resource "aws_instance" "web"
➡️ "aws_instance" = resource type / "web" = local name
data "aws_ami" "example" {
most_recent = true
owners = ["self"]
tags = {
Name = "app-server"
Tested = "true"
}
}
data "aws_iam_policy_document" "example_multiple_condition_keys_and_values" {
statement {
actions = [
"kms:Decrypt",
"kms:GenerateDataKey"
]
resources = ["*"]
condition {
test = "ForAnyValue:StringEquals"
variable = "kms:EncryptionContext:service"
values = ["pi"]
}
condition {
test = "ForAnyValue:StringEquals"
variable = "kms:EncryptionContext:aws:pi:service"
values = ["rds"]
}
condition {
test = "ForAnyValue:StringEquals"
variable = "kms:EncryptionContext:aws:rds:db-id"
values = ["db-AAAAABBBBBCCCCCDDDDDEEEEE", "db-EEEEEDDDDDCCCCCBBBBBAAAAA"]
}
}
}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": [
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"kms:EncryptionContext:aws:pi:service": "rds",
"kms:EncryptionContext:aws:rds:db-id": [
"db-AAAAABBBBBCCCCCDDDDDEEEEE",
"db-EEEEEDDDDDCCCCCBBBBBAAAAA"
],
"kms:EncryptionContext:service": "pi"
}
}
}
]
}
module "servers" {
source = "./app-cluster"
server = 5
}
module "consul" {
source = "hashicorp/consul/aws"
version = "0.0.5"
server = 3
}
arguments
defaule: 기본값
type: string, number, bool, list, set, map, object, tuple
description: 설명
validation: 검증 규칙
variable "image_id" {
type = string
description = "The id of machine image (AMI) to use for the server."
validation {
condition = length(var.image_id) > 4 && substr(var.image_id, 0, 4) == "ami-"
error_message = "The image_id value must be a valid AMI id, starting with \"ami-\"."
sensitive: plan, apply 할 때 해당 값을 출력하지 않게 하는 옵션 (개인정보 등 민감한 정보)
nullable: null 여부
locals {
service_name = "forum"
owner = "Community Team"
표현식을 여러번 반복할 때 사용
locals {
instance_ids = concat (aws_instance.blue.*.id, aws_instance.green.*.id)
}
locals {
common_tag = {
Service = local.service_name
Owner = local.owner
}
}
# main.tf
module "foo" {
source = "./mod"
}
resource "test_instance" "x" {
some_attribute = module.foo.a
}
output "out" {
value = "xyz"
sensitive = true
}
# mod/main.tf, our module containing a sensitive output
output "a" {
value = "secret"
sensitive = true
}
- resource : <resource type>.<name>
- data : data.<data type>.<name>
- input : var.<name>
- local : local.<name>
- child module output : module.<module name>.<output>
- workspace : terraform.workspace
- filesystem : path.module, path.root, path.cw`