terraform（Terraform 基础设施）

When to use this skill

Use this skill whenever the user wants to:

• Write or debug Terraform configuration files (.tf)
• Manage cloud infrastructure (AWS, Azure, GCP, etc.)
• Configure providers, resources, data sources, and outputs
• Manage Terraform state, modules, and workspaces

How to use this skill

Workflow

1. Write configuration — define providers, resources, variables, and outputs in HCL
2. Initialize — run terraform init to download providers and modules
3. Plan — run terraform plan to preview changes
4. Apply — run terraform apply to provision infrastructure
5. Validate — confirm resources with terraform state list and cloud console

Quick Start Example

# main.tf
terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {
    bucket         = "myapp-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
  }
}

provider "aws" {
  region = var.aws_region
}

variable "aws_region" {
  description = "AWS region for resources"
  type        = string
  default     = "us-east-1"
}

resource "aws_s3_bucket" "app_assets" {
  bucket = "myapp-${var.environment}-assets"
  tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

output "bucket_arn" {
  value = aws_s3_bucket.app_assets.arn
}

# Standard workflow
terraform init
terraform fmt          # Format code
terraform validate     # Check syntax
terraform plan         # Preview changes
terraform apply        # Apply changes

# State inspection
terraform state list
terraform state show aws_s3_bucket.app_assets

Module Usage Example

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "myapp-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["us-east-1a", "us-east-1b"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
}

Best Practices

• Use remote state (S3 + DynamoDB, Azure Blob, etc.) to avoid state file conflicts
• Store sensitive values in variables or environment variables — never hardcode in .tf files
• Run terraform fmt and terraform validate before every commit
• Use workspaces or directory-based environments for isolation (dev/staging/prod)
• Version-pin providers and modules to avoid unexpected breaking changes

Troubleshooting

• State lock error: Check for stale locks in DynamoDB/backend; use terraform force-unlock as last resort
• Provider version conflict: Pin versions in required_providers and run terraform init -upgrade
• Drift detected: Run terraform plan to see differences; import or taint resources as needed
• Destroy hanging: Check for resource dependencies; use -target for selective destruction

Keywords

terraform, iac, infrastructure as code, hcl, aws, azure, gcp, modules, state management, cloud provisioning