Terraform入門｜Infrastructure as CodeでAWSインフラをコード化する基礎ハンズオン

この記事のポイント

・TerraformはHCLでAWSインフラを宣言的にコード化できるIaCツール
・tfstateで状態を管理し、S3+DynamoDBでチーム共有するのが実務の基本
・terraform importで既存リソースをTerraformのstate管理に取り込める
・plan/apply失敗の多くは依存関係・権限・tfstate不整合が原因

# main.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"  # 東京リージョン
}

# EC2インスタンスを定義する例
resource "aws_instance" "web_server" {
  ami           = "ami-0d52744d6551d851e"  # Amazon Linux 2023 (ap-northeast-1)
  instance_type = "t3.micro"

  tags = {
    Name = "web-server"
    Env  = "dev"
  }
}

# variables.tf
variable "env" {
  description = "環境名 (dev/stg/prd)"
  type        = string
  default     = "dev"
}

variable "instance_type" {
  description = "EC2インスタンスタイプ"
  type        = string
  default     = "t3.micro"
}

# main.tfでの参照
resource "aws_instance" "web_server" {
  instance_type = var.instance_type

  tags = {
    Env = var.env
  }
}

# outputs.tf
output "instance_public_ip" {
  description = "EC2インスタンスのパブリックIP"
  value       = aws_instance.web_server.public_ip
}

# 実行後に確認する
# $ terraform output instance_public_ip
# "54.xxx.xxx.xxx"

# backend.tf
terraform {
  backend "s3" {
    bucket         = "my-terraform-state-bucket"
    key            = "dev/terraform.tfstate"
    region         = "ap-northeast-1"
    dynamodb_table = "terraform-state-lock"  # ロック用テーブル
    encrypt        = true                    # 暗号化を必ず有効化
  }
}

# backend設定後は必ずinitを実行
$ terraform init

# ローカルtfstateをS3へ移行するか確認される
# "Do you want to copy existing state to the new backend?" → yes

# main.tf（初期状態。属性は後でplanを見ながら埋める）
resource "aws_instance" "web" {
  # importを実行するためにブロックは必要。中身は後から補完する
}

# EC2インスタンスのIDをCLIで確認
$ aws ec2 describe-instances --filters "Name=tag:Name,Values=web-server"   --query "Reservations[*].Instances[*].InstanceId" --output text
i-0a1b2c3d4e5f67890

# importを実行
$ terraform import aws_instance.web i-0a1b2c3d4e5f67890
aws_instance.web: Importing from ID "i-0a1b2c3d4e5f67890"...
aws_instance.web: Import prepared!
  Prepared aws_instance for import
aws_instance.web: Refreshing state... [id=i-0a1b2c3d4e5f67890]

Import successful!

# main.tf（差分を埋めた後の状態）
resource "aws_instance" "web" {
  ami           = "ami-0c3fd0f5d33134a76"
  instance_type = "t3.micro"

  tags = {
    Name = "web-server"
  }

  root_block_device {
    volume_type = "gp3"
    volume_size = 20
    encrypted   = false
  }
}

# 差分がゼロになった状態
# $ terraform plan
# No changes. Your infrastructure matches the configuration.

resource "aws_instance" "web" {
  ami           = "ami-0c3fd0f5d33134a76"
  instance_type = "t3.micro"

  lifecycle {
    # AMIは手動での変更を許容し、Terraformによる変更検知を無視する
    ignore_changes = [ami, user_data]
  }
}

# import.tf（Terraform 1.5以降の記法）
import {
  to = aws_instance.web
  id = "i-0a1b2c3d4e5f67890"
}

import {
  to = aws_s3_bucket.assets
  id = "my-assets-bucket-20240501"
}

import {
  to = aws_security_group.web_sg
  id = "sg-0abc123def456789a"
}

# HCLの雛形を自動生成する（生成したコードは必ず見直すこと）
$ terraform plan -generate-config-out=generated.tf

terraform-project/
├── modules/           # 再利用可能なモジュール群
│   ├── vpc/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   └── ec2/
│       ├── main.tf
│       ├── variables.tf
│       └── outputs.tf
├── environments/      # 環境ごとの設定
│   ├── dev/
│   │   ├── main.tf    # モジュールの呼び出しと変数の注入
│   │   └── backend.tf
│   └── prd/
│       ├── main.tf
│       └── backend.tf

# environments/dev/main.tf
module "vpc" {
  source      = "../../modules/vpc"
  env         = "dev"
  cidr_block  = "10.0.0.0/16"
}

module "ec2" {
  source        = "../../modules/ec2"
  env           = "dev"
  vpc_id        = module.vpc.vpc_id    # VPCモジュールのoutputを参照
  instance_type = "t3.micro"
}

# Terraformのバージョン確認
$ terraform version
Terraform v1.8.5
on linux_amd64

# AWS CLIの認証確認
$ aws sts get-caller-identity
{
    "UserId": "AIDAXXXXXXXXXXXXXXXXX",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/terraform-user"
}

# プロジェクトディレクトリで初期化
$ terraform init

Initializing the backend...
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 5.0"...
- Installing hashicorp/aws v5.54.1...

Terraform has been successfully initialized!

# vpc.tf

# VPC本体
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "main-vpc"
    Env  = var.env
  }
}

# パブリックサブネット（ap-northeast-1a）
resource "aws_subnet" "public_1a" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "ap-northeast-1a"
  map_public_ip_on_launch = true

  tags = {
    Name = "public-subnet-1a"
    Env  = var.env
  }
}

# インターネットゲートウェイ
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "main-igw"
    Env  = var.env
  }
}

# ルートテーブル（パブリックサブネット用）
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = "public-rt"
    Env  = var.env
  }
}

# サブネットとルートテーブルの関連付け
resource "aws_route_table_association" "public_1a" {
  subnet_id      = aws_subnet.public_1a.id
  route_table_id = aws_route_table.public.id
}

# ec2.tf

# セキュリティグループ
resource "aws_security_group" "web" {
  name        = "web-sg"
  description = "Allow HTTP and SSH"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["xxx.xxx.xxx.xxx/32"]  # 自分のIPのみ許可
  }

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "web-sg"
    Env  = var.env
  }
}

# EC2インスタンス
resource "aws_instance" "web" {
  ami                    = "ami-0d52744d6551d851e"  # Amazon Linux 2023
  instance_type          = var.instance_type
  subnet_id              = aws_subnet.public_1a.id
  vpc_security_group_ids = [aws_security_group.web.id]
  key_name               = "my-key-pair"  # 事前にAWSで作成したキーペア名

  tags = {
    Name = "web-server"
    Env  = var.env
  }
}

# 差分の確認（AWSへの変更は行われない）
$ terraform plan

Terraform will perform the following actions:

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami           = "ami-0d52744d6551d851e"
      + instance_type = "t3.micro"
      ...
    }

Plan: 6 to add, 0 to change, 0 to destroy.

# 問題なければ適用
$ terraform apply

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_vpc.main: Creating...
aws_vpc.main: Creation complete after 2s [id=vpc-0a1b2c3d4e5f6789]
...

Apply complete! Resources: 6 added, 0 changed, 0 destroyed.

Outputs:
instance_public_ip = "54.xxx.xxx.xxx"

# 全リソースの削除（本番環境では絶対に間違えないこと）
$ terraform destroy

Plan: 0 to add, 0 to change, 6 to destroy.

Do you really want to destroy all resources?
  Enter a value: yes

Destroy complete! Resources: 6 destroyed.

# 対処: AWS CLIの認証設定を確認
$ aws configure list
      Name                    Value             Type    Location
      ----                    -----             ----    --------
   profile                             None    None
access_key     ****************XXXX shared-credentials-file
secret_key     ****************XXXX shared-credentials-file
    region           ap-northeast-1      config-file    ~/.aws/config

# 認証情報が未設定の場合
$ aws configure
AWS Access Key ID [None]: AKIAXXXXXXXXXXXXXXXXX
AWS Secret Access Key [None]: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Default region name [None]: ap-northeast-1

# エラーメッセージ例
Error: Error locking state: Error acquiring the state lock

# 対処: ロックを強制解除（前のapplyが本当に完了または失敗したことを確認してから実行）
$ terraform force-unlock LOCK_ID

# LOCK_IDはエラーメッセージ中に表示される
# 例: "ID: 12345678-1234-1234-1234-123456789012"

# NG例: リソース名が一致していない
resource "aws_instance" "web_server" {
  subnet_id = aws_subnet.public.id  # "public"というサブネットは存在しない
}

# OK例: 定義したリソース名と一致させる
resource "aws_subnet" "public_1a" { ... }

resource "aws_instance" "web_server" {
  subnet_id = aws_subnet.public_1a.id  # 正しく参照
}

Error: Resource already managed by Terraform

Terraform is already managing a remote object for aws_instance.web.
To import to this address you must first remove the existing object from the state.

# 対処: stateの状態を確認し、誤ったimportであればstateから削除してやり直す
$ terraform state list
aws_instance.web

$ terraform state rm aws_instance.web
Removed aws_instance.web
Successfully removed 1 resource instance(s).

# 削除後に正しいリソースIDで再import
$ terraform import aws_instance.web i-0XXXXXXXXXXXXXXXX

# 実リソースの現状をtfstateに取り込む（plan前に状態を同期）
$ terraform refresh

# または planで差分を確認（refreshが自動で行われる）
$ terraform plan

# stateの実際の属性値を確認したい場合
$ terraform state show aws_instance.web