Terraform基础设施即代码与多云资源自动化管理实战

基础设施即代码的核心价值

基础设施即代码（IaC）将云资源的创建、变更和销毁过程从手动操作转为声明式配置，核心价值在于：配置可版本控制（变更可追溯、可回滚）、环境一致性（开发/测试/生产环境配置相同）、自动化审计（每次变更都有完整记录）。Terraform是目前主流的多云IaC工具，支持AWS、Azure、GCP及数十家国内云厂商。

Terraform项目结构与模块化设计

多环境多项目场景下，Terraform代码需要模块化组织：

infra/
├── modules/
│   ├── vpc/           # VPC网络模块
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   ├── ecs/           # 云服务器模块
│   ├── rds/           # 数据库模块
│   └── oss/           # 对象存储模块
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── terraform.tfvars
│   │   └── backend.tf
│   ├── staging/
│   └── prod/
└── shared/
    └── backend.tf

VPC网络模块实现

# modules/vpc/main.tf
resource "alicloud_vpc" "main" {
  vpc_name   = var.vpc_name
  cidr_block = var.cidr_block
  tags = merge(var.common_tags, {
    Environment = var.environment
  })
}

resource "alicloud_vswitch" "azs" {
  count           = length(var.availability_zones)
  vpc_id          = alicloud_vpc.main.id
  cidr_block      = var.subnet_cidrs[count.index]
  zone_id         = var.availability_zones[count.index]
  vswitch_name    = "${var.vpc_name}-subnet-${count.index}"
}

# modules/vpc/variables.tf
variable "vpc_name" { type = string }
variable "cidr_block" { type = string }
variable "availability_zones" { type = list(string) }
variable "subnet_cidrs" { type = list(string) }
variable "environment" { type = string }
variable "common_tags" { type = map(string); default = {} }

# modules/vpc/outputs.tf
output "vpc_id" { value = alicloud_vpc.main.id }
output "vswitch_ids" { value = alicloud_vswitch.azs[*].id }

环境配置引用模块

# environments/dev/main.tf
provider "alicloud" {
  region = "cn-hangzhou"
}

module "vpc" {
  source           = "../../modules/vpc"
  vpc_name         = "dev-vpc"
  cidr_block       = "10.0.0.0/16"
  availability_zones = ["cn-hangzhou-a", "cn-hangzhou-b"]
  subnet_cidrs     = ["10.0.1.0/24", "10.0.2.0/24"]
  environment      = "dev"
  common_tags      = local.common_tags
}

module "ecs" {
  source        = "../../modules/ecs"
  vpc_id        = module.vpc.vpc_id
  vswitch_ids   = module.vpc.vswitch_ids
  instance_type = "ecs.c6.large"
  instance_count = 2
  environment   = "dev"
}

locals {
  common_tags = {
    Project     = "myapp"
    ManagedBy   = "terraform"
  }
}

状态远程存储与锁定

Terraform状态文件记录资源的实际状态，是变更计算的基础。生产环境必须使用远程存储：

# environments/dev/backend.tf
terraform {
  backend "oss" {
    bucket   = "terraform-state-prod"
    key      = "dev/terraform.tfstate"
    region   = "cn-hangzhou"
    encrypt  = true
  }
}

状态文件包含敏感信息（数据库密码、内网IP等），务必启用加密并限制访问权限。

Workspaces多环境隔离

terraform workspace new dev
terraform workspace new staging
terraform workspace new prod

# main.tf中根据workspace切换配置
locals {
  env_config = {
    dev = {
      instance_type = "ecs.c6.large"
      instance_count = 2
    }
    staging = {
      instance_type = "ecs.c6.xlarge"
      instance_count = 3
    }
    prod = {
      instance_type = "ecs.c6.2xlarge"
      instance_count = 6
    }
  }
  current_env = terraform.workspace
  config      = local.env_config[local.current_env]
}

resource "alicloud_instance" "app" {
  count         = local.config.instance_count
  instance_type = local.config.instance_type
}

变更审批与自动化CI/CD集成

# GitLab CI配置示例
stages:
  - plan
  - apply

terraform_plan:
  stage: plan
  script:
    - terraform init -backend-config="bucket=$STATE_BUCKET"
    - terraform plan -out=tfplan.bin
    - terraform show -no-color tfplan.bin > plan_output.txt
  artifacts:
    paths:
      - tfplan.bin
      - plan_output.txt
  rules:
    - if: "$CI_MERGE_REQUEST_IID"

terraform_apply:
  stage: apply
  script:
    - terraform apply -auto-approve tfplan.bin
  rules:
    - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  when: manual

关键安全策略：apply操作必须人工确认，plan结果作为评审依据；使用terraform fmt -check和terraform validate做代码规范检查；敏感变量通过环境变量注入，不写入代码仓库。

状态漂移检测与修正

# 检测漂移
terraform plan -detailed-exitcode
# 退出码0=无变更，1=错误，2=有变更（漂移）

# 修正方案一：更新状态匹配实际资源
terraform plan -refresh-only

# 修正方案二：重新应用配置覆盖手动变更
terraform apply -auto-approve

建议在CI流水线中加入每日漂移检测任务，输出变更报告通知运维团队，确保基础设施配置始终与代码定义一致。