TerraformでWebサーバ構築

## はじめに
Terraformを学習したかったのでAWSで一般的なWebサーバのコードを作成してみました。

## 構成
#### 今回はVPC、EC2、ALB
![ネットワーク構成図.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3812406/4e288da3-99fd-4afb-a3f4-c2227cb085f7.png)

### VPC
```
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "test-vpc"
  }
}

resource "aws_subnet" "public1" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.0.0/24"
  availability_zone       = "ap-northeast-1a"
  map_public_ip_on_launch = true

  tags = {
    Name = "PublicSubnet1"
  }
}

resource "aws_subnet" "public2" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "ap-northeast-1c"
  map_public_ip_on_launch = true

  tags = {
    Name = "PublicSubnet2"
  }
}

resource "aws_subnet" "private1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.10.0/24"
  availability_zone       = "ap-northeast-1a"

  tags = {
    Name = "PrivateSubnet1"
  }
}

resource "aws_subnet" "private2" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.11.0/24"
  availability_zone       = "ap-northeast-1c"

  tags = {
    Name = "PrivateSubnet2"
  }
}

resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "test-igw"
  }
}

resource "aws_route_table" "rt" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.gw.id
  }

  tags = {
    Name = "test-public-rt"
  }
}

resource "aws_route_table_association" "pub_1a_association" {
  subnet_id = aws_subnet.public1.id
  route_table_id = aws_route_table.rt.id
}

resource "aws_route_table_association" "pub_1c_association" {
  subnet_id = aws_subnet.public2.id
  route_table_id = aws_route_table.rt.id
}
```
### EC2
```
data "aws_ami" "latest_amazon_linux" {
  owners = ["amazon"]
  most_recent = true
  filter {
    name = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

# EC2インスタンス1a
resource "aws_instance" "instance1" {
  ami = data.aws_ami.latest_amazon_linux.id
  instance_type = "t2.micro"
  subnet_id = aws_subnet.public1.id
  user_data = <<-EOF
   #!/bin/bash
   sudo amazon-linux-extras install nginx1 -y
   sudo systemctl start nginx
   sudo systemctl enable nginx
   echo "<html><body>OK</body></html>" | sudo tee /usr/share/nginx/html/health
  EOF
  vpc_security_group_ids = [aws_security_group.ec2_sg.id]

  tags = {
    Name = "EC2Instance1A"
  }

  depends_on = [aws_security_group.ec2_sg]
}

resource "aws_instance" "instance2" {
  ami = data.aws_ami.latest_amazon_linux.id
  instance_type = "t2.micro"
  subnet_id = aws_subnet.public2.id
  user_data = <<-EOF
   #!/bin/bash
   sudo amazon-linux-extras install nginx1 -y
   sudo systemctl start nginx
   sudo systemctl enable nginx
   echo "<html><body>OK</body></html>" | sudo tee /usr/share/nginx/html/health
  EOF
  vpc_security_group_ids = [aws_security_group.ec2_sg.id]

  tags = {
    Name = "EC2Instance1C"
  }

  depends_on = [aws_security_group.ec2_sg]
}

resource "aws_security_group" "ec2_sg" {
  name = "ec2_sg"  
  description = "Allow HTTP and SSH"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port = 80
    to_port   = 80
    protocol  = "tcp"
    cidr_blocks = ["10.0.0.0/16"]
  }

  ingress {
    from_port = 22
    to_port   = 22
    protocol  = "tcp"
    cidr_blocks = ["3.112.23.0/29"] # Instance Connect
  }

    egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1" # 全トラフィック
    cidr_blocks = ["0.0.0.0/0"]
  }


  tags = {
    Name = "ec2_sg"
  }
}
```

### ALB
- 今回はHTTP通信のみ許可しています。CloudFrontとRoute53を作成した後リスナーとSGを変更します。


```
resource "aws_lb" "alb" {
  name               = "MyLoadBalancer"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb_sg.id]
  subnets            = [
    aws_subnet.public1.id,
    aws_subnet.public2.id
  ]
  enable_deletion_protection = false
} 

resource "aws_lb_listener" "listener" {
  load_balancer_arn = aws_lb.alb.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.lb_tg.arn
  }
}

resource "aws_lb_target_group" "lb_tg" {
  name = "test-lb-tg"
  port = 80
  protocol = "HTTP"
  vpc_id = aws_vpc.main.id

  health_check {
    path = "/health"
  }
}

resource "aws_lb_target_group_attachment" "instance1" {
  target_group_arn = aws_lb_target_group.lb_tg.arn
  target_id = aws_instance.instance1.id
  port = 80
}

resource "aws_lb_target_group_attachment" "instance2" {
  target_group_arn = aws_lb_target_group.lb_tg.arn
  target_id = aws_instance.instance2.id
  port = 80
}

resource "aws_security_group" "alb_sg" {
  name = "alb-sg"
  description = "Allow HTTP and SSH"
  vpc_id = aws_vpc.main.id
  
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
```

## 結果
- ヘルスチェック
![202503022_000001.JPG](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3812406/c6bed93a-18a3-43e7-9a9a-d716d879e7b0.jpeg)

```
C:\terraform>curl http://MyLoadBalancer-2077151388.ap-northeast-1.elb.amazonaws.com
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
・
・
・
```

## さいごに
CloudFormationではスタック間の依存関係を処理する手間が煩雑に感じられましたが、Terraformではリソース間の依存関係が自動的に解決される仕組みがあるため、コードを書く際にスムーズで効率的だと感じました。