Terraform IaC 실전: 모듈·state·환경 분리

terraform/
├── environments/
│   ├── prod/
│   │   ├── main.tf
│   │   └── terraform.tfvars
│   └── staging/
└── modules/
    ├── vpc/
    ├── eks/
    └── rds/

# modules/vpc/main.tf
resource "aws_vpc" "main" {
  cidr_block           = var.cidr_block
  enable_dns_hostnames = true

  tags = merge(var.common_tags, {
    Name = "${var.project}-${var.environment}-vpc"
  })
}

variable "cidr_block" {
  type    = string
  default = "10.0.0.0/16"

  validation {
    condition     = can(cidrhost(var.cidr_block, 0))
    error_message = "유효한 CIDR 형식이어야 합니다."
  }
}

terraform {
  backend "s3" {
    bucket         = "my-company-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "ap-northeast-2"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"
  }
}

# State 잠금 테이블 생성
aws dynamodb create-table \
  --table-name terraform-state-lock \
  --attribute-definitions AttributeName=LockID,AttributeType=S \
  --key-schema AttributeName=LockID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST

name: Terraform
on:
  pull_request:
    paths: ['terraform/**']

jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform init
      - run: terraform fmt -check -recursive
      - run: terraform validate
      - run: terraform plan -out=tfplan

*.tfstate
*.tfstate.backup
.terraform/

variable "db_password" {
  type      = string
  sensitive = true
}

# 드리프트만 확인 (인프라 변경 없이 state와 실제 비교)
terraform plan -refresh-only
# CI용: 변경이 있으면 종료 코드 2
terraform plan -detailed-exitcode -out=tfplan; echo "exit=$?"
# 삭제·재생성 대상만 골라 보기
terraform show -json tfplan | jq -r '.resource_changes[] | select(.change.actions | index("delete")) | .address'

moved {
  from = aws_security_group.web
  to   = module.web.aws_security_group.this
}

modules/
  network/     # VPC, subnet, SG
  data/        # RDS, bucket
  compute/     # ASG, EKS node group
envs/
  dev/
  staging/
  prod/

terraform {
  backend "s3" {
    bucket         = "org-tf-state"
    key            = "prod/network/terraform.tfstate"
    region         = "ap-northeast-2"
    dynamodb_table = "tf-locks"
    encrypt        = true
  }
}

# PR: plan만, main: apply
- run: terraform fmt -check
- run: terraform validate
- run: terraform plan -out=tfplan
# apply는 protected branch + 수동 승인