITY_TOKEN="yourSTStoken"

After you configure environment variables, you do not need to explicitly declare access credentials or you can declare only the region ID in the provider code block of the configuration template.

provider "alicloud" {
  region = "cn-hangzhou"
}

You can also specify the region ID by using the ALICLOUD_REGION environment variable. If no region ID is declared and the ALICLOUD_REGION environment variable is not configured, cn-beijing is used as the value of the region parameter.

Supported resources

Use Terraform to create and manage ECS resources

This section describes how to create an ECS instance by using Terraform.

1. Create a working directory and a configuration file named main.tf in the directory. The following code is used to create an ECS instance and the virtual private cloud (VPC), security group, and vSwitch that are required to create the ECS instance. Copy the following code to the main.tf configuration file:

   # Define a variable named region to represent an Alibaba Cloud region. The default value of this variable is cn-beijing.
   variable "region"{
     default = "cn-beijing"
   }
   
   # Configure the Alibaba Cloud provider and specify the region defined in the region variable.
   provider "alicloud"{
     region = var.region
   }
   
   # Define a string variable named instance_type to represent an ECS instance type. The default value of this variable is ecs.e-c1m1.large.
   variable "instance_type" {
     type    = string
     default = "ecs.e-c1m1.large"
   }
   
   # Use a data source and configure the specified instance type, resource type (such as vSwitch), and disk category as filters to query zones in which you can create ECS instances.
   data "alicloud_zones" "default" {
     available_instance_type     = var.instance_type
     available_resource_creation = "VSwitch"
     available_disk_category     = "cloud_essd"
   }
   
   # Define a variable named vpc_cidr_block to represent the CIDR block that you want to associate with a VPC. The default value of this variable is 172.16.0.0/16.
   variable "vpc_cidr_block" {
     default = "172.16.0.0/16"
   }
   
   # Define a variable named vsw_cidr_block to represent the CIDR block that you want to associate with a vSwitch. The default value of this variable is 172.16.0.0/24.
   variable "vsw_cidr_block" {
     default = "172.16.0.0/24"
   }
   
   # Generate a random integer from 10000 to 99999 to ensure the uniqueness of certain resource names.
   resource "random_integer" "default" {
     min = 10000
     max = 99999
   }
   
   # Create a VPC named vpc-test and use a random integer to ensure the uniqueness of the name.
   resource "alicloud_vpc" "vpc" {
     vpc_name   = "vpc-test_${random_integer.default.result}"
     cidr_block = var.vpc_cidr_block
   }
   
   # Create a security group in the created VPC and use a random integer to ensure the uniqueness of the security group name.
   resource "alicloud_security_group" "group" {
     security_group_name = "test_${random_integer.default.result}"  # Replace test_$ with an actual value.
     vpc_id              = alicloud_vpc.vpc.id
   }
   
   # Create an inbound security group rule that allows all TCP traffic in the created security group.
   resource "alicloud_security_group_rule" "allow_all_tcp" {
     type              = "ingress"
     ip_protocol       = "tcp"
     nic_type          = "intranet"  # Set the nic_type parameter to 'intranet'.
     policy            = "accept"
     port_range        = "1/65535"
     priority          = 1
     security_group_id = alicloud_security_group.group.id
     cidr_ip           = "0.0.0.0/0"
   }
   
   # Create a vSwitch in the specified zone and the created VPC and use a random integer to ensure the uniqueness of the vSwitch name.
   resource "alicloud_vswitch" "vswitch" {
     vpc_id       = alicloud_vpc.vpc.id
     cidr_block   = var.vsw_cidr_block
     zone_id      = data.alicloud_zones.default.zones[0].id
     vswitch_name = "vswitch-test-${random_integer.default.result}"
   }
   
   # Specify multiple parameters, including the zone, security group, and instance type, to create an ECS instance and use a random integer to ensure the uniqueness of the instance name.
   resource "alicloud_instance" "instance" {
     availability_zone          = data.alicloud_zones.default.zones[0].id
     security_groups            = [alicloud_security_group.group.id]
     instance_type              = var.instance_type
     system_disk_category       = "cloud_essd"
     system_disk_name           = "test_foo_system_disk_${random_integer.default.result}"
     system_disk_description    = "test_foo_system_disk_description"
     image_id                   = "aliyun_2_1903_x64_20G_alibase_20240628.vhd"
     instance_name              = "test_ecs_${random_integer.default.result}"
     vswitch_id                 = alicloud_vswitch.vswitch.id
     internet_max_bandwidth_out = 10
     password                   = "Terraform@Example" # Configure a password for the ECS instance. Replace Terraform@Example with an actual value.
   }

2. Run the following command to initialize the Terraform runtime environment:

   terraform init

   The following command output indicates that Terraform is initialized:

   Terraform has been successfully initialized!
   
   You may now begin working with Terraform. Try running "terraform plan" to see
   any changes that are required for your infrastructure. All Terraform commands
   should now work.
   
   If you ever set or change modules or backend configuration for Terraform,
   rerun this command to reinitialize your working directory. If you forget, other
   commands will detect it and remind you to do so if necessary.

3. Run the following command to run the code:

   terraform apply

   During the code execution, enter yes as prompted and press the Enter key. Wait until the execution is complete. The following command output indicates that the code is run:

   You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.
   
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: yes
   
   
   Apply complete!  Resources: 6 added, 0 changed, 0 destroyed.

4. Verify the results

terraform show

References

• For information about Terraform use cases, see Best Practices.

• For information about common Terraform commands, see Common commands.

• Terraform is available as a managed service in ROS. You can deploy Terraform templates in the ROS console. For more information, see Create a Terraform stack.