Note: terraform taintは非推奨。-replaceオプションを使用する。

required_providers { aws = { source = “hashicorp/aws” version = “~> 5.0” } }

backend “s3” { bucket = “my-tfstate-bucket” key = “terraform.tfstate” region = “ap-northeast-1” dynamodb_table = “my-tfstate-lock” encrypt = true } }

</details>

<details>
<summary>provider ブロック</summary>
```hcl
provider "aws" {
  region = "ap-northeast-1"

  default_tags {
    tags = {
      Project   = "my-project"
      ManagedBy = "terraform"
    }
  }
}

# 複数リージョン対応（alias）
provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}

tags = { Name = “web-server” }

depends_on = [aws_internet_gateway.main]

lifecycle { create_before_destroy = true prevent_destroy = false ignore_changes = [tags] } }

</details>

<details>
<summary>data ブロック（既存リソース参照）</summary>
```hcl
data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}

resource "aws_instance" "web" {
  ami = data.aws_ami.amazon_linux.id
}

variable “environment” { type = string validation { condition = contains([“dev”, “stg”, “prod”], var.environment) error_message = “environment must be dev, stg, or prod” } }

variable “password” { type = string sensitive = true }

</details>

<details>
<summary>output / locals ブロック</summary>
```hcl
output "instance_id" {
  value       = aws_instance.web.id
  description = "EC2 instance ID"
}

output "db_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

locals {
  common_tags = {
    Project     = var.project_name
    Environment = var.environment
    ManagedBy   = "terraform"
  }
  name_prefix = "${var.project_name}-${var.environment}"
}

vpc_cidr = “10.0.0.0/16” environment = var.environment }

module “s3” { source = “terraform-aws-modules/s3-bucket/aws” version = “3.0.0”

bucket = “my-bucket” }

マルチリージョンプロバイダーを渡す

#

module “acm” { source = “./modules/acm”

providers = { aws = aws.us_east_1 } }

</details>

<details>
<summary>moved ブロック（リファクタリング）</summary>
```hcl
moved {
  from = aws_s3_bucket.content
  to   = module.s3_content.aws_s3_bucket.this
}

moved {
  from = aws_instance.web
  to   = aws_instance.web_server
}

count（インデックスベース）

#

resource “aws_instance” “web” { count = 3 tags = { Name = “web-${count.index}” } }

条件付き作成

#

resource “aws_eip” “nat” { count = var.create_nat ? 1 : 0 }

</details>

<details>
<summary>for_each</summary>
```hcl
# マップ
resource "aws_subnet" "private" {
  for_each = {
    "a" = "10.0.1.0/24"
    "c" = "10.0.2.0/24"
  }

  availability_zone = "ap-northeast-1${each.key}"
  cidr_block        = each.value
}

# セット
resource "aws_security_group_rule" "ports" {
  for_each = toset(["80", "443", "22"])

  from_port = tonumber(each.value)
  to_port   = tonumber(each.value)
}

dynamic ブロック

#

resource “aws_security_group” “main” { name = “main”

dynamic “ingress” { for_each = var.ingress_rules content { from_port = ingress.value.from_port to_port = ingress.value.to_port protocol = ingress.value.protocol cidr_blocks = ingress.value.cidr_blocks } } }

</details>

---

### ディレクトリ構成例

<details>
<summary>シンプル構成</summary>

project/ ├── main.tf ├── variables.tf ├── outputs.tf ├── versions.tf └── terraform.tfvars

</details>

<details>
<summary>モジュール構成</summary>

project/ ├── modules/ │ ├── vpc/ │ │ ├── main.tf │ │ ├── variables.tf │ │ └── outputs.tf │ └── ec2/ ├── environments/ │ ├── dev/ │ │ ├── main.tf │ │ ├── backend.tf │ │ └── terraform.tfvars │ └── prod/ └── backend-setup/ └── main.tf

</details>

---

### よく使うパターン

<details>
<summary>タグの共通化</summary>
```hcl
locals {
  common_tags = {
    Project     = "my-project"
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

resource "aws_instance" "web" {
  tags = merge(local.common_tags, {
    Name = "web-server"
    Role = "web"
  })
}

allocation_id = aws_eip.nat[0].id subnet_id = aws_subnet.public.id }

output “nat_gateway_id” { value = var.enable_nat_gateway ? aws_nat_gateway.main[0].id : null }

</details>

<details>
<summary>user_data / セキュリティグループ参照</summary>
```hcl
# user_data
resource "aws_instance" "web" {
  user_data = <<-EOF
              #!/bin/bash
              dnf update -y
              dnf install -y httpd
              systemctl start httpd
              EOF
}

# SGをソースに指定
resource "aws_vpc_security_group_ingress_rule" "rds" {
  security_group_id            = aws_security_group.rds.id
  referenced_security_group_id = aws_security_group.web.id
  from_port                    = 3306
  to_port                      = 3306
  ip_protocol                  = "tcp"
}