AI 助理
备案控制台
开发者社区 开发与运维 文章 正文

基础设施自动化实践——用Terraform自动化构建云上环境

2022-10-17 1289
版权
版权声明：
本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《 阿里云开发者社区用户服务协议》和 《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写 侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
简介： 前言在我们平时的开发工作中，经常会遇到需要搭建各式各样的云上环境，比如项目开发环境、测试环境、部署环境、客户展示环境等。而有时这些搭建过程并不轻松，如可能涉及很多台ECS，可能对镜像或配置有特殊要求，可能涉及较为复杂的网络配置等。而对于这些较为复杂多变的环境部署要求，传统的人工手动配置方法，不仅耗时费力，还有一个很大的问题就是难以追踪管理、难以复用。比如负责搭建环境的架构师如果休假了，团队其他人很

前言

在我们平时的开发工作中，经常会遇到需要搭建各式各样的云上环境，比如项目开发环境、测试环境、部署环境、客户展示环境等。而有时这些搭建过程并不轻松，如可能涉及很多台ECS，可能对镜像或配置有特殊要求，可能涉及较为复杂的网络配置等。而对于这些较为复杂多变的环境部署要求，传统的人工手动配置方法，不仅耗时费力，还有一个很大的问题就是难以追踪管理、难以复用。比如负责搭建环境的架构师如果休假了，团队其他人很难搞清楚如何快速更改当前环境的配置或快速搭建另一套类似的环境。

在软件开发领域，一个很重要的原则就是我们应该尽可能地将一切流程代码化、Git化，以便共享与复用，并实现自动化。在CI/CD领域，我们已经体验到了尽可能地将编译、部署、测试、发布等流程脚本化、自动化。而在基础设施环境搭建方面，也有同样的思路。我们可以借助于Terraform，轻松地实现基础设施即代码（Infrastructure as code）。

背景

关于Terraform本身的使用说明或介绍教程已有很多，本文将不再赘述Terraform本身涉及的基础概念、语法、命令或用法，而是以具体、真实的案例为例，向大家介绍一下如何利用Terraform完成云上环境构建自动化。该案例的背景是我们希望在阿里云上构建一个demo环境，用于部署我们的风险管理产品，并希望能模拟客户环境中遭遇的恶意行为，产生真实的风险分数变化告警。为了简化并清晰起见，我这里简单地将要求列举如下：

  1. 云上同一个区域内申请4台ECS，规格尽可能小，且采用较旧的debian镜像（节约成本；该版本漏洞较多，便于模拟客户环境产生告警）。
  2. 要求能访问公网。
  3. 每个实例上希望能自动化定时运行恶意脚本（脚本中包含一些高风险请求，用于模拟客户环境正在遭受恶意行为）。

初始化

阿里云提供了两种方式运行Terraform，一种是通过CloudShell，另一种是通过本地CLI。为了便于与Git交互，建议在本地安装Terraform，并为项目创建Git仓库。每次试图变更环境之前，可以先从Git拉取最新的Terraform文件，本地比较、修改后，执行Terraform变更到远程云上环境；环境变更执行成功后，记得及时提交变更文件到远程Git。

在本地CLI执行Terraform的有效命令之前，还需要配置阿里云上所需的ak/sk等信息，以便连接云上provider，示例如下：

export ALICLOUD_ACCESS_KEY="ak"
export ALICLOUD_SECRET_KEY="sk"
export ALICLOUD_REGION="cn-hangzhou"

创建ECS实例

我们先从创建ECS示例开始，这其实是我们平时使用云环境中最经常遇到的场景。我们可以直接使用alicloud_instance（https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/instance）来创建，也可以使ecs_instance的module(https://registry.terraform.io/modules/alibaba/ecs-instance/alicloud/latest)来创建。module是对resource的封装，使用起来更简单快捷。因为我们一次需要创建多个实例，这里采用module的形式，配置代码如下：

variable "profile" {
  default = "default"
}

variable "region" {
  default = "cn-hangzhou"
}

variable "zone_id" {
  default = "cn-hangzhou-h"
}

variable "instances_number" {
  default = 4
}

provider "alicloud" {
  region  = var.region
  profile = var.profile
}

resource "alicloud_vpc" "vpc" {
  vpc_name   = "vpc_tf_demo"
  cidr_block = "172.16.0.0/12"
}

resource "alicloud_vswitch" "vsw" {
  vpc_id     = alicloud_vpc.vpc.id
  cidr_block = "172.16.0.0/21"
  zone_id    = var.zone_id
}

resource "alicloud_security_group" "default" {
  name   = "default"
  vpc_id = alicloud_vpc.vpc.id
}

resource "alicloud_security_group_rule" "allow_all_tcp" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "1/65535"
  priority          = 1
  security_group_id = alicloud_security_group.default.id
  cidr_ip           = "0.0.0.0/0"
}

data "alicloud_images" "debian" {
  most_recent = false
  name_regex  = "^debian_8_09_64_20G_alibase_20170824.vhd"
}

module "tf-instances" {
  source                      = "alibaba/ecs-instance/alicloud"
  region                      = var.region
  number_of_instances         = var.instances_number
  vswitch_id                  = alicloud_vswitch.vsw.id
  group_ids                   = [alicloud_security_group.default.id]
  private_ips                 = ["172.16.0.9", "172.16.0.10", "172.16.0.11", "172.16.0.12"]
  image_id                    = data.alicloud_images.debian.ids.0
  instance_type               = "ecs.s6-c1m1.small"
  associate_public_ip_address = false
  instance_name               = "demo_instance_"
  host_name                   = "tf-demo"
  internet_charge_type        = "PayByTraffic"
  password                    = "password123"
  system_disk_category        = "cloud_ssd"
  system_disk_size            = 20

  tags = {
    Created     = "Terraform"
    env         = "pre"
    application = "online-shop"
  }
}

这里我们简单定义了一些variable变量，指定了alicloud provider，定义了vpc/vswitch/security_group/security_group_rule等资源；指定了镜像为某个较旧版本的debian；并利用ecs-instance的module创建了4个ECS实例，其中分别指定了private_ip/instance_name/disk/tags等信息。

init

编写完成terraform文件之后，需要执行Terraform init来初始化该Terraform文件所在的目录，并下载必要的插件。执行成功后的提示信息如下：

shanyao:terraform-ata shanyao$ terraform init
Initializing modules...

Initializing the backend...

Initializing provider plugins...
- Reusing previous version of hashicorp/alicloud from the dependency lock file
- Using previously-installed hashicorp/alicloud v1.186.0

╷
│ Warning: Additional provider information from registry
│ 
│ The remote registry returned warnings for registry.terraform.io/hashicorp/alicloud:
│ - For users on Terraform 0.13 or greater, this provider has moved to aliyun/alicloud. Please update your source in required_providers.
╵

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

大家可以看到，在init执行的过程中，下载了provider/modules等插件，并完成了目录的初始化。初始化完成后的工程目录如下：

可见，在.teraform文件下，新增了modules/providers等插件。

plan

完成init之后，可以通过terraform plan来查看本次变更所涉及的远程资源变更，执行后的结果如下：

shanyao:terraform-ata shanyao$ terraform plan
data.alicloud_images.debian: Reading...
data.alicloud_images.debian: Read complete after 2s [id=4116092999]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # alicloud_security_group.default will be created
  + resource "alicloud_security_group" "default" {
      + id                  = (known after apply)
      + inner_access        = (known after apply)
      + inner_access_policy = (known after apply)
      + name                = "default"
      + security_group_type = "normal"
      + vpc_id              = (known after apply)
    }

  # alicloud_security_group_rule.allow_all_tcp will be created
  + resource "alicloud_security_group_rule" "allow_all_tcp" {
      + cidr_ip           = "0.0.0.0/0"
      + id                = (known after apply)
      + ip_protocol       = "tcp"
      + nic_type          = "intranet"
      + policy            = "accept"
      + port_range        = "1/65535"
      + prefix_list_id    = (known after apply)
      + priority          = 1
      + security_group_id = (known after apply)
      + type              = "ingress"
    }

  # alicloud_vpc.vpc will be created
  + resource "alicloud_vpc" "vpc" {
      + cidr_block            = "172.16.0.0/12"
      + id                    = (known after apply)
      + ipv6_cidr_block       = (known after apply)
      + name                  = (known after apply)
      + resource_group_id     = (known after apply)
      + route_table_id        = (known after apply)
      + router_id             = (known after apply)
      + router_table_id       = (known after apply)
      + secondary_cidr_blocks = (known after apply)
      + status                = (known after apply)
      + vpc_name              = "vpc_tf_demo"
    }

  # alicloud_vswitch.vsw will be created
  + resource "alicloud_vswitch" "vsw" {
      + availability_zone = (known after apply)
      + cidr_block        = "172.16.0.0/21"
      + id                = (known after apply)
      + name              = (known after apply)
      + status            = (known after apply)
      + vpc_id            = (known after apply)
      + vswitch_name      = (known after apply)
      + zone_id           = "cn-hangzhou-h"
    }

  # module.tf-instances.alicloud_instance.this[0] will be created
  + resource "alicloud_instance" "this" {
      + availability_zone                  = (known after apply)
      + credit_specification               = (known after apply)
      + deletion_protection                = false
      + deployment_set_group_no            = (known after apply)
      + description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance"
      + dry_run                            = false
      + host_name                          = "tf-demo001"
      + id                                 = (known after apply)
      + image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd"
      + instance_charge_type               = "PostPaid"
      + instance_name                      = "demo_instance_001"
      + instance_type                      = "ecs.s6-c1m1.small"
      + internet_max_bandwidth_in          = (known after apply)
      + internet_max_bandwidth_out         = 0
      + key_name                           = (known after apply)
      + maintenance_action                 = (known after apply)
      + operator_type                      = "upgrade"
      + private_ip                         = "172.16.0.9"
      + public_ip                          = (known after apply)
      + role_name                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ips              = (known after apply)
      + security_enhancement_strategy      = "Active"
      + security_groups                    = (known after apply)
      + spot_strategy                      = "NoSpot"
      + status                             = "Running"
      + stopped_mode                       = (known after apply)
      + subnet_id                          = (known after apply)
      + system_disk_category               = "cloud_ssd"
      + system_disk_performance_level      = (known after apply)
      + system_disk_size                   = 20
      + tags                               = {
          + "Created"     = "Terraform"
          + "Name"        = "demo_instance_001"
          + "application" = "online-shop"
          + "env"         = "pre"
        }
      + volume_tags                        = {
          + "Name" = "demo_instance_001"
        }
      + vswitch_id                         = (known after apply)
    }

  # module.tf-instances.alicloud_instance.this[1] will be created
  + resource "alicloud_instance" "this" {
      + availability_zone                  = (known after apply)
      + credit_specification               = (known after apply)
      + deletion_protection                = false
      + deployment_set_group_no            = (known after apply)
      + description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance"
      + dry_run                            = false
      + host_name                          = "tf-demo002"
      + id                                 = (known after apply)
      + image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd"
      + instance_charge_type               = "PostPaid"
      + instance_name                      = "demo_instance_002"
      + instance_type                      = "ecs.s6-c1m1.small"
      + internet_max_bandwidth_in          = (known after apply)
      + internet_max_bandwidth_out         = 0
      + key_name                           = (known after apply)
      + maintenance_action                 = (known after apply)
      + operator_type                      = "upgrade"
      + private_ip                         = "172.16.0.10"
      + public_ip                          = (known after apply)
      + role_name                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ips              = (known after apply)
      + security_enhancement_strategy      = "Active"
      + security_groups                    = (known after apply)
      + spot_strategy                      = "NoSpot"
      + status                             = "Running"
      + stopped_mode                       = (known after apply)
      + subnet_id                          = (known after apply)
      + system_disk_category               = "cloud_ssd"
      + system_disk_performance_level      = (known after apply)
      + system_disk_size                   = 20
      + tags                               = {
          + "Created"     = "Terraform"
          + "Name"        = "demo_instance_002"
          + "application" = "online-shop"
          + "env"         = "pre"
        }
      + volume_tags                        = {
          + "Name" = "demo_instance_002"
        }
      + vswitch_id                         = (known after apply)
    }

  # module.tf-instances.alicloud_instance.this[2] will be created
  + resource "alicloud_instance" "this" {
      + availability_zone                  = (known after apply)
      + credit_specification               = (known after apply)
      + deletion_protection                = false
      + deployment_set_group_no            = (known after apply)
      + description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance"
      + dry_run                            = false
      + host_name                          = "tf-demo003"
      + id                                 = (known after apply)
      + image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd"
      + instance_charge_type               = "PostPaid"
      + instance_name                      = "demo_instance_003"
      + instance_type                      = "ecs.s6-c1m1.small"
      + internet_max_bandwidth_in          = (known after apply)
      + internet_max_bandwidth_out         = 0
      + key_name                           = (known after apply)
      + maintenance_action                 = (known after apply)
      + operator_type                      = "upgrade"
      + private_ip                         = "172.16.0.11"
      + public_ip                          = (known after apply)
      + role_name                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ips              = (known after apply)
      + security_enhancement_strategy      = "Active"
      + security_groups                    = (known after apply)
      + spot_strategy                      = "NoSpot"
      + status                             = "Running"
      + stopped_mode                       = (known after apply)
      + subnet_id                          = (known after apply)
      + system_disk_category               = "cloud_ssd"
      + system_disk_performance_level      = (known after apply)
      + system_disk_size                   = 20
      + tags                               = {
          + "Created"     = "Terraform"
          + "Name"        = "demo_instance_003"
          + "application" = "online-shop"
          + "env"         = "pre"
        }
      + volume_tags                        = {
          + "Name" = "demo_instance_003"
        }
      + vswitch_id                         = (known after apply)
    }

  # module.tf-instances.alicloud_instance.this[3] will be created
  + resource "alicloud_instance" "this" {
      + availability_zone                  = (known after apply)
      + credit_specification               = (known after apply)
      + deletion_protection                = false
      + deployment_set_group_no            = (known after apply)
      + description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance"
      + dry_run                            = false
      + host_name                          = "tf-demo004"
      + id                                 = (known after apply)
      + image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd"
      + instance_charge_type               = "PostPaid"
      + instance_name                      = "demo_instance_004"
      + instance_type                      = "ecs.s6-c1m1.small"
      + internet_max_bandwidth_in          = (known after apply)
      + internet_max_bandwidth_out         = 0
      + key_name                           = (known after apply)
      + maintenance_action                 = (known after apply)
      + operator_type                      = "upgrade"
      + private_ip                         = "172.16.0.12"
      + public_ip                          = (known after apply)
      + role_name                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ips              = (known after apply)
      + security_enhancement_strategy      = "Active"
      + security_groups                    = (known after apply)
      + spot_strategy                      = "NoSpot"
      + status                             = "Running"
      + stopped_mode                       = (known after apply)
      + subnet_id                          = (known after apply)
      + system_disk_category               = "cloud_ssd"
      + system_disk_performance_level      = (known after apply)
      + system_disk_size                   = 20
      + tags                               = {
          + "Created"     = "Terraform"
          + "Name"        = "demo_instance_004"
          + "application" = "online-shop"
          + "env"         = "pre"
        }
      + volume_tags                        = {
          + "Name" = "demo_instance_004"
        }
      + vswitch_id                         = (known after apply)
    }

Plan: 8 to add, 0 to change, 0 to destroy.

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

可见，该命令提示我们，该执行计划将会创建security_group/security_group_rule/vpc/vswitch，以及4个alicloud_instance实例；总计涉及8个资源的add（4个网络相关资源和4个ECS实例）。

apply

执行计划查看后，若符合预期，则可以通过terraform apply命令执行变更到云上，执行后的示例结果如下：

shanyao:terraform-ata shanyao$ terraform apply
data.alicloud_images.debian: Reading...
data.alicloud_images.debian: Read complete after 2s [id=4116092999]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # alicloud_security_group.default will be created
  + resource "alicloud_security_group" "default" {
      + id                  = (known after apply)
      + inner_access        = (known after apply)
      + inner_access_policy = (known after apply)
      + name                = "default"
      + security_group_type = "normal"
      + vpc_id              = (known after apply)
    }

  # alicloud_security_group_rule.allow_all_tcp will be created
  + resource "alicloud_security_group_rule" "allow_all_tcp" {
      + cidr_ip           = "0.0.0.0/0"
      + id                = (known after apply)
      + ip_protocol       = "tcp"
      + nic_type          = "intranet"
      + policy            = "accept"
      + port_range        = "1/65535"
      + prefix_list_id    = (known after apply)
      + priority          = 1
      + security_group_id = (known after apply)
      + type              = "ingress"
    }

  # alicloud_vpc.vpc will be created
  + resource "alicloud_vpc" "vpc" {
      + cidr_block            = "172.16.0.0/12"
      + id                    = (known after apply)
      + ipv6_cidr_block       = (known after apply)
      + name                  = (known after apply)
      + resource_group_id     = (known after apply)
      + route_table_id        = (known after apply)
      + router_id             = (known after apply)
      + router_table_id       = (known after apply)
      + secondary_cidr_blocks = (known after apply)
      + status                = (known after apply)
      + vpc_name              = "vpc_tf_demo"
    }

  # alicloud_vswitch.vsw will be created
  + resource "alicloud_vswitch" "vsw" {
      + availability_zone = (known after apply)
      + cidr_block        = "172.16.0.0/21"
      + id                = (known after apply)
      + name              = (known after apply)
      + status            = (known after apply)
      + vpc_id            = (known after apply)
      + vswitch_name      = (known after apply)
      + zone_id           = "cn-hangzhou-h"
    }

  # module.tf-instances.alicloud_instance.this[0] will be created
  + resource "alicloud_instance" "this" {
      + availability_zone                  = (known after apply)
      + credit_specification               = (known after apply)
      + deletion_protection                = false
      + deployment_set_group_no            = (known after apply)
      + description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance"
      + dry_run                            = false
      + host_name                          = "tf-demo001"
      + id                                 = (known after apply)
      + image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd"
      + instance_charge_type               = "PostPaid"
      + instance_name                      = "demo_instance_001"
      + instance_type                      = "ecs.s6-c1m1.small"
      + internet_max_bandwidth_in          = (known after apply)
      + internet_max_bandwidth_out         = 0
      + key_name                           = (known after apply)
      + maintenance_action                 = (known after apply)
      + operator_type                      = "upgrade"
      + private_ip                         = "172.16.0.9"
      + public_ip                          = (known after apply)
      + role_name                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ips              = (known after apply)
      + security_enhancement_strategy      = "Active"
      + security_groups                    = (known after apply)
      + spot_strategy                      = "NoSpot"
      + status                             = "Running"
      + stopped_mode                       = (known after apply)
      + subnet_id                          = (known after apply)
      + system_disk_category               = "cloud_ssd"
      + system_disk_performance_level      = (known after apply)
      + system_disk_size                   = 20
      + tags                               = {
          + "Created"     = "Terraform"
          + "Name"        = "demo_instance_001"
          + "application" = "online-shop"
          + "env"         = "pre"
        }
      + volume_tags                        = {
          + "Name" = "demo_instance_001"
        }
      + vswitch_id                         = (known after apply)
    }

  # module.tf-instances.alicloud_instance.this[1] will be created
  + resource "alicloud_instance" "this" {
      + availability_zone                  = (known after apply)
      + credit_specification               = (known after apply)
      + deletion_protection                = false
      + deployment_set_group_no            = (known after apply)
      + description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance"
      + dry_run                            = false
      + host_name                          = "tf-demo002"
      + id                                 = (known after apply)
      + image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd"
      + instance_charge_type               = "PostPaid"
      + instance_name                      = "demo_instance_002"
      + instance_type                      = "ecs.s6-c1m1.small"
      + internet_max_bandwidth_in          = (known after apply)
      + internet_max_bandwidth_out         = 0
      + key_name                           = (known after apply)
      + maintenance_action                 = (known after apply)
      + operator_type                      = "upgrade"
      + private_ip                         = "172.16.0.10"
      + public_ip                          = (known after apply)
      + role_name                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ips              = (known after apply)
      + security_enhancement_strategy      = "Active"
      + security_groups                    = (known after apply)
      + spot_strategy                      = "NoSpot"
      + status                             = "Running"
      + stopped_mode                       = (known after apply)
      + subnet_id                          = (known after apply)
      + system_disk_category               = "cloud_ssd"
      + system_disk_performance_level      = (known after apply)
      + system_disk_size                   = 20
      + tags                               = {
          + "Created"     = "Terraform"
          + "Name"        = "demo_instance_002"
          + "application" = "online-shop"
          + "env"         = "pre"
        }
      + volume_tags                        = {
          + "Name" = "demo_instance_002"
        }
      + vswitch_id                         = (known after apply)
    }

  # module.tf-instances.alicloud_instance.this[2] will be created
  + resource "alicloud_instance" "this" {
      + availability_zone                  = (known after apply)
      + credit_specification               = (known after apply)
      + deletion_protection                = false
      + deployment_set_group_no            = (known after apply)
      + description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance"
      + dry_run                            = false
      + host_name                          = "tf-demo003"
      + id                                 = (known after apply)
      + image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd"
      + instance_charge_type               = "PostPaid"
      + instance_name                      = "demo_instance_003"
      + instance_type                      = "ecs.s6-c1m1.small"
      + internet_max_bandwidth_in          = (known after apply)
      + internet_max_bandwidth_out         = 0
      + key_name                           = (known after apply)
      + maintenance_action                 = (known after apply)
      + operator_type                      = "upgrade"
      + private_ip                         = "172.16.0.11"
      + public_ip                          = (known after apply)
      + role_name                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ips              = (known after apply)
      + security_enhancement_strategy      = "Active"
      + security_groups                    = (known after apply)
      + spot_strategy                      = "NoSpot"
      + status                             = "Running"
      + stopped_mode                       = (known after apply)
      + subnet_id                          = (known after apply)
      + system_disk_category               = "cloud_ssd"
      + system_disk_performance_level      = (known after apply)
      + system_disk_size                   = 20
      + tags                               = {
          + "Created"     = "Terraform"
          + "Name"        = "demo_instance_003"
          + "application" = "online-shop"
          + "env"         = "pre"
        }
      + volume_tags                        = {
          + "Name" = "demo_instance_003"
        }
      + vswitch_id                         = (known after apply)
    }

  # module.tf-instances.alicloud_instance.this[3] will be created
  + resource "alicloud_instance" "this" {
      + availability_zone                  = (known after apply)
      + credit_specification               = (known after apply)
      + deletion_protection                = false
      + deployment_set_group_no            = (known after apply)
      + description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance"
      + dry_run                            = false
      + host_name                          = "tf-demo004"
      + id                                 = (known after apply)
      + image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd"
      + instance_charge_type               = "PostPaid"
      + instance_name                      = "demo_instance_004"
      + instance_type                      = "ecs.s6-c1m1.small"
      + internet_max_bandwidth_in          = (known after apply)
      + internet_max_bandwidth_out         = 0
      + key_name                           = (known after apply)
      + maintenance_action                 = (known after apply)
      + operator_type                      = "upgrade"
      + private_ip                         = "172.16.0.12"
      + public_ip                          = (known after apply)
      + role_name                          = (known after apply)
      + secondary_private_ip_address_count = (known after apply)
      + secondary_private_ips              = (known after apply)
      + security_enhancement_strategy      = "Active"
      + security_groups                    = (known after apply)
      + spot_strategy                      = "NoSpot"
      + status                             = "Running"
      + stopped_mode                       = (known after apply)
      + subnet_id                          = (known after apply)
      + system_disk_category               = "cloud_ssd"
      + system_disk_performance_level      = (known after apply)
      + system_disk_size                   = 20
      + tags                               = {
          + "Created"     = "Terraform"
          + "Name"        = "demo_instance_004"
          + "application" = "online-shop"
          + "env"         = "pre"
        }
      + volume_tags                        = {
          + "Name" = "demo_instance_004"
        }
      + vswitch_id                         = (known after apply)
    }

Plan: 8 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_vpc.vpc: Creating...
alicloud_vpc.vpc: Creation complete after 6s [id=vpc-bp13jb0hn8gvlk7frvngl]
alicloud_security_group.default: Creating...
alicloud_vswitch.vsw: Creating...
alicloud_security_group.default: Creation complete after 1s [id=sg-bp14g56wck3nk5qlvlyl]
alicloud_security_group_rule.allow_all_tcp: Creating...
alicloud_security_group_rule.allow_all_tcp: Creation complete after 1s [id=sg-bp14g56wck3nk5qlvlyl:ingress:tcp:1/65535:intranet:0.0.0.0/0:accept:1]
alicloud_vswitch.vsw: Creation complete after 6s [id=vsw-bp14yu7pmsg7zkkvry3vb]
module.tf-instances.alicloud_instance.this[2]: Creating...
module.tf-instances.alicloud_instance.this[1]: Creating...
module.tf-instances.alicloud_instance.this[3]: Creating...
module.tf-instances.alicloud_instance.this[0]: Creating...
module.tf-instances.alicloud_instance.this[2]: Still creating... [10s elapsed]
module.tf-instances.alicloud_instance.this[1]: Still creating... [10s elapsed]
module.tf-instances.alicloud_instance.this[3]: Still creating... [10s elapsed]
module.tf-instances.alicloud_instance.this[0]: Still creating... [10s elapsed]
module.tf-instances.alicloud_instance.this[0]: Still creating... [20s elapsed]
module.tf-instances.alicloud_instance.this[1]: Still creating... [20s elapsed]
module.tf-instances.alicloud_instance.this[3]: Still creating... [20s elapsed]
module.tf-instances.alicloud_instance.this[2]: Still creating... [20s elapsed]
module.tf-instances.alicloud_instance.this[0]: Creation complete after 22s [id=i-bp15veru9k3viz048x9f]
module.tf-instances.alicloud_instance.this[1]: Creation complete after 22s [id=i-bp1dtiqbjgjinghn478b]
module.tf-instances.alicloud_instance.this[3]: Creation complete after 22s [id=i-bp1b3a43b6c7sfffcbsp]
module.tf-instances.alicloud_instance.this[2]: Creation complete after 22s [id=i-bp176ekeo6unrcunczdx]

Apply complete! Resources: 8 added, 0 changed, 0 destroyed.

该命令将再次提示我们即将进行的远程资源变更，若确认无误，需输入“yes”，则正式执行。最终提示我们执行完成，有8个资源已经added。

我们可以登录阿里云ECS控制台，查看确认新创建的实例信息，如下：

如果创建后的ECS实例不符合预期，也可以直接修改terraform文件，再通过plan、apply来执行变更。比如，我们可以新增或修改密码，plan提示如下：

shanyao:terraform-ata shanyao$ terraform plan
data.alicloud_images.debian: Reading...
alicloud_vpc.vpc: Refreshing state... [id=vpc-bp13jb0hn8gvlk7frvngl]
alicloud_security_group.default: Refreshing state... [id=sg-bp14g56wck3nk5qlvlyl]
alicloud_vswitch.vsw: Refreshing state... [id=vsw-bp14yu7pmsg7zkkvry3vb]
alicloud_security_group_rule.allow_all_tcp: Refreshing state... [id=sg-bp14g56wck3nk5qlvlyl:ingress:tcp:1/65535:intranet:0.0.0.0/0:accept:1]
data.alicloud_images.debian: Read complete after 2s [id=4116092999]
module.tf-instances.alicloud_instance.this[3]: Refreshing state... [id=i-bp1b3a43b6c7sfffcbsp]
module.tf-instances.alicloud_instance.this[1]: Refreshing state... [id=i-bp1dtiqbjgjinghn478b]
module.tf-instances.alicloud_instance.this[2]: Refreshing state... [id=i-bp176ekeo6unrcunczdx]
module.tf-instances.alicloud_instance.this[0]: Refreshing state... [id=i-bp15veru9k3viz048x9f]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.tf-instances.alicloud_instance.this[0] will be updated in-place
  ~ resource "alicloud_instance" "this" {
        id                                 = "i-bp15veru9k3viz048x9f"
      ~ password                           = (sensitive value)
        tags                               = {
            "Created"     = "Terraform"
            "Name"        = "demo_instance_001"
            "application" = "online-shop"
            "env"         = "pre"
        }
        # (30 unchanged attributes hidden)
    }

  # module.tf-instances.alicloud_instance.this[1] will be updated in-place
  ~ resource "alicloud_instance" "this" {
        id                                 = "i-bp1dtiqbjgjinghn478b"
      ~ password                           = (sensitive value)
        tags                               = {
            "Created"     = "Terraform"
            "Name"        = "demo_instance_002"
            "application" = "online-shop"
            "env"         = "pre"
        }
        # (30 unchanged attributes hidden)
    }

  # module.tf-instances.alicloud_instance.this[2] will be updated in-place
  ~ resource "alicloud_instance" "this" {
        id                                 = "i-bp176ekeo6unrcunczdx"
      ~ password                           = (sensitive value)
        tags                               = {
            "Created"     = "Terraform"
            "Name"        = "demo_instance_003"
            "application" = "online-shop"
            "env"         = "pre"
        }
        # (30 unchanged attributes hidden)
    }

  # module.tf-instances.alicloud_instance.this[3] will be updated in-place
  ~ resource "alicloud_instance" "this" {
        id                                 = "i-bp1b3a43b6c7sfffcbsp"
      ~ password                           = (sensitive value)
        tags                               = {
            "Created"     = "Terraform"
            "Name"        = "demo_instance_004"
            "application" = "online-shop"
            "env"         = "pre"
        }
        # (30 unchanged attributes hidden)
    }

Plan: 0 to add, 4 to change, 0 to destroy.

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

其中有4个change。

destroy

而如果依然不符合预期，或者你想释放或销毁所有terraform创建的资源。可通过terraform destory命令摧毁一切。为了确保销毁过程符合预期，你可以通过terraform plan -destroy命令来查看销毁的执行计划，如下：

shanyao:terraform-ata shanyao$ terraform plan -destroy
alicloud_vpc.vpc: Refreshing state... [id=vpc-bp13jb0hn8gvlk7frvngl]
data.alicloud_images.debian: Reading...
alicloud_security_group.default: Refreshing state... [id=sg-bp14g56wck3nk5qlvlyl]
alicloud_vswitch.vsw: Refreshing state... [id=vsw-bp14yu7pmsg7zkkvry3vb]
alicloud_security_group_rule.allow_all_tcp: Refreshing state... [id=sg-bp14g56wck3nk5qlvlyl:ingress:tcp:1/65535:intranet:0.0.0.0/0:accept:1]
data.alicloud_images.debian: Read complete after 2s [id=4116092999]
module.tf-instances.alicloud_instance.this[3]: Refreshing state... [id=i-bp1b3a43b6c7sfffcbsp]
module.tf-instances.alicloud_instance.this[2]: Refreshing state... [id=i-bp176ekeo6unrcunczdx]
module.tf-instances.alicloud_instance.this[1]: Refreshing state... [id=i-bp1dtiqbjgjinghn478b]
module.tf-instances.alicloud_instance.this[0]: Refreshing state... [id=i-bp15veru9k3viz048x9f]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # alicloud_security_group.default will be destroyed
  - resource "alicloud_security_group" "default" {
      - id                  = "sg-bp14g56wck3nk5qlvlyl" -> null
      - inner_access        = true -> null
      - inner_access_policy = "Accept" -> null
      - name                = "default" -> null
      - security_group_type = "normal" -> null
      - tags                = {} -> null
      - vpc_id              = "vpc-bp13jb0hn8gvlk7frvngl" -> null
    }

  # alicloud_security_group_rule.allow_all_tcp will be destroyed
  - resource "alicloud_security_group_rule" "allow_all_tcp" {
      - cidr_ip           = "0.0.0.0/0" -> null
      - id                = "sg-bp14g56wck3nk5qlvlyl:ingress:tcp:1/65535:intranet:0.0.0.0/0:accept:1" -> null
      - ip_protocol       = "tcp" -> null
      - nic_type          = "intranet" -> null
      - policy            = "accept" -> null
      - port_range        = "1/65535" -> null
      - priority          = 1 -> null
      - security_group_id = "sg-bp14g56wck3nk5qlvlyl" -> null
      - type              = "ingress" -> null
    }

  # alicloud_vpc.vpc will be destroyed
  - resource "alicloud_vpc" "vpc" {
      - cidr_block            = "172.16.0.0/12" -> null
      - id                    = "vpc-bp13jb0hn8gvlk7frvngl" -> null
      - name                  = "vpc_tf_demo" -> null
      - resource_group_id     = "rg-acfm3gyq7fqm2qa" -> null
      - route_table_id        = "vtb-bp1kbkehf4cm5wb1y6t8n" -> null
      - router_id             = "vrt-bp1pqrbr6ylqioadjdkee" -> null
      - router_table_id       = "vtb-bp1kbkehf4cm5wb1y6t8n" -> null
      - secondary_cidr_blocks = [] -> null
      - status                = "Available" -> null
      - user_cidrs            = [] -> null
      - vpc_name              = "vpc_tf_demo" -> null
    }

  # alicloud_vswitch.vsw will be destroyed
  - resource "alicloud_vswitch" "vsw" {
      - availability_zone = "cn-hangzhou-h" -> null
      - cidr_block        = "172.16.0.0/21" -> null
      - id                = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
      - status            = "Available" -> null
      - tags              = {} -> null
      - vpc_id            = "vpc-bp13jb0hn8gvlk7frvngl" -> null
      - zone_id           = "cn-hangzhou-h" -> null
    }

  # module.tf-instances.alicloud_instance.this[0] will be destroyed
  - resource "alicloud_instance" "this" {
      - availability_zone                  = "cn-hangzhou-h" -> null
      - deletion_protection                = false -> null
      - description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance" -> null
      - dry_run                            = false -> null
      - host_name                          = "tf-demo001" -> null
      - id                                 = "i-bp15veru9k3viz048x9f" -> null
      - image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd" -> null
      - instance_charge_type               = "PostPaid" -> null
      - instance_name                      = "demo_instance_001" -> null
      - instance_type                      = "ecs.s6-c1m1.small" -> null
      - internet_charge_type               = "PayByTraffic" -> null
      - internet_max_bandwidth_in          = -1 -> null
      - internet_max_bandwidth_out         = 0 -> null
      - maintenance_action                 = "AutoRecover" -> null
      - maintenance_notify                 = false -> null
      - operator_type                      = "upgrade" -> null
      - password                           = (sensitive value)
      - private_ip                         = "172.16.0.9" -> null
      - secondary_private_ip_address_count = 0 -> null
      - secondary_private_ips              = [] -> null
      - security_enhancement_strategy      = "Active" -> null
      - security_groups                    = [
          - "sg-bp14g56wck3nk5qlvlyl",
        ] -> null
      - spot_price_limit                   = 0 -> null
      - spot_strategy                      = "NoSpot" -> null
      - status                             = "Running" -> null
      - stopped_mode                       = "Not-applicable" -> null
      - subnet_id                          = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
      - system_disk_category               = "cloud_ssd" -> null
      - system_disk_encrypted              = false -> null
      - system_disk_size                   = 20 -> null
      - tags                               = {
          - "Created"     = "Terraform"
          - "Name"        = "demo_instance_001"
          - "application" = "online-shop"
          - "env"         = "pre"
        } -> null
      - volume_tags                        = {
          - "Name" = "demo_instance_001"
        } -> null
      - vswitch_id                         = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
    }

  # module.tf-instances.alicloud_instance.this[1] will be destroyed
  - resource "alicloud_instance" "this" {
      - availability_zone                  = "cn-hangzhou-h" -> null
      - deletion_protection                = false -> null
      - description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance" -> null
      - dry_run                            = false -> null
      - host_name                          = "tf-demo002" -> null
      - id                                 = "i-bp1dtiqbjgjinghn478b" -> null
      - image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd" -> null
      - instance_charge_type               = "PostPaid" -> null
      - instance_name                      = "demo_instance_002" -> null
      - instance_type                      = "ecs.s6-c1m1.small" -> null
      - internet_charge_type               = "PayByTraffic" -> null
      - internet_max_bandwidth_in          = -1 -> null
      - internet_max_bandwidth_out         = 0 -> null
      - maintenance_action                 = "AutoRecover" -> null
      - maintenance_notify                 = false -> null
      - operator_type                      = "upgrade" -> null
      - password                           = (sensitive value)
      - private_ip                         = "172.16.0.10" -> null
      - secondary_private_ip_address_count = 0 -> null
      - secondary_private_ips              = [] -> null
      - security_enhancement_strategy      = "Active" -> null
      - security_groups                    = [
          - "sg-bp14g56wck3nk5qlvlyl",
        ] -> null
      - spot_price_limit                   = 0 -> null
      - spot_strategy                      = "NoSpot" -> null
      - status                             = "Running" -> null
      - stopped_mode                       = "Not-applicable" -> null
      - subnet_id                          = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
      - system_disk_category               = "cloud_ssd" -> null
      - system_disk_encrypted              = false -> null
      - system_disk_size                   = 20 -> null
      - tags                               = {
          - "Created"     = "Terraform"
          - "Name"        = "demo_instance_002"
          - "application" = "online-shop"
          - "env"         = "pre"
        } -> null
      - volume_tags                        = {
          - "Name" = "demo_instance_002"
        } -> null
      - vswitch_id                         = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
    }

  # module.tf-instances.alicloud_instance.this[2] will be destroyed
  - resource "alicloud_instance" "this" {
      - availability_zone                  = "cn-hangzhou-h" -> null
      - deletion_protection                = false -> null
      - description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance" -> null
      - dry_run                            = false -> null
      - host_name                          = "tf-demo003" -> null
      - id                                 = "i-bp176ekeo6unrcunczdx" -> null
      - image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd" -> null
      - instance_charge_type               = "PostPaid" -> null
      - instance_name                      = "demo_instance_003" -> null
      - instance_type                      = "ecs.s6-c1m1.small" -> null
      - internet_charge_type               = "PayByTraffic" -> null
      - internet_max_bandwidth_in          = -1 -> null
      - internet_max_bandwidth_out         = 0 -> null
      - maintenance_action                 = "AutoRecover" -> null
      - maintenance_notify                 = false -> null
      - operator_type                      = "upgrade" -> null
      - password                           = (sensitive value)
      - private_ip                         = "172.16.0.11" -> null
      - secondary_private_ip_address_count = 0 -> null
      - secondary_private_ips              = [] -> null
      - security_enhancement_strategy      = "Active" -> null
      - security_groups                    = [
          - "sg-bp14g56wck3nk5qlvlyl",
        ] -> null
      - spot_price_limit                   = 0 -> null
      - spot_strategy                      = "NoSpot" -> null
      - status                             = "Running" -> null
      - stopped_mode                       = "Not-applicable" -> null
      - subnet_id                          = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
      - system_disk_category               = "cloud_ssd" -> null
      - system_disk_encrypted              = false -> null
      - system_disk_size                   = 20 -> null
      - tags                               = {
          - "Created"     = "Terraform"
          - "Name"        = "demo_instance_003"
          - "application" = "online-shop"
          - "env"         = "pre"
        } -> null
      - volume_tags                        = {
          - "Name" = "demo_instance_003"
        } -> null
      - vswitch_id                         = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
    }

  # module.tf-instances.alicloud_instance.this[3] will be destroyed
  - resource "alicloud_instance" "this" {
      - availability_zone                  = "cn-hangzhou-h" -> null
      - deletion_protection                = false -> null
      - description                        = "An ECS instance came from terraform-alicloud-modules/ecs-instance" -> null
      - dry_run                            = false -> null
      - host_name                          = "tf-demo004" -> null
      - id                                 = "i-bp1b3a43b6c7sfffcbsp" -> null
      - image_id                           = "debian_8_09_64_20G_alibase_20170824.vhd" -> null
      - instance_charge_type               = "PostPaid" -> null
      - instance_name                      = "demo_instance_004" -> null
      - instance_type                      = "ecs.s6-c1m1.small" -> null
      - internet_charge_type               = "PayByTraffic" -> null
      - internet_max_bandwidth_in          = -1 -> null
      - internet_max_bandwidth_out         = 0 -> null
      - maintenance_action                 = "AutoRecover" -> null
      - maintenance_notify                 = false -> null
      - operator_type                      = "upgrade" -> null
      - password                           = (sensitive value)
      - private_ip                         = "172.16.0.12" -> null
      - secondary_private_ip_address_count = 0 -> null
      - secondary_private_ips              = [] -> null
      - security_enhancement_strategy      = "Active" -> null
      - security_groups                    = [
          - "sg-bp14g56wck3nk5qlvlyl",
        ] -> null
      - spot_price_limit                   = 0 -> null
      - spot_strategy                      = "NoSpot" -> null
      - status                             = "Running" -> null
      - stopped_mode                       = "Not-applicable" -> null
      - subnet_id                          = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
      - system_disk_category               = "cloud_ssd" -> null
      - system_disk_encrypted              = false -> null
      - system_disk_size                   = 20 -> null
      - tags                               = {
          - "Created"     = "Terraform"
          - "Name"        = "demo_instance_004"
          - "application" = "online-shop"
          - "env"         = "pre"
        } -> null
      - volume_tags                        = {
          - "Name" = "demo_instance_004"
        } -> null
      - vswitch_id                         = "vsw-bp14yu7pmsg7zkkvry3vb" -> null
    }

Plan: 0 to add, 0 to change, 8 to destroy.

可见，这里列出了需要销毁的8个刚创建的资源。你可以在完成使用后，再及时释放这些资源。

配置公网访问

如上所示，我们顺利地创建了4台符合要求的ECS实例（已完成要求a）。但是这些实例默认是不能访问公网的，如果你确有需求需要访问公网，应该怎么办呢？

还需要依次申请nat网关、eip公网IP地址，将nat与eip绑定，并配置snat entry规则。你可以新增以下resource资源配置：

resource "alicloud_nat_gateway" "nat" {
  depends_on       = [alicloud_vswitch.vsw]
  vpc_id           = alicloud_vpc.vpc.id
  nat_gateway_name = "natGateway-tf"
  payment_type     = "PayAsYouGo"
  vswitch_id       = alicloud_vswitch.vsw.id
  nat_type         = "Enhanced"
}

resource "alicloud_eip_address" "eip" {
  address_name         = "eip-tf"
  isp                  = "BGP"
  internet_charge_type = "PayByBandwidth"
  payment_type         = "PayAsYouGo"
  bandwidth            = 1
}

resource "alicloud_eip_association" "eip_nat" {
  allocation_id = alicloud_eip_address.eip.id
  instance_id   = alicloud_nat_gateway.nat.id
}

resource "alicloud_snat_entry" "snat" {
  depends_on        = [alicloud_eip_association.eip_nat]
  snat_table_id     = alicloud_nat_gateway.nat.snat_table_ids
  source_vswitch_id = alicloud_vswitch.vsw.id
  snat_ip           = join(",", alicloud_eip_address.eip.*.ip_address)
}

plan执行结果如下，将提示我们新增以上4个资源：

shanyao:terraform-ata shanyao$ terraform plan
data.alicloud_images.debian: Reading...
alicloud_vpc.vpc: Refreshing state... [id=vpc-bp13jb0hn8gvlk7frvngl]
alicloud_security_group.default: Refreshing state... [id=sg-bp14g56wck3nk5qlvlyl]
alicloud_vswitch.vsw: Refreshing state... [id=vsw-bp14yu7pmsg7zkkvry3vb]
alicloud_security_group_rule.allow_all_tcp: Refreshing state... [id=sg-bp14g56wck3nk5qlvlyl:ingress:tcp:1/65535:intranet:0.0.0.0/0:accept:1]
data.alicloud_images.debian: Read complete after 1s [id=4116092999]
module.tf-instances.alicloud_instance.this[3]: Refreshing state... [id=i-bp1b3a43b6c7sfffcbsp]
module.tf-instances.alicloud_instance.this[1]: Refreshing state... [id=i-bp1dtiqbjgjinghn478b]
module.tf-instances.alicloud_instance.this[0]: Refreshing state... [id=i-bp15veru9k3viz048x9f]
module.tf-instances.alicloud_instance.this[2]: Refreshing state... [id=i-bp176ekeo6unrcunczdx]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # alicloud_eip_address.eip will be created
  + resource "alicloud_eip_address" "eip" {
      + address_name         = "eip-tf"
      + bandwidth            = "1"
      + deletion_protection  = (known after apply)
      + id                   = (known after apply)
      + instance_charge_type = (known after apply)
      + internet_charge_type = "PayByBandwidth"
      + ip_address           = (known after apply)
      + isp                  = "BGP"
      + name                 = (known after apply)
      + payment_type         = "PayAsYouGo"
      + resource_group_id    = (known after apply)
      + status               = (known after apply)
    }

  # alicloud_eip_association.eip_nat will be created
  + resource "alicloud_eip_association" "eip_nat" {
      + allocation_id      = (known after apply)
      + force              = false
      + id                 = (known after apply)
      + instance_id        = (known after apply)
      + instance_type      = (known after apply)
      + private_ip_address = (known after apply)
    }

  # alicloud_nat_gateway.nat will be created
  + resource "alicloud_nat_gateway" "nat" {
      + bandwidth_package_ids = (known after apply)
      + deletion_protection   = (known after apply)
      + eip_bind_mode         = (known after apply)
      + forward_table_ids     = (known after apply)
      + id                    = (known after apply)
      + instance_charge_type  = (known after apply)
      + internet_charge_type  = (known after apply)
      + name                  = (known after apply)
      + nat_gateway_name      = "natGateway-tf"
      + nat_type              = "Enhanced"
      + network_type          = (known after apply)
      + payment_type          = "PayAsYouGo"
      + snat_table_ids        = (known after apply)
      + specification         = (known after apply)
      + status                = (known after apply)
      + vpc_id                = "vpc-bp13jb0hn8gvlk7frvngl"
      + vswitch_id            = "vsw-bp14yu7pmsg7zkkvry3vb"
    }

  # alicloud_snat_entry.snat will be created
  + resource "alicloud_snat_entry" "snat" {
      + id                = (known after apply)
      + snat_entry_id     = (known after apply)
      + snat_ip           = (known after apply)
      + snat_table_id     = (known after apply)
      + source_cidr       = (known after apply)
      + source_vswitch_id = "vsw-bp14yu7pmsg7zkkvry3vb"
      + status            = (known after apply)
    }

Plan: 4 to add, 0 to change, 0 to destroy.

apply执行后，将增加以上4个资源。

此时，我们登录ECS实例试验，可验证已经能够成功访问公网了（已完成要求b）。

执行自定义脚本

有时，我们会有进一步的个性化需求，比如我们想完成环境初始化之后，再执行一些自定义的脚本，如创建一些目录、安装nginx等软件、或者执行测试脚本。那该如何实现呢？

可喜的是，terraform提供了user-data机制，借助于底层虚拟机的cloud-init功能，user-data允许我们在虚拟机实例第一次启动时执行一些自定义的脚本来完成初始化操作。阿里云ECS的user_data说明如下：

user_data - (Optional) User-defined data to customize the startup behaviors of an ECS instance and to pass data into an ECS instance. From version 1.60.0, it can be update in-place. If updated, the instance will reboot to make the change take effect. Note: Not all of changes will take effect and it depends on cloud-init module type.

其中特别需要注意的一点是脚本什么执行呢？从原则上来说，user-data只能在实例初始化启动阶段执行，这也就意味着在ECS整个生命周期当中，仅有初始化创建阶段脚本能够被执行，而不能立即生效，也不能通过重启来执行。虽然在较新的版本中，有些更新可以update in-place，但是依然是少数，需要认真辨别。通常来讲，需要destroy掉所有资源，再重新apply所有资源才能使得user_data里的脚本能够被执行。

针对我们的例子，我们可以创建脚本文件cron_task.sh，如下：

#!/bin/bash
dir='/home/tf'
if [ ! -d "$dir" ];then
  mkdir -p $dir
fi
echo "#!/bin/bash
urls=(
'https://www.baidu.com/'
'https://www.youdao.com/'
'https://github.com/terraform-alicloud-modules/terraform-alicloud-ecs-instance'
)
for url in \${urls[*]}
do
  curl --connect-timeout 10 -m 10 -s \$url >> $dir/curl.log
  sleep 5s
done
echo 'curl finished!' >> $dir/curl.log
"> $dir/cron_task.sh

chmod +x $dir/cron_task.sh

echo "0 *    * * *   root    $dir/cron_task.sh">>/etc/crontab
service cron reload
echo 'crontab task initialized successfully, and it will run hourly.' >> $dir/cron.log

并定义local变量，修改instance module，通过‘user_data = local.user_data’来指定user_data，如下：

locals {
  user_data = file("cron_task.sh")
}

module "tf-instances" {
  source                      = "alibaba/ecs-instance/alicloud"
  region                      = var.region
  number_of_instances         = var.instances_number
  vswitch_id                  = alicloud_vswitch.vsw.id
  group_ids                   = [alicloud_security_group.default.id]
  private_ips                 = ["172.16.0.9", "172.16.0.10", "172.16.0.11", "172.16.0.12"]
  image_id                    = data.alicloud_images.debian.ids.0
  instance_type               = "ecs.s6-c1m1.small"
  associate_public_ip_address = false
  instance_name               = "demo_instance_"
  host_name                   = "tf-demo"
  internet_charge_type        = "PayByTraffic"
  password                    = "password123"
  system_disk_category        = "cloud_ssd"
  system_disk_size            = 20
  user_data                   = local.user_data


  tags = {
    Created     = "Terraform"
    env         = "pre"
    application = "online-shop"
  }
}

如前所述，我们可以通过plan，查看执行计划如下：

shanyao:terraform-ata shanyao$ terraform plan
data.alicloud_images.debian: Reading...
alicloud_vpc.vpc: Refreshing state... [id=vpc-bp13jb0hn8gvlk7frvngl]
alicloud_eip_address.eip: Refreshing state... [id=eip-bp1kx6bn9caoxrlpjldlx]
alicloud_security_group.default: Refreshing state... [id=sg-bp14g56wck3nk5qlvlyl]
alicloud_vswitch.vsw: Refreshing state... [id=vsw-bp14yu7pmsg7zkkvry3vb]
alicloud_nat_gateway.nat: Refreshing state... [id=ngw-bp1383r6vru07uhxnnw1c]
alicloud_eip_association.eip_nat: Refreshing state... [id=eip-bp1kx6bn9caoxrlpjldlx:ngw-bp1383r6vru07uhxnnw1c]
alicloud_security_group_rule.allow_all_tcp: Refreshing state... [id=sg-bp14g56wck3nk5qlvlyl:ingress:tcp:1/65535:intranet:0.0.0.0/0:accept:1]
alicloud_snat_entry.snat: Refreshing state... [id=stb-bp11moovtq98n7zjrgrl3:snat-bp1n6jzrjbl8130my7jbj]
data.alicloud_images.debian: Read complete after 1s [id=4116092999]
module.tf-instances.alicloud_instance.this[1]: Refreshing state... [id=i-bp1dtiqbjgjinghn478b]
module.tf-instances.alicloud_instance.this[2]: Refreshing state... [id=i-bp176ekeo6unrcunczdx]
module.tf-instances.alicloud_instance.this[3]: Refreshing state... [id=i-bp1b3a43b6c7sfffcbsp]
module.tf-instances.alicloud_instance.this[0]: Refreshing state... [id=i-bp15veru9k3viz048x9f]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.tf-instances.alicloud_instance.this[0] will be updated in-place
  ~ resource "alicloud_instance" "this" {
        id                                 = "i-bp15veru9k3viz048x9f"
        tags                               = {
            "Created"     = "Terraform"
            "Name"        = "demo_instance_001"
            "application" = "online-shop"
            "env"         = "pre"
        }
      + user_data                          = <<-EOT
            #!/bin/bash
            dir='/home/tf'
            if [ ! -d "$dir" ];then
              mkdir -p $dir
            fi
            echo "#!/bin/bash
            urls=(
            'https://www.baidu.com/'
            'https://www.youdao.com/'
            'https://github.com/terraform-alicloud-modules/terraform-alicloud-ecs-instance'
            )
            for url in \${urls[*]}
            do
              curl --connect-timeout 10 -m 10 -s \$url >> $dir/curl.log
              sleep 5s
            done
            echo 'curl finished!' >> $dir/curl.log
            "> $dir/cron_task.sh
            
            chmod +x $dir/cron_task.sh
            
            echo "0 *    * * *   root    $dir/cron_task.sh">>/etc/crontab
            service cron reload
            echo 'crontab task initialized successfully, and it will run hourly.' >> $dir/cron.log
        EOT
        # (31 unchanged attributes hidden)
    }

  # module.tf-instances.alicloud_instance.this[1] will be updated in-place
  ~ resource "alicloud_instance" "this" {
        id                                 = "i-bp1dtiqbjgjinghn478b"
        tags                               = {
            "Created"     = "Terraform"
            "Name"        = "demo_instance_002"
            "application" = "online-shop"
            "env"         = "pre"
        }
      + user_data                          = <<-EOT
            #!/bin/bash
            dir='/home/tf'
            if [ ! -d "$dir" ];then
              mkdir -p $dir
            fi
            echo "#!/bin/bash
            urls=(
            'https://www.baidu.com/'
            'https://www.youdao.com/'
            'https://github.com/terraform-alicloud-modules/terraform-alicloud-ecs-instance'
            )
            for url in \${urls[*]}
            do
              curl --connect-timeout 10 -m 10 -s \$url >> $dir/curl.log
              sleep 5s
            done
            echo 'curl finished!' >> $dir/curl.log
            "> $dir/cron_task.sh
            
            chmod +x $dir/cron_task.sh
            
            echo "0 *    * * *   root    $dir/cron_task.sh">>/etc/crontab
            service cron reload
            echo 'crontab task initialized successfully, and it will run hourly.' >> $dir/cron.log
        EOT
        # (31 unchanged attributes hidden)
    }

  # module.tf-instances.alicloud_instance.this[2] will be updated in-place
  ~ resource "alicloud_instance" "this" {
        id                                 = "i-bp176ekeo6unrcunczdx"
        tags                               = {
            "Created"     = "Terraform"
            "Name"        = "demo_instance_003"
            "application" = "online-shop"
            "env"         = "pre"
        }
      + user_data                          = <<-EOT
            #!/bin/bash
            dir='/home/tf'
            if [ ! -d "$dir" ];then
              mkdir -p $dir
            fi
            echo "#!/bin/bash
            urls=(
            'https://www.baidu.com/'
            'https://www.youdao.com/'
            'https://github.com/terraform-alicloud-modules/terraform-alicloud-ecs-instance'
            )
            for url in \${urls[*]}
            do
              curl --connect-timeout 10 -m 10 -s \$url >> $dir/curl.log
              sleep 5s
            done
            echo 'curl finished!' >> $dir/curl.log
            "> $dir/cron_task.sh
            
            chmod +x $dir/cron_task.sh
            
            echo "0 *    * * *   root    $dir/cron_task.sh">>/etc/crontab
            service cron reload
            echo 'crontab task initialized successfully, and it will run hourly.' >> $dir/cron.log
        EOT
        # (31 unchanged attributes hidden)
    }

  # module.tf-instances.alicloud_instance.this[3] will be updated in-place
  ~ resource "alicloud_instance" "this" {
        id                                 = "i-bp1b3a43b6c7sfffcbsp"
        tags                               = {
            "Created"     = "Terraform"
            "Name"        = "demo_instance_004"
            "application" = "online-shop"
            "env"         = "pre"
        }
      + user_data                          = <<-EOT
            #!/bin/bash
            dir='/home/tf'
            if [ ! -d "$dir" ];then
              mkdir -p $dir
            fi
            echo "#!/bin/bash
            urls=(
            'https://www.baidu.com/'
            'https://www.youdao.com/'
            'https://github.com/terraform-alicloud-modules/terraform-alicloud-ecs-instance'
            )
            for url in \${urls[*]}
            do
              curl --connect-timeout 10 -m 10 -s \$url >> $dir/curl.log
              sleep 5s
            done
            echo 'curl finished!' >> $dir/curl.log
            "> $dir/cron_task.sh
            
            chmod +x $dir/cron_task.sh
            
            echo "0 *    * * *   root    $dir/cron_task.sh">>/etc/crontab
            service cron reload
            echo 'crontab task initialized successfully, and it will run hourly.' >> $dir/cron.log
        EOT
        # (31 unchanged attributes hidden)
    }

Plan: 0 to add, 4 to change, 0 to destroy.

但需要注意的是，我们只有通过先用terraformform destroy掉所有资源，再重新执行terraform apply申请所有资源，才可以使user_data里面的脚本真正被调用执行。

完整的terraform脚本如下(至此已完成全部要求abc)：

variable "profile" {
  default = "default"
}

variable "region" {
  default = "cn-hangzhou"
}

variable "zone_id" {
  default = "cn-hangzhou-h"
}

variable "instances_number" {
  default = 4
}

provider "alicloud" {
  region  = var.region
  profile = var.profile
}

resource "alicloud_vpc" "vpc" {
  vpc_name   = "vpc_tf_demo"
  cidr_block = "172.16.0.0/12"
}

resource "alicloud_vswitch" "vsw" {
  vpc_id     = alicloud_vpc.vpc.id
  cidr_block = "172.16.0.0/21"
  zone_id    = var.zone_id
}

resource "alicloud_security_group" "default" {
  name   = "default"
  vpc_id = alicloud_vpc.vpc.id
}

resource "alicloud_security_group_rule" "allow_all_tcp" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "1/65535"
  priority          = 1
  security_group_id = alicloud_security_group.default.id
  cidr_ip           = "0.0.0.0/0"
}

data "alicloud_images" "debian" {
  most_recent = false
  name_regex  = "^debian_8_09_64_20G_alibase_20170824.vhd"
}

resource "alicloud_nat_gateway" "nat" {
  depends_on       = [alicloud_vswitch.vsw]
  vpc_id           = alicloud_vpc.vpc.id
  nat_gateway_name = "natGateway-tf"
  payment_type     = "PayAsYouGo"
  vswitch_id       = alicloud_vswitch.vsw.id
  nat_type         = "Enhanced"
}

resource "alicloud_eip_address" "eip" {
  address_name         = "eip-tf"
  isp                  = "BGP"
  internet_charge_type = "PayByBandwidth"
  payment_type         = "PayAsYouGo"
  bandwidth            = 1
}

resource "alicloud_eip_association" "eip_nat" {
  allocation_id = alicloud_eip_address.eip.id
  instance_id   = alicloud_nat_gateway.nat.id
}

resource "alicloud_snat_entry" "snat" {
  depends_on        = [alicloud_eip_association.eip_nat]
  snat_table_id     = alicloud_nat_gateway.nat.snat_table_ids
  source_vswitch_id = alicloud_vswitch.vsw.id
  snat_ip           = join(",", alicloud_eip_address.eip.*.ip_address)
}

locals {
  user_data = file("cron_task.sh")
}

module "tf-instances" {
  source                      = "alibaba/ecs-instance/alicloud"
  region                      = var.region
  number_of_instances         = var.instances_number
  vswitch_id                  = alicloud_vswitch.vsw.id
  group_ids                   = [alicloud_security_group.default.id]
  private_ips                 = ["172.16.0.9", "172.16.0.10", "172.16.0.11", "172.16.0.12"]
  image_id                    = data.alicloud_images.debian.ids.0
  instance_type               = "ecs.s6-c1m1.small"
  associate_public_ip_address = false
  instance_name               = "demo_instance_"
  host_name                   = "tf-demo"
  internet_charge_type        = "PayByTraffic"
  password                    = "password123"
  system_disk_category        = "cloud_ssd"
  system_disk_size            = 20
  user_data                   = local.user_data


  tags = {
    Created     = "Terraform"
    env         = "pre"
    application = "online-shop"
  }
}

总结

本文以真实的案例，向大家展示了如何使用terraform创建、修改、删除云上环境。示例当中，包含了如何通过简单的命令创建多台ECS实例，也简要介绍了如何解决经常遇到的怎么开通公网访问；在进阶示例中，又简要说明了如何通过user_data在实例初始化阶段执行自定义脚本。Terraform是一个简单且强大的IaC工具，本文简单介绍，希望能对大家有所帮助，更多复杂的功能等待大家去探索。

参考文档

https://www.terraform.io/

https://www.terraform.io/cli/commands/init

https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/instance

https://registry.terraform.io/modules/alibaba/ecs-instance/alicloud/latest

https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/nat_gateway

https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/eip_address

https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/eip_association

https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/snat_entry

文章标签：
云服务器 ECS
弹性公网IP
NAT网关
专有网络VPC
开发工具
测试技术
应用服务中间件
弹性计算
数据安全/隐私保护
nginx
git
安全
数据中心
架构师
关键词：
自动化实践
terraform构建
自动化terraform
terraform自动化
设施terraform
相关实践学习
通义万相文本绘图与人像美化
本解决方案展示了如何利用自研的通义万相AIGC技术在Web服务中实现先进的图像生成。
7天玩转云服务器
云服务器ECS（Elastic Compute Service）是一种弹性可伸缩的计算服务，可降低 IT 成本，提升运维效率。本课程手把手带你了解ECS、掌握基本操作、动手实操快照管理、镜像管理等。了解产品详情:&nbsp;https://www.aliyun.com/product/ecs
WeiKuo
目录
相关文章
G0518
|
2月前
|
敏捷开发 测试技术 API
测试金字塔：构建高效自动化测试策略的基石
测试金字塔：构建高效自动化测试策略的基石
G0518
298 116
G0518
|
2月前
|
测试技术 API 数据库
测试金字塔：构建高效自动化测试策略的基石
测试金字塔：构建高效自动化测试策略的基石
G0518
323 114
G0518
|
2月前
|
设计模式 前端开发 测试技术
告别脆弱：构建稳定UI自动化测试的3个核心策略
告别脆弱：构建稳定UI自动化测试的3个核心策略
G0518
372 113
站大爷
|
2月前
|
存储 数据采集 监控
Python定时爬取新闻网站头条：从零到一的自动化实践
在信息爆炸时代，本文教你用Python定时爬取腾讯新闻头条，实现自动化监控。涵盖请求、解析、存储、去重、代理及异常通知，助你构建高效新闻采集系统，适用于金融、电商、媒体等场景。（238字）
站大爷
431 2
霍格沃兹测试开发学社
|
2月前
|
JSON 监控 API
n8n错误处理全攻略：构建稳定可靠的自动化工作流
在n8n自动化工作流中，错误是提升系统可靠性的关键。本文详解常见错误类型、节点级与全局处理机制，结合重试、熔断、补偿事务等高级模式，助您构建稳定、可维护的生产级自动化流程。
霍格沃兹测试开发学社
516 5
阿里云开发者
|
2月前
|
人工智能 自然语言处理 测试技术
从人工到AI驱动：天猫测试全流程自动化变革实践
天猫技术质量团队探索AI在测试全流程的落地应用，覆盖需求解析、用例生成、数据构造、执行验证等核心环节。通过AI+自然语言驱动，实现测试自动化、可溯化与可管理化，在用例生成、数据构造和执行校验中显著提效，推动测试体系从人工迈向AI全流程自动化，提升效率40%以上，用例覆盖超70%，并构建行业级知识资产沉淀平台。
阿里云开发者
766 0
从人工到AI驱动：天猫测试全流程自动化变革实践
蒋星熠Jaxonic
|
2月前
|
Java 项目管理 Maven
Maven项目管理与构建自动化完全指南
Maven彻底改变了Java项目管理方式，通过POM模型、依赖管理和标准化构建流程，大幅提升开发效率。本文深入解析其核心概念、多模块管理、私服搭建及与Spring Boot、Docker等现代技术栈的集成实践，助力开发者实现高效、规范的项目构建与团队协作。
蒋星熠Jaxonic
424 0
Maven项目管理与构建自动化完全指南
顾翔
|
3月前
|
Java 测试技术 API
自动化测试工具集成及实践
自动化测试用例的覆盖度及关键点最佳实践、自动化测试工具、集成方法、自动化脚本编写等（兼容多语言（Java、Python、Go、C++、C#等）、多框架（Spring、React、Vue等））
顾翔
206 6
数据采集 Web App开发 人工智能
223 0
DataWorks@佳里
|
4月前
|
人工智能 自然语言处理 安全
Milvus x n8n ：自动化拆解Github文档，零代码构建领域知识智能问答
本文介绍了在构建特定技术领域问答机器人时面临的四大挑战：知识滞后性、信息幻觉、领域术语理解不足和知识库维护成本高。通过结合Milvus向量数据库和n8n低代码平台，提出了一种高效的解决方案。该方案利用Milvus的高性能向量检索和n8n的工作流编排能力，构建了一个可自动更新、精准回答技术问题的智能问答系统，并介绍了部署过程中的可观测性和安全性实现方法。
DataWorks@佳里
717 0

热门文章

最新文章

  • 1
    告别脆弱：构建稳定UI自动化测试的3个核心策略
  • 2
    测试金字塔：构建高效自动化测试策略的基石
  • 3
    测试金字塔：构建高效自动化测试策略的基石
  • 4
    别再熬夜救火了！自动化运维正在重塑企业IT管理的底层逻辑
  • 5
    Terraform Module 编写指南
  • 6
    玩转阿里云 Terraform(二)：Terraform 的几个关键概念
  • 7
    Terraform 一分钟部署阿里云ECS集群（含视频）
  • 8
    Terraform Module大赛来啦，AirPods Pro免费送！
  • 9
    Terraform Module 可视化正式发布
  • 10
    Terraform 助力 ECS 实例借助 RAM 管理阿里云产品
  • 1
    测试金字塔：构建高效自动化测试策略的基石
    298
  • 2
    测试金字塔：构建高效自动化测试策略的基石
    323
  • 3
    告别脆弱：构建稳定UI自动化测试的3个核心策略
    372
  • 4
    别再熬夜救火了！自动化运维正在重塑企业IT管理的底层逻辑
    163
  • 5
    2025年工作流自动化的15个趋势，如何影响企业的业务？
    293
  • 6
    Python定时爬取新闻网站头条：从零到一的自动化实践
    431
  • 7
    n8n错误处理全攻略：构建稳定可靠的自动化工作流
    516
  • 8
    在阿里云ECS上部署n8n自动化工作流：U2实例实战
    696
  • 9
    Nessus Professional 10.10 Auto Installer for macOS Tahoe - Nessus 自动化安装程序
    127
  • 10
    Nessus Professional 10.10 Auto Installer for RHEL 10, AlmaLinux 10, Rocky Linux 10 - Nessus 自动化安装程序
    210

    • 相关课程

    更多
  • MSE微服务测试最佳实践 - 自动化回归

    • 相关电子书

    更多
  • 自动化AutoTalk第一期-什么是云上自动化
  • Terraform - 管理云资源的正确姿势
  • 基于Terraform的自动化管理云上资源实践

    • 推荐镜像

    更多
  • terraform
    • 下一篇
    基于Python+Vue开发的口腔牙科预约管理系统