Terraform Registory を使ってみた。

https://github.com/terraform-aws-modules

$ mkdir Terraform/modules
$ cd Terraform/modules

$  git clone https://github.com/terraform-aws-modules/terraform-aws-vpc
$ git clone https://github.com/terraform-aws-modules/terraform-aws-ec2-instance

$ git clone https://github.com/terraform-aws-modules/terraform-aws-alb
$ git clone https://github.com/terraform-aws-modules/terraform-aws-s3-bucket

$ git clone https://github.com/terraform-aws-modules/terraform-aws-rds-aurora

$ git clone https://github.com/terraform-aws-modules/terraform-aws-iam

$ git clone https://github.com/terraform-aws-modules/terraform-aws-rds

$ git clone https://github.com/terraform-aws-modules/terraform-aws-security-group

$ ln -s terraform-aws-vpc vpc

$ ln -s terraform-aws-ec2-instance ec2

$ ln -s terraform-aws-alb alb

$ ln -s terraform-aws-s3-bucket s3

$ ln -s terraform-aws-rds-aurora aurora

$ ln -s terraform-aws-rds rds

$ ln -s terraform-aws-iam iam

$ ln -s terraform-aws-security-group sg

CentOS brew インストール

# yum install git-all

# git --version
git version 2.37.1

# yum groupinstall 'Development Tools' && sudo yum install curl file git ruby which

$ sh -c "$(curl -fsSL https://raw.githubusercontent.com/Linuxbrew/install/master/install.sh)"

$ echo 'eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv)' >>~/.bash_profile

$ eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv)

確認

$ brew install hello

Terraform

【terraform aws 公式ドキュメント】

https://registry.terraform.io/providers/hashicorp/aws/latest/docs

tfenv 越しにtrratermインストール

$ git clone https://github.com/tfutils/tfenv.git ~/.tfenv    # インストール

$ sudo ln -s ~/.tfenv/bin/* /usr/local/bin                                  # PATH

$ tfenv list-remote                                                                              # バージョン確認

$ tfenv install 1.2.8

$ tfenv use 1.2.8                                                                                  # バージョン切り替え

$ tfenv list

$ terraform init

$ terraform init -reconfigure

$ 

$ terraform plan

$ terraform validate     # 構文チェック

$ terraform fmt              # 構文整形

$ terraform apply

$ terraform destroy

$ terraform destroy -taget = aaaa.aaaa

$ terraform workspace new "stage"

$ terraform workspace new "prod"

$ terraform workspace list

$ terraform workspace select stage

$ terraform workspace delete "prod"

$ terraform console

> cidrsubnet("10.0.0.0/16", 8, 1)

"10.0.1.0/24"

※ネットワーク部を8ビット拡張して、1を代入

1) s3にバケット(test-terraform-tfstate)作成

2) terraform ユーザ作成

3) assume role 作成

     test-AssumeRole-for-terraform

{

"Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "s3:PutObject", "s3:GetObject", "s3:GetObjectVersion", "s3:DeleteObject", "s3:DeleteObjectVersion" ], "Resource":"arn:aws:s3:::test-terraform-ttfstate/*" } ] }

4) terraform ユーザにassume権限を付加

# vi settings.tf

terraform { 

    required_version = "1.2.8"

    backend "s3" {

        backet = "test-terraform-tfstate"

        key = "test-teraform"

        reagion = "ap-northeast-1"

    }

}

provider "aws" {

    reagion = "ap-northeast-1"

}

"demo-vpc"   → "${terraform.workspace}-demo-vpc"

assume role

 1. role作成→AWSのサービス→EC2

ロール名称： test-AssumeRole-for-tester

{

       "Version": "2012-10-17",
        "Statement": [
        {
            "Effect": "Allow",  
            "Action": [
            "sts:AssumeRole"
            ],
            "Principal": {
                "Service": [
                "ec2.amazonaws.com"
                ]
            }
        }
    ]
}

2. 対象ユーザ→インラインポリシ追加→

    サービス選択→sts

    アクション追加→assume→ AssumeRole

    リソース→role→ARNの追加→arn:aws:iam::99999999999:role/test-AssumeRole-for-tester→追加

    

    ポリシー名前:test-inline-AssumeRole-tester →ポリシ作成

3. ロールをアカウントに変更

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::999999999999999:user/tester"
},
"Action": "sts:AssumeRole"
}
]
}

$ aws sts assume-role --role-arn arn:aws:iam::999999999999:role/test-assume-role-s3FullAccess --role-session-name s3accessSitai --duration-second 900 --profile tester

$ vi .aws/config

[default]

output = json

region = ap-northeast-1

[profile tester]

output = json

region = ap-northeast-1

[profile s3-full-access-man]

output = json

region = ap-northeast-1      

  

$ vi .aws/credentials

[s3-full-access-man]

aws_access_key_id = xxxxxx

aws_secret_access_key = yyyyyyy

aws_session_token = zzzzzzzz

$ aws --profile tester  s3 ls

An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied

$ aws --profile assume-s3-fullaccess-user  s3 ls

$ aws --profile assume-ec2-fullaccess-user ec2 describe-instances

AWS CLI config

$ aws configure

$ aws ec2 describe-vpcs
{
"Vpcs": [
{
"VpcId": "vpc-027937fa6634e3240",
"InstanceTenancy": "default",
"Tags": [
{
"Value": "test",
"Key": "Name"
}
],
"CidrBlockAssociationSet": [
{
"AssociationId": "vpc-cidr-assoc-002ab330e002211a3",
"CidrBlock": "192.168.0.0/16",
"CidrBlockState": {
"State": "associated"
}
}
],
"State": "available",
"DhcpOptionsId": "dopt-0bf5659c981e8ca7c",
"OwnerId": "xxxxxxxxxxxxxx",
"CidrBlock": "192.168.0.0/16",
"IsDefault": false
}
]
}

]

$ aws ec2 describe-vpcs --query  Vpcs[].VpcId

AWS Application Deploy デプロイ

$  cd Make
$ ./save
$ ./aws_put

$ ssh aws.test

$ cd 

$ tar xvzf  Release.tar.20220805

$ sudo sh -c "rm -rf /var/www/wsgi/Release.1; mv /var/www/wsgi/Release /var/www/wsgi/Release.1; mv /home/ec2-user/Release  /var/www/wsgi/Release"

【環境構築】

$ sudo sh

# cd /var/www/wsgi/Release

# . ./env

# ./env create

$ vi requirements.txt

dataclasses==0.8 → 0.6

※Collecting pyreportjasper==2.1.2 # 違うサーバでは再現しなかった。？
Killed
# pip3 --no-cache-dir install pyreportjasper $INTERNET_PROXY で回避

. 

Package            Version Latest Type

------------------ ------- ------ -----

charset-normalizer      2.0.12  2.1.0  wheel

importlib-metadata     2.1.3   4.8.3  wheel

PyJWT                                1.7.1   2.4.0  wheel

setuptools                       39.2.0  59.6.0 wheel

tzlocal                                2.1     4.2    wheel

→epelを有効にしてインストール
# amazon-linux-extras install epel -y
# yum install zbar

# cd /var/www/wsgi

# chown -R apache:apache Releas

# tar cvzf delivery.tar Release