Terraform -環境構築-

# 目的
terraformを使用し、同じ構成の環境を作成する

## 構成図
![terraform1.png](https://qiita-image-store.s3.amazonaws.com/0/58788/d9821909-1b19-999c-f5d6-0dad1a4ea991.png)


# 方法
環境毎にパラメータ編集しやすいようにテンプレートファイルを機能毎に作成する。

# 設定
## Templates
* config.tf

```bash
///config

provider "aws" {
    access_key = "${var.access_key}"
    secret_key = "${var.secret_key}"
    region = "${var.region}"
}
```

* eip.tf

```bash
/// eip allocate
resource "aws_eip" "natgw" {
    vpc = true
}
```

* igw.tf

```bash
resource "aws_internet_gateway" "practice2-igw" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    tags {
      Name = "practice2-igw"
    }
}
```

* instance.tf

```bash
/// bastion-server作成

resource "aws_instance" "bastion" {
    ami = "ami-0c11b26d"
    instance_type = "t2.nano"
    key_name = "xxxxxx"
    security_groups = ["${aws_security_group.ssh-limited.id}"]
    subnet_id = "${aws_subnet.practice2-dmz-1a.id}"
    tags {
        Name = "bastion"
    }
}
```

* nat-gw.tf

```bash
resource "aws_nat_gateway" "practice2-natgw" {
    allocation_id = "${aws_eip.natgw.id}"
    subnet_id = "${aws_subnet.practice2-dmz-1a.id}"
}
```

* output.tf

```bash
/// instanceとNatGatewayに使われるGIPをoutputさせる
output "eip.natgw.id" {
  value = "${aws_eip.natgw.id}"
}

output "public ip of bastion" {
  value = "${aws_instance.bastion.public_ip}"
}
```

* routetable.tf

```bash
/// dmz-1a routetable
resource "aws_route_table" "practice2-dmz-1a" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    route {
        cidr_block = "0.0.0.0/0"
        gateway_id = "${aws_internet_gateway.practice2-igw.id}"
    }
    tags {
      Name = "practice2-dmz-1a"
    }
}

/// dmz-1c routetable
resource "aws_route_table" "practice2-dmz-1c" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    route {
        cidr_block = "0.0.0.0/0"
        gateway_id = "${aws_internet_gateway.practice2-igw.id}"
    }
    tags {
      Name = "practice2-dmz-1c"
    }
}

/// trust-1a routetable
resource "aws_route_table" "practice2-trust-1a" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    route {
        cidr_block = "0.0.0.0/0"
        nat_gateway_id = "${aws_nat_gateway.practice2-natgw.id}"
    }
    tags {
      Name = "practice2-trust-1a"
    }
}

/// trust-1c routetable
resource "aws_route_table" "practice2-trust-1c" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    route {
        cidr_block = "0.0.0.0/0"
        nat_gateway_id = "${aws_nat_gateway.practice2-natgw.id}"
    }
    tags {
      Name = "practice2-trust-1c"
    }
}

/// practice2-dmz-1aを関連付け
resource "aws_route_table_association" "practice2-dmz-1a" {
    subnet_id = "${aws_subnet.practice2-dmz-1a.id}"
    route_table_id = "${aws_route_table.practice2-dmz-1a.id}"
}

/// practice2-dmz-1cを関連付け
resource "aws_route_table_association" "practice2-dmz-1c" {
    subnet_id = "${aws_subnet.practice2-dmz-1c.id}"
    route_table_id = "${aws_route_table.practice2-dmz-1c.id}"
}

/// practice2-trust-1aを関連付け
resource "aws_route_table_association" "practice2-trust-1a" {
    subnet_id = "${aws_subnet.practice2-trust-1a.id}"
    route_table_id = "${aws_route_table.practice2-trust-1a.id}"
}

/// practice2-trust-1cを関連付け
resource "aws_route_table_association" "practice2-trust-1c" {
    subnet_id = "${aws_subnet.practice2-trust-1c.id}"
    route_table_id = "${aws_route_table.practice2-trust-1c.id}"
}
```

* security-g.tf

```bash
resource "aws_security_group" "ssh-limited" {
  vpc_id = "${aws_vpc.practice2-vpc.id}"
  name = "ssh-limited"
  description = "ssh_limited inbound traffic"

  ingress {
      from_port = 22
      to_port = 22
      protocol = "tcp"
      cidr_blocks = ["***.***.***.***/32"]
  }
  egress {
      from_port = 0
      to_port = 0
      protocol = "-1"
      cidr_blocks = ["0.0.0.0/0"]
  }

  tags {
    Name = "ssh-limited"
  }
}
```

* subnet.tf

```bash
/// dmz-1a subnet新規作成
resource "aws_subnet" "practice2-dmz-1a" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    cidr_block = "10.0.0.0/24"
    map_public_ip_on_launch = "true" # dmzで起動するインスタンスはPublicIPを持たす
    availability_zone = "ap-northeast-1a"
    tags {
      Name = "practice2-dmz-1a"
    }
}

/// dmz-1c subnet新規作成
resource "aws_subnet" "practice2-dmz-1c" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    cidr_block = "10.0.1.0/24"
    map_public_ip_on_launch = "true" # dmzで起動するインスタンスはPublicIPを持たす
    availability_zone = "ap-northeast-1c"
    tags {
      Name = "practice2-dmz-1c"
    }
}

/// trust-1a subnet新規作成
resource "aws_subnet" "practice2-trust-1a" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    cidr_block = "10.0.2.0/24"
    availability_zone = "ap-northeast-1a"
    tags {
      Name = "practice2-trust-1a"
    }
}

/// trust-1c subnet新規作成
resource "aws_subnet" "practice2-trust-1c" {
    vpc_id = "${aws_vpc.practice2-vpc.id}"
    cidr_block = "10.0.3.0/24"
    availability_zone = "ap-northeast-1c"
    tags {
      Name = "practice2-trust-1c"
    }
}
```

* terraform.tfvars

```bash
///iam-user-key

access_key = "********"
secret_key = "***************"
```

* variables.tf

```bash
variable "access_key" {}
variable "secret_key" {}
variable "region" {
    default = "ap-northeast-1"
}
```

* vpc.tf

```bash
resource "aws_vpc" "practice2-vpc" {
    cidr_block = "10.0.0.0/16"
    instance_tenancy = "default"
    enable_dns_support = "true"
    enable_dns_hostnames = "true" #インスタンスがdns-nameを持つようにする
    tags {
      Name = "practice2-vpc"
    }
}
```

# DryRun

* エラーが無いことを確認する

```bash
$ terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but
will not be persisted to local or remote state storage.


The Terraform execution plan has been generated and is shown below.
Resources are shown in alphabetical order for quick scanning. Green resources
will be created (or destroyed and then created if an existing resource
exists), yellow resources are being changed in-place, and red resources
will be destroyed. Cyan entries are data sources to be read.

Note: You didn't specify an "-out" parameter to save this plan, so when
"apply" is called, Terraform can't guarantee this is what will execute.

+ aws_eip.natgw
    allocation_id:     "<computed>"
    association_id:    "<computed>"
    domain:            "<computed>"
    instance:          "<computed>"
    network_interface: "<computed>"
    private_ip:        "<computed>"
    public_ip:         "<computed>"
    vpc:               "true"

+ aws_instance.stg-bastion
    ami:                         "ami-0c11b26d"
    associate_public_ip_address: "<computed>"
    availability_zone:           "<computed>"
    ebs_block_device.#:          "<computed>"
    ephemeral_block_device.#:    "<computed>"
    instance_state:              "<computed>"
    instance_type:               "t2.nano"
    key_name:                    "**********"
    network_interface_id:        "<computed>"
    placement_group:             "<computed>"
    private_dns:                 "<computed>"
    private_ip:                  "<computed>"
    public_dns:                  "<computed>"
    public_ip:                   "<computed>"
    root_block_device.#:         "<computed>"
    security_groups.#:           "<computed>"
    source_dest_check:           "true"
    subnet_id:                   "<computed>"
    tags.%:                      "1"
    tags.Name:                   "bastion"
    tenancy:                     "<computed>"
    vpc_security_group_ids.#:    "<computed>"

+ aws_internet_gateway.practice2-igw
    tags.%:    "1"
    tags.Name: "practice2-igw"
    vpc_id:    "<computed>"

+ aws_nat_gateway.practice2-natgw
    allocation_id:        "<computed>"
    network_interface_id: "<computed>"
    private_ip:           "<computed>"
    public_ip:            "<computed>"
    subnet_id:            "<computed>"

+ aws_route_table.practice2-dmz-1a
    route.#:                                     "1"
    route.~2406728767.cidr_block:                "0.0.0.0/0"
    route.~2406728767.gateway_id:                "<computed>"
    route.~2406728767.instance_id:               ""
    route.~2406728767.nat_gateway_id:            ""
    route.~2406728767.network_interface_id:      ""
    route.~2406728767.vpc_peering_connection_id: ""
    tags.%:                                      "1"
    tags.Name:                                   "practice2-dmz-1a"
    vpc_id:                                      "<computed>"

+ aws_route_table.practice2-dmz-1c
    route.#:                                     "1"
    route.~2406728767.cidr_block:                "0.0.0.0/0"
    route.~2406728767.gateway_id:                "<computed>"
    route.~2406728767.instance_id:               ""
    route.~2406728767.nat_gateway_id:            ""
    route.~2406728767.network_interface_id:      ""
    route.~2406728767.vpc_peering_connection_id: ""
    tags.%:                                      "1"
    tags.Name:                                   "practice2-dmz-1c"
    vpc_id:                                      "<computed>"

+ aws_route_table.practice2-trust-1a
    route.#:                                     "1"
    route.~2120687611.cidr_block:                "0.0.0.0/0"
    route.~2120687611.gateway_id:                ""
    route.~2120687611.instance_id:               ""
    route.~2120687611.nat_gateway_id:            "<computed>"
    route.~2120687611.network_interface_id:      ""
    route.~2120687611.vpc_peering_connection_id: ""
    tags.%:                                      "1"
    tags.Name:                                   "practice2-trust-1a"
    vpc_id:                                      "<computed>"

+ aws_route_table.practice2-trust-1c
    route.#:                                     "1"
    route.~2120687611.cidr_block:                "0.0.0.0/0"
    route.~2120687611.gateway_id:                ""
    route.~2120687611.instance_id:               ""
    route.~2120687611.nat_gateway_id:            "<computed>"
    route.~2120687611.network_interface_id:      ""
    route.~2120687611.vpc_peering_connection_id: ""
    tags.%:                                      "1"
    tags.Name:                                   "practice2-trust-1c"
    vpc_id:                                      "<computed>"

+ aws_route_table_association.practice2-dmz-1a
    route_table_id: "<computed>"
    subnet_id:      "<computed>"

+ aws_route_table_association.practice2-dmz-1c
    route_table_id: "<computed>"
    subnet_id:      "<computed>"

+ aws_route_table_association.practice2-trust-1a
    route_table_id: "<computed>"
    subnet_id:      "<computed>"

+ aws_route_table_association.practice2-trust-1c
    route_table_id: "<computed>"
    subnet_id:      "<computed>"

+ aws_security_group.ssh-limited
    description:                          "ssh_limited inbound traffic"
    egress.#:                             "1"
    egress.482069346.cidr_blocks.#:       "1"
    egress.482069346.cidr_blocks.0:       "0.0.0.0/0"
    egress.482069346.from_port:           "0"
    egress.482069346.prefix_list_ids.#:   "0"
    egress.482069346.protocol:            "-1"
    egress.482069346.security_groups.#:   "0"
    egress.482069346.self:                "false"
    egress.482069346.to_port:             "0"
    ingress.#:                            "1"
    ingress.3925595496.cidr_blocks.#:     "1"
    ingress.3925595496.cidr_blocks.0:     "***.***.***.***./32"
    ingress.3925595496.from_port:         "22"
    ingress.3925595496.protocol:          "tcp"
    ingress.3925595496.security_groups.#: "0"
    ingress.3925595496.self:              "false"
    ingress.3925595496.to_port:           "22"
    name:                                 "ssh-limited"
    owner_id:                             "<computed>"
    tags.%:                               "1"
    tags.Name:                            "ssh-limited"
    vpc_id:                               "<computed>"

+ aws_subnet.practice2-dmz-1a
    availability_zone:       "ap-northeast-1a"
    cidr_block:              "10.0.0.0/24"
    map_public_ip_on_launch: "true"
    tags.%:                  "1"
    tags.Name:               "practice2-dmz-1a"
    vpc_id:                  "<computed>"

+ aws_subnet.practice2-dmz-1c
    availability_zone:       "ap-northeast-1c"
    cidr_block:              "10.0.1.0/24"
    map_public_ip_on_launch: "true"
    tags.%:                  "1"
    tags.Name:               "practice2-dmz-1c"
    vpc_id:                  "<computed>"

+ aws_subnet.practice2-trust-1a
    availability_zone:       "ap-northeast-1a"
    cidr_block:              "10.0.2.0/24"
    map_public_ip_on_launch: "false"
    tags.%:                  "1"
    tags.Name:               "practice2-trust-1a"
    vpc_id:                  "<computed>"

+ aws_subnet.practice2-trust-1c
    availability_zone:       "ap-northeast-1c"
    cidr_block:              "10.0.3.0/24"
    map_public_ip_on_launch: "false"
    tags.%:                  "1"
    tags.Name:               "practice2-trust-1c"
    vpc_id:                  "<computed>"

+ aws_vpc.practice2-vpc
    cidr_block:                "10.0.0.0/16"
    default_network_acl_id:    "<computed>"
    default_route_table_id:    "<computed>"
    default_security_group_id: "<computed>"
    dhcp_options_id:           "<computed>"
    enable_classiclink:        "<computed>"
    enable_dns_hostnames:      "true"
    enable_dns_support:        "true"
    instance_tenancy:          "default"
    main_route_table_id:       "<computed>"
    tags.%:                    "1"
    tags.Name:                 "practice2-vpc"


Plan: 18 to add, 0 to change, 0 to destroy.
```

# 実行

```bash
$ terraform apply
aws_eip.natgw: Creating...
  allocation_id:     "" => "<computed>"
  association_id:    "" => "<computed>"
  domain:            "" => "<computed>"
  instance:          "" => "<computed>"
  network_interface: "" => "<computed>"
  private_ip:        "" => "<computed>"
  public_ip:         "" => "<computed>"
  vpc:               "" => "true"
aws_vpc.practice2-vpc: Creating...
  cidr_block:                "" => "10.0.0.0/16"
  default_network_acl_id:    "" => "<computed>"
  default_route_table_id:    "" => "<computed>"
  default_security_group_id: "" => "<computed>"
  dhcp_options_id:           "" => "<computed>"
  enable_classiclink:        "" => "<computed>"
  enable_dns_hostnames:      "" => "true"
  enable_dns_support:        "" => "true"
  instance_tenancy:          "" => "default"
  main_route_table_id:       "" => "<computed>"
  tags.%:                    "" => "1"
  tags.Name:                 "" => "practice2-vpc"
aws_eip.natgw: Creation complete
aws_vpc.practice2-vpc: Creation complete
aws_internet_gateway.practice2-igw: Creating...
  tags.%:    "0" => "1"
  tags.Name: "" => "practice2-igw"
  vpc_id:    "" => "vpc-7e905e1a"
aws_subnet.practice2-trust-1a: Creating...
  availability_zone:       "" => "ap-northeast-1a"
  cidr_block:              "" => "10.0.2.0/24"
  map_public_ip_on_launch: "" => "false"
  tags.%:                  "" => "1"
  tags.Name:               "" => "practice2-trust-1a"
  vpc_id:                  "" => "vpc-7e905e1a"
aws_subnet.practice2-dmz-1c: Creating...
  availability_zone:       "" => "ap-northeast-1c"
  cidr_block:              "" => "10.0.1.0/24"
  map_public_ip_on_launch: "" => "true"
  tags.%:                  "" => "1"
  tags.Name:               "" => "practice2-dmz-1c"
  vpc_id:                  "" => "vpc-7e905e1a"
aws_subnet.practice2-trust-1c: Creating...
  availability_zone:       "" => "ap-northeast-1c"
  cidr_block:              "" => "10.0.3.0/24"
  map_public_ip_on_launch: "" => "false"
  tags.%:                  "" => "1"
  tags.Name:               "" => "practice2-trust-1c"
  vpc_id:                  "" => "vpc-7e905e1a"
aws_subnet.practice2-dmz-1a: Creating...
  availability_zone:       "" => "ap-northeast-1a"
  cidr_block:              "" => "10.0.0.0/24"
  map_public_ip_on_launch: "" => "true"
  tags.%:                  "" => "1"
  tags.Name:               "" => "practice2-dmz-1a"
  vpc_id:                  "" => "vpc-7e905e1a"
aws_security_group.ssh-limited: Creating...
  description:                          "" => "ssh_limited inbound traffic"
  egress.#:                             "" => "1"
  egress.482069346.cidr_blocks.#:       "" => "1"
  egress.482069346.cidr_blocks.0:       "" => "0.0.0.0/0"
  egress.482069346.from_port:           "" => "0"
  egress.482069346.prefix_list_ids.#:   "" => "0"
  egress.482069346.protocol:            "" => "-1"
  egress.482069346.security_groups.#:   "" => "0"
  egress.482069346.self:                "" => "false"
  egress.482069346.to_port:             "" => "0"
  ingress.#:                            "" => "1"
  ingress.3925595496.cidr_blocks.#:     "" => "1"
  ingress.3925595496.cidr_blocks.0:     "" => "***.***.***.***/32"
  ingress.3925595496.from_port:         "" => "22"
  ingress.3925595496.protocol:          "" => "tcp"
  ingress.3925595496.security_groups.#: "" => "0"
  ingress.3925595496.self:              "" => "false"
  ingress.3925595496.to_port:           "" => "22"
  name:                                 "" => "ssh-limited"
  owner_id:                             "" => "<computed>"
  tags.%:                               "" => "1"
  tags.Name:                            "" => "ssh-limited"
  vpc_id:                               "" => "vpc-7e905e1a"
aws_internet_gateway.practice2-igw: Creation complete
aws_route_table.practice2-dmz-1c: Creating...
  route.#:                                    "" => "1"
  route.4294384048.cidr_block:                "" => "0.0.0.0/0"
  route.4294384048.gateway_id:                "" => "igw-0ecf986b"
  route.4294384048.instance_id:               "" => ""
  route.4294384048.nat_gateway_id:            "" => ""
  route.4294384048.network_interface_id:      "" => ""
  route.4294384048.vpc_peering_connection_id: "" => ""
  tags.%:                                     "" => "1"
  tags.Name:                                  "" => "practice2-dmz-1c"
  vpc_id:                                     "" => "vpc-7e905e1a"
aws_route_table.practice2-dmz-1a: Creating...
  route.#:                                    "" => "1"
  route.4294384048.cidr_block:                "" => "0.0.0.0/0"
  route.4294384048.gateway_id:                "" => "igw-0ecf986b"
  route.4294384048.instance_id:               "" => ""
  route.4294384048.nat_gateway_id:            "" => ""
  route.4294384048.network_interface_id:      "" => ""
  route.4294384048.vpc_peering_connection_id: "" => ""
  tags.%:                                     "" => "1"
  tags.Name:                                  "" => "practice2-dmz-1a"
  vpc_id:                                     "" => "vpc-7e905e1a"
aws_subnet.practice2-trust-1a: Creation complete
aws_subnet.practice2-dmz-1a: Creation complete
aws_nat_gateway.practice2-natgw: Creating...
  allocation_id:        "" => "eipalloc-2898ae4d"
  network_interface_id: "" => "<computed>"
  private_ip:           "" => "<computed>"
  public_ip:            "" => "<computed>"
  subnet_id:            "" => "subnet-20c24b56"
aws_subnet.practice2-trust-1c: Creation complete
aws_subnet.practice2-dmz-1c: Creation complete
aws_route_table.practice2-dmz-1c: Creation complete
aws_route_table_association.practice2-dmz-1c: Creating...
  route_table_id: "" => "rtb-04c74b60"
  subnet_id:      "" => "subnet-b81ccce0"
aws_route_table_association.practice2-dmz-1c: Creation complete
aws_route_table.practice2-dmz-1a: Creation complete
aws_route_table_association.practice2-dmz-1a: Creating...
  route_table_id: "" => "rtb-05c74b61"
  subnet_id:      "" => "subnet-20c24b56"
aws_security_group.ssh-limited: Creation complete
aws_instance.stg-bastion: Creating...
  ami:                         "" => "ami-0c11b26d"
  associate_public_ip_address: "" => "<computed>"
  availability_zone:           "" => "<computed>"
  ebs_block_device.#:          "" => "<computed>"
  ephemeral_block_device.#:    "" => "<computed>"
  instance_state:              "" => "<computed>"
  instance_type:               "" => "t2.nano"
  key_name:                    "" => "**********"
  network_interface_id:        "" => "<computed>"
  placement_group:             "" => "<computed>"
  private_dns:                 "" => "<computed>"
  private_ip:                  "" => "<computed>"
  public_dns:                  "" => "<computed>"
  public_ip:                   "" => "<computed>"
  root_block_device.#:         "" => "<computed>"
  security_groups.#:           "" => "1"
  security_groups.1593894738:  "" => "sg-0ade0c6d"
  source_dest_check:           "" => "true"
  subnet_id:                   "" => "subnet-20c24b56"
  tags.%:                      "" => "1"
  tags.Name:                   "" => "bastion"
  tenancy:                     "" => "<computed>"
  vpc_security_group_ids.#:    "" => "<computed>"
aws_route_table_association.practice2-dmz-1a: Creation complete
aws_nat_gateway.practice2-natgw: Still creating... (10s elapsed)
aws_instance.stg-bastion: Still creating... (10s elapsed)
aws_instance.stg-bastion: Creation complete
aws_nat_gateway.practice2-natgw: Still creating... (20s elapsed)
aws_nat_gateway.practice2-natgw: Still creating... (30s elapsed)
aws_nat_gateway.practice2-natgw: Still creating... (40s elapsed)
aws_nat_gateway.practice2-natgw: Still creating... (50s elapsed)
aws_nat_gateway.practice2-natgw: Still creating... (1m0s elapsed)
aws_nat_gateway.practice2-natgw: Still creating... (1m10s elapsed)
aws_nat_gateway.practice2-natgw: Still creating... (1m20s elapsed)
aws_nat_gateway.practice2-natgw: Still creating... (1m30s elapsed)
aws_nat_gateway.practice2-natgw: Creation complete
aws_route_table.practice2-trust-1c: Creating...
  route.#:                                    "" => "1"
  route.1966172565.cidr_block:                "" => "0.0.0.0/0"
  route.1966172565.gateway_id:                "" => ""
  route.1966172565.instance_id:               "" => ""
  route.1966172565.nat_gateway_id:            "" => "nat-0ef9a3396c1bd932e"
  route.1966172565.network_interface_id:      "" => ""
  route.1966172565.vpc_peering_connection_id: "" => ""
  tags.%:                                     "" => "1"
  tags.Name:                                  "" => "practice2-trust-1c"
  vpc_id:                                     "" => "vpc-7e905e1a"
aws_route_table.practice2-trust-1a: Creating...
  route.#:                                    "" => "1"
  route.1966172565.cidr_block:                "" => "0.0.0.0/0"
  route.1966172565.gateway_id:                "" => ""
  route.1966172565.instance_id:               "" => ""
  route.1966172565.nat_gateway_id:            "" => "nat-0ef9a3396c1bd932e"
  route.1966172565.network_interface_id:      "" => ""
  route.1966172565.vpc_peering_connection_id: "" => ""
  tags.%:                                     "" => "1"
  tags.Name:                                  "" => "practice2-trust-1a"
  vpc_id:                                     "" => "vpc-7e905e1a"
aws_route_table.practice2-trust-1a: Creation complete
aws_route_table_association.practice2-trust-1a: Creating...
  route_table_id: "" => "rtb-e1c74b85"
  subnet_id:      "" => "subnet-21c24b57"
aws_route_table_association.practice2-trust-1a: Creation complete
aws_route_table.practice2-trust-1c: Creation complete
aws_route_table_association.practice2-trust-1c: Creating...
  route_table_id: "" => "rtb-e0c74b84"
  subnet_id:      "" => "subnet-871cccdf"
aws_route_table_association.practice2-trust-1c: Creation complete

Apply complete! Resources: 18 added, 0 changed, 0 destroyed.

The state of your infrastructure has been saved to the path
below. This state is required to modify and destroy your
infrastructure, so keep it safe. To inspect the complete state
use the `terraform show` command.

State path: terraform.tfstate

Outputs:

eip.natgw.id = eipalloc-2898ae4d
public ip of stg-bastion = 52.***.***.***
```

# 確認

```bash
$ terraform show
aws_eip.natgw:
  id = eipalloc-2898ae4d
  association_id = 
  domain = vpc
  instance = 
  network_interface = 
  private_ip = 
  public_ip = 52.***.***.***
  vpc = true
aws_instance.stg-bastion:
  id = i-**************
  ami = ami-0c11b26d
  associate_public_ip_address = true
  availability_zone = ap-northeast-1a
  disable_api_termination = false
  ebs_block_device.# = 0
  ebs_optimized = false
  ephemeral_block_device.# = 0
  iam_instance_profile = 
  instance_state = running
  instance_type = t2.nano
  key_name = ***********
  monitoring = false
  network_interface_id = eni-ba4034f7
  private_dns = ip-10-0-0-164.ap-northeast-1.compute.internal
  private_ip = 10.0.0.164
  public_dns = ec2-52-***-***-***.ap-northeast-1.compute.amazonaws.com
  public_ip = 52.***.***.***
  root_block_device.# = 1
  root_block_device.0.delete_on_termination = true
  root_block_device.0.iops = 100
  root_block_device.0.volume_size = 8
  root_block_device.0.volume_type = gp2
  security_groups.# = 0
  source_dest_check = true
  subnet_id = subnet-20c24b56
  tags.% = 1
  tags.Name = bastion
  tenancy = default
  vpc_security_group_ids.# = 1
  vpc_security_group_ids.1593894738 = sg-0ade0c6d
aws_internet_gateway.practice2-igw:
  id = igw-0ecf986b
  tags.% = 1
  tags.Name = practice2-igw
  vpc_id = vpc-7e905e1a
aws_nat_gateway.practice2-natgw:
  id = nat-0ef9a3396c1bd932e
  allocation_id = eipalloc-2898ae4d
  network_interface_id = eni-a75b2fea
  private_ip = 10.0.0.45
  public_ip = 52.***.***.***
  subnet_id = subnet-20c24b56
aws_route_table.practice2-dmz-1a:
  id = rtb-05c74b61
  propagating_vgws.# = 0
  route.# = 1
  route.4294384048.cidr_block = 0.0.0.0/0
  route.4294384048.gateway_id = igw-0ecf986b
  route.4294384048.instance_id = 
  route.4294384048.nat_gateway_id = 
  route.4294384048.network_interface_id = 
  route.4294384048.vpc_peering_connection_id = 
  tags.% = 1
  tags.Name = practice2-dmz-1a
  vpc_id = vpc-7e905e1a
aws_route_table.practice2-dmz-1c:
  id = rtb-04c74b60
  propagating_vgws.# = 0
  route.# = 1
  route.4294384048.cidr_block = 0.0.0.0/0
  route.4294384048.gateway_id = igw-0ecf986b
  route.4294384048.instance_id = 
  route.4294384048.nat_gateway_id = 
  route.4294384048.network_interface_id = 
  route.4294384048.vpc_peering_connection_id = 
  tags.% = 1
  tags.Name = practice2-dmz-1c
  vpc_id = vpc-7e905e1a
aws_route_table.practice2-trust-1a:
  id = rtb-e1c74b85
  propagating_vgws.# = 0
  route.# = 1
  route.1966172565.cidr_block = 0.0.0.0/0
  route.1966172565.gateway_id = 
  route.1966172565.instance_id = 
  route.1966172565.nat_gateway_id = nat-0ef9a3396c1bd932e
  route.1966172565.network_interface_id = 
  route.1966172565.vpc_peering_connection_id = 
  tags.% = 1
  tags.Name = practice2-trust-1a
  vpc_id = vpc-7e905e1a
aws_route_table.practice2-trust-1c:
  id = rtb-e0c74b84
  propagating_vgws.# = 0
  route.# = 1
  route.1966172565.cidr_block = 0.0.0.0/0
  route.1966172565.gateway_id = 
  route.1966172565.instance_id = 
  route.1966172565.nat_gateway_id = nat-0ef9a3396c1bd932e
  route.1966172565.network_interface_id = 
  route.1966172565.vpc_peering_connection_id = 
  tags.% = 1
  tags.Name = practice2-trust-1c
  vpc_id = vpc-7e905e1a
aws_route_table_association.practice2-dmz-1a:
  id = rtbassoc-8d3001e9
  route_table_id = rtb-05c74b61
  subnet_id = subnet-20c24b56
aws_route_table_association.practice2-dmz-1c:
  id = rtbassoc-8c3001e8
  route_table_id = rtb-04c74b60
  subnet_id = subnet-b81ccce0
aws_route_table_association.practice2-trust-1a:
  id = rtbassoc-71330215
  route_table_id = rtb-e1c74b85
  subnet_id = subnet-21c24b57
aws_route_table_association.practice2-trust-1c:
  id = rtbassoc-72330216
  route_table_id = rtb-e0c74b84
  subnet_id = subnet-871cccdf
aws_security_group.ssh-limited:
  id = sg-0ade0c6d
  description = ssh_limited inbound traffic
  egress.# = 1
  egress.482069346.cidr_blocks.# = 1
  egress.482069346.cidr_blocks.0 = 0.0.0.0/0
  egress.482069346.from_port = 0
  egress.482069346.prefix_list_ids.# = 0
  egress.482069346.protocol = -1
  egress.482069346.security_groups.# = 0
  egress.482069346.self = false
  egress.482069346.to_port = 0
  ingress.# = 1
  ingress.3925595496.cidr_blocks.# = 1
  ingress.3925595496.cidr_blocks.0 = ***.***.***.***/32
  ingress.3925595496.from_port = 22
  ingress.3925595496.protocol = tcp
  ingress.3925595496.security_groups.# = 0
  ingress.3925595496.self = false
  ingress.3925595496.to_port = 22
  name = ssh-limited
  owner_id = 385997410181
  tags.% = 1
  tags.Name = ssh-limited
  vpc_id = vpc-7e905e1a
aws_subnet.practice2-dmz-1a:
  id = subnet-20c24b56
  availability_zone = ap-northeast-1a
  cidr_block = 10.0.0.0/24
  map_public_ip_on_launch = true
  tags.% = 1
  tags.Name = practice2-dmz-1a
  vpc_id = vpc-7e905e1a
aws_subnet.practice2-dmz-1c:
  id = subnet-b81ccce0
  availability_zone = ap-northeast-1c
  cidr_block = 10.0.1.0/24
  map_public_ip_on_launch = true
  tags.% = 1
  tags.Name = practice2-dmz-1c
  vpc_id = vpc-7e905e1a
aws_subnet.practice2-trust-1a:
  id = subnet-21c24b57
  availability_zone = ap-northeast-1a
  cidr_block = 10.0.2.0/24
  map_public_ip_on_launch = false
  tags.% = 1
  tags.Name = practice2-trust-1a
  vpc_id = vpc-7e905e1a
aws_subnet.practice2-trust-1c:
  id = subnet-871cccdf
  availability_zone = ap-northeast-1c
  cidr_block = 10.0.3.0/24
  map_public_ip_on_launch = false
  tags.% = 1
  tags.Name = practice2-trust-1c
  vpc_id = vpc-7e905e1a
aws_vpc.practice2-vpc:
  id = vpc-7e905e1a
  cidr_block = 10.0.0.0/16
  default_network_acl_id = acl-903f86f4
  default_route_table_id = rtb-3bc74b5f
  default_security_group_id = sg-0bde0c6c
  dhcp_options_id = dopt-851a0fe7
  enable_classiclink = false
  enable_dns_hostnames = true
  enable_dns_support = true
  instance_tenancy = default
  main_route_table_id = rtb-3bc74b5f
  tags.% = 1
  tags.Name = practice2-vpc


Outputs:

eip.natgw.id = eipalloc-2898ae4d
public ip of stg-bastion = 52.***.***.***
```

# 削除
* 削除確認

```bash
$ terraform plan --destroy
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but
will not be persisted to local or remote state storage.

aws_vpc.practice2-vpc: Refreshing state... (ID: vpc-7e905e1a)
aws_eip.natgw: Refreshing state... (ID: eipalloc-2898ae4d)
aws_internet_gateway.practice2-igw: Refreshing state... (ID: igw-0ecf986b)
aws_security_group.ssh-limited: Refreshing state... (ID: sg-0ade0c6d)
aws_subnet.practice2-trust-1c: Refreshing state... (ID: subnet-871cccdf)
aws_subnet.practice2-dmz-1c: Refreshing state... (ID: subnet-b81ccce0)
aws_subnet.practice2-trust-1a: Refreshing state... (ID: subnet-21c24b57)
aws_subnet.practice2-dmz-1a: Refreshing state... (ID: subnet-20c24b56)
aws_nat_gateway.practice2-natgw: Refreshing state... (ID: nat-0ef9a3396c1bd932e)
aws_instance.bastion: Refreshing state... (ID: i-*********)
aws_route_table.practice2-dmz-1a: Refreshing state... (ID: rtb-05c74b61)
aws_route_table.practice2-dmz-1c: Refreshing state... (ID: rtb-04c74b60)
aws_route_table_association.practice2-dmz-1c: Refreshing state... (ID: rtbassoc-8c3001e8)
aws_route_table_association.practice2-dmz-1a: Refreshing state... (ID: rtbassoc-8d3001e9)
aws_route_table.practice2-trust-1a: Refreshing state... (ID: rtb-e1c74b85)
aws_route_table.practice2-trust-1c: Refreshing state... (ID: rtb-e0c74b84)
aws_route_table_association.practice2-trust-1a: Refreshing state... (ID: rtbassoc-71330215)
aws_route_table_association.practice2-trust-1c: Refreshing state... (ID: rtbassoc-72330216)

The Terraform execution plan has been generated and is shown below.
Resources are shown in alphabetical order for quick scanning. Green resources
will be created (or destroyed and then created if an existing resource
exists), yellow resources are being changed in-place, and red resources
will be destroyed. Cyan entries are data sources to be read.

Note: You didn't specify an "-out" parameter to save this plan, so when
"apply" is called, Terraform can't guarantee this is what will execute.

- aws_eip.natgw

- aws_instance.stg-bastion

- aws_internet_gateway.practice2-igw

- aws_nat_gateway.practice2-natgw

- aws_route_table.practice2-dmz-1a

- aws_route_table.practice2-dmz-1c

- aws_route_table.practice2-trust-1a

- aws_route_table.practice2-trust-1c

- aws_route_table_association.practice2-dmz-1a

- aws_route_table_association.practice2-dmz-1c

- aws_route_table_association.practice2-trust-1a

- aws_route_table_association.practice2-trust-1c

- aws_security_group.ssh-limited

- aws_subnet.practice2-dmz-1a

- aws_subnet.practice2-dmz-1c

- aws_subnet.practice2-trust-1a

- aws_subnet.practice2-trust-1c

- aws_vpc.practice2-vpc


Plan: 0 to add, 0 to change, 18 to destroy.
```
*　削除実行

```bash
$ terraform destroy
Do you really want to destroy?
  Terraform will delete all your managed infrastructure.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

aws_eip.natgw: Refreshing state... (ID: eipalloc-2898ae4d)
aws_vpc.practice2-vpc: Refreshing state... (ID: vpc-7e905e1a)
aws_security_group.ssh-limited: Refreshing state... (ID: sg-0ade0c6d)
aws_subnet.practice2-dmz-1a: Refreshing state... (ID: subnet-20c24b56)
aws_subnet.practice2-dmz-1c: Refreshing state... (ID: subnet-b81ccce0)
aws_internet_gateway.practice2-igw: Refreshing state... (ID: igw-0ecf986b)
aws_subnet.practice2-trust-1c: Refreshing state... (ID: subnet-871cccdf)
aws_subnet.practice2-trust-1a: Refreshing state... (ID: subnet-21c24b57)
aws_route_table.practice2-dmz-1a: Refreshing state... (ID: rtb-05c74b61)
aws_route_table.practice2-dmz-1c: Refreshing state... (ID: rtb-04c74b60)
aws_route_table_association.practice2-dmz-1c: Refreshing state... (ID: rtbassoc-8c3001e8)
aws_nat_gateway.practice2-natgw: Refreshing state... (ID: nat-0ef9a3396c1bd932e)
aws_instance.stg-bastion: Refreshing state... (ID: i-************)
aws_route_table.practice2-trust-1c: Refreshing state... (ID: rtb-e0c74b84)
aws_route_table.practice2-trust-1a: Refreshing state... (ID: rtb-e1c74b85)
aws_route_table_association.practice2-trust-1c: Refreshing state... (ID: rtbassoc-72330216)
aws_route_table_association.practice2-trust-1a: Refreshing state... (ID: rtbassoc-71330215)
aws_route_table_association.practice2-dmz-1a: Refreshing state... (ID: rtbassoc-8d3001e9)
aws_route_table_association.practice2-dmz-1a: Destroying...
aws_route_table_association.practice2-trust-1a: Destroying...
aws_route_table_association.practice2-dmz-1c: Destroying...
aws_route_table_association.practice2-trust-1c: Destroying...
aws_instance.stg-bastion: Destroying...
aws_route_table_association.practice2-trust-1c: Destruction complete
aws_subnet.practice2-trust-1c: Destroying...
aws_route_table_association.practice2-dmz-1a: Destruction complete
aws_route_table.practice2-trust-1c: Destroying...
aws_route_table.practice2-dmz-1a: Destroying...
aws_route_table_association.practice2-trust-1a: Destruction complete
aws_route_table.practice2-trust-1a: Destroying...
aws_subnet.practice2-trust-1a: Destroying...
aws_subnet.practice2-trust-1a: Destruction complete
aws_subnet.practice2-trust-1c: Destruction complete
aws_route_table_association.practice2-dmz-1c: Destruction complete
aws_route_table.practice2-dmz-1c: Destroying...
aws_subnet.practice2-dmz-1c: Destroying...
aws_route_table.practice2-trust-1a: Destruction complete
aws_subnet.practice2-dmz-1c: Destruction complete
aws_route_table.practice2-dmz-1c: Destruction complete
aws_route_table.practice2-trust-1c: Destruction complete
aws_nat_gateway.practice2-natgw: Destroying...
aws_route_table.practice2-dmz-1a: Destruction complete
aws_internet_gateway.practice2-igw: Destroying...
aws_instance.stg-bastion: Still destroying... (10s elapsed)
aws_nat_gateway.practice2-natgw: Still destroying... (10s elapsed)
aws_internet_gateway.practice2-igw: Still destroying... (10s elapsed)
aws_instance.stg-bastion: Still destroying... (20s elapsed)
aws_nat_gateway.practice2-natgw: Still destroying... (20s elapsed)
aws_internet_gateway.practice2-igw: Still destroying... (20s elapsed)
aws_instance.stg-bastion: Still destroying... (30s elapsed)
aws_instance.stg-bastion: Destruction complete
aws_security_group.ssh-limited: Destroying...
aws_security_group.ssh-limited: Destruction complete
aws_nat_gateway.practice2-natgw: Still destroying... (30s elapsed)
aws_internet_gateway.practice2-igw: Still destroying... (30s elapsed)
aws_nat_gateway.practice2-natgw: Still destroying... (40s elapsed)
aws_internet_gateway.practice2-igw: Still destroying... (40s elapsed)
aws_internet_gateway.practice2-igw: Destruction complete
aws_nat_gateway.practice2-natgw: Still destroying... (50s elapsed)
aws_nat_gateway.practice2-natgw: Destruction complete
aws_subnet.practice2-dmz-1a: Destroying...
aws_eip.natgw: Destroying...
aws_eip.natgw: Destruction complete
aws_subnet.practice2-dmz-1a: Destruction complete
aws_vpc.practice2-vpc: Destroying...
aws_vpc.practice2-vpc: Destruction complete

Destroy complete! Resources: 18 destroyed.
```

* もっと編集して細かい要件に沿って運用できますね！