Terraform

terraform init      # Descargar providers y módulos
terraform validate  # Verificar sintaxis
terraform plan      # Ver qué va a cambiar
terraform apply     # Aplicar cambios
terraform destroy   # Eliminar toda la infraestructura

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
 
provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "data" {
  bucket = "my-app-data-${var.environment}"
 
  tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}
 
resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id
  versioning_configuration {
    status = "Enabled"
  }
}

# variables.tf
variable "environment" {
  description = "Deployment environment"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Must be dev, staging, or prod."
  }
}
 
variable "instance_count" {
  description = "Number of instances"
  type        = number
  default     = 2
}

# terraform.tfvars
environment    = "prod"
instance_count = 3

output "bucket_arn" {
  description = "ARN of the S3 bucket"
  value       = aws_s3_bucket.data.arn
}
 
output "api_url" {
  description = "API Gateway URL"
  value       = aws_apigatewayv2_api.main.api_endpoint
  sensitive   = false
}

data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["amazon"]
 
  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}
 
resource "aws_instance" "web" {
  ami           = data.aws_ami.amazon_linux.id
  instance_type = "t3.micro"
}

# Backend remoto (obligatorio para equipos)
terraform {
  backend "s3" {
    bucket         = "company-terraform-state"
    key            = "services/api/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"    # Locking
    encrypt        = true                  # Encryption at rest
  }
}

terraform state list                    # Listar recursos
terraform state show aws_instance.web   # Detalle de un recurso
terraform state mv aws_instance.old aws_instance.new  # Renombrar
terraform state rm aws_instance.legacy  # Dejar de gestionar
terraform import aws_instance.web i-1234567890  # Importar existente

# Módulo propio
module "api" {
  source = "./modules/lambda-api"
 
  function_name = "my-api"
  runtime       = "nodejs20.x"
  memory_size   = 256
  environment   = var.environment
}
 
# Módulo del registry
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.5.0"
 
  name = "production"
  cidr = "10.0.0.0/16"
}

terraform workspace new staging
terraform workspace new production
terraform workspace select staging
terraform apply -var-file="staging.tfvars"

# Crear múltiples recursos
resource "aws_iam_user" "team" {
  for_each = toset(["alice", "bob", "carol"])
  name     = each.key
}
 
# Condicional
resource "aws_cloudwatch_log_group" "api" {
  count = var.enable_logging ? 1 : 0
  name  = "/api/${var.environment}"
}

moved {
  from = aws_instance.server
  to   = aws_instance.web
}

# Nunca hardcodear secretos
variable "db_password" {
  type      = string
  sensitive = true   # No aparece en logs ni plan
}
 
# Usar data sources para secretos
data "aws_secretsmanager_secret_version" "db" {
  secret_id = "prod/db/password"
}