「远程状态与团队协作」

# 1. 状态文件在个人电脑上，别人拿不到
ls -la terraform.tfstate*

# 2. 误提交到 git（含明文密钥）
git log --all -- terraform.tfstate

# 3. 两人同时 apply，后者的状态覆盖前者

terraform {
  backend "s3" {
    bucket         = "company-terraform-state"
    key            = "prod/network/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
  }
}

# 创建锁表（一次性）
aws dynamodb create-table \
  --table-name terraform-locks \
  --attribute-definitions AttributeName=LockID,AttributeType=S \
  --key-schema AttributeName=LockID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST

terraform {
  cloud {
    organization = "example-org"

    workspaces {
      name = "prod-network"
    }
  }
}

terraform login
terraform init
# 状态由平台托管，本地不再出现 tfstate 文件

terraform apply
# Error: Error acquiring the state lock
# Lock Info:
#   ID:        8f3c2a1e-...
#   Path:      prod/network/terraform.tfstate
#   Operation: OperationTypeApply
#   Who:       ci-runner@build-1234

# 确认没有正在运行的 apply 之后，才强制解锁
terraform force-unlock 8f3c2a1e-...

# 也可以设置锁等待时间，避免 CI 因瞬时冲突失败
terraform apply -lock-timeout=5m

# 在 CI 中统一设置锁超时
# terraform plan/apply 都加 -lock-timeout

# 同一份配置，通过 workspace 区分环境
locals {
  env = terraform.workspace

  instance_count = {
    dev  = 1
    stg  = 2
    prod = 4
  }[local.env]
}

terraform workspace list
terraform workspace new stg
terraform workspace select prod
terraform workspace show

# 通过 API 创建变量集并关联多个工作区
curl -s -X POST \
  -H "Authorization: Bearer $TFC_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  https://app.terraform.io/api/v2/varsets \
  -d '{
    "data": {
      "type": "varsets",
      "attributes": {
        "name": "global-aws-creds",
        "global": false
      }
    }
  }'

# 拆分示例
# prod/network/   —— VPC、子网、路由（极少变更）
# prod/data/      —— RDS、ElastiCache（季度变更）
# prod/app/       —— ECS、ALB、AutoScaling（频繁变更）

data "terraform_remote_state" "network" {
  backend = "s3"

  config = {
    bucket = "company-terraform-state"
    key    = "prod/network/terraform.tfstate"
    region = "us-east-1"
  }
}

resource "aws_instance" "web" {
  subnet_id = data.terraform_remote_state.network.outputs.private_subnet_ids[0]
}

data "aws_vpc" "main" {
  filter {
    name   = "tag:Name"
    values = ["prod-vpc"]
  }
}

resource "aws_instance" "web" {
  subnet_id = data.aws_subnets.private.ids[0]
}

# 敏感值在 state 中仍是明文，标记 sensitive 只影响输出显示
resource "aws_db_instance" "main" {
  password = var.db_password   # state 里是明文！
}

# 检查 state 中是否有明文密钥
terraform state pull | jq -r '.. | strings' | grep -iE 'password|secret|token' | head

# 1. 后端加密（S3 SSE-KMS）
terraform {
  backend "s3" {
    encrypt    = true
    kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
  }
}

# 2. 密钥来自动态数据源，不落 tfvars
data "aws_secretsmanager_secret_version" "db" {
  secret_id = "prod/db/password"
}

resource "aws_db_instance" "main" {
  password = data.aws_secretsmanager_secret_version.db.secret_string
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::company-terraform-state/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalArn": "arn:aws:iam::123456789012:role/terraform-ci"
        }
      }
    }
  ]
}

# 从本地迁移到 S3
terraform init -migrate-state
# 会提示：Do you want to copy existing state to the new backend?

# 从一个 S3 路径迁到另一个
terraform init -migrate-state -force-copy

# 开启存储桶版本化，保留历史状态
aws s3api put-bucket-versioning \
  --bucket company-terraform-state \
  --versioning-configuration Status=Enabled

# 列出某状态文件的历史版本
aws s3api list-object-versions \
  --bucket company-terraform-state \
  --prefix prod/network/terraform.tfstate \
  --query 'Versions[].{VersionId:VersionId,LastModified:LastModified}'

# 定期备份到独立位置
terraform state pull > backup/network-$(date +%Y%m%d).tfstate

# 恢复：先备份现状，再推送历史版本
terraform state push backup/network-20261001.tfstate