✍️ 필사 모드: Terraform 내부 완전 가이드 2025: DAG, State, Providers, Plan/Apply, OpenTofu 심층 분석

$ terraform apply

# 변수
variable "region" {
  type    = string
  default = "us-east-1"
}

# 리소스
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"
  
  tags = {
    Name = "WebServer"
  }
}

# Output
output "instance_ip" {
  value = aws_instance.web.public_ip
}

{
  "resource": {
    "aws_instance": {
      "web": {
        "ami": "ami-0c55b159cbfafe1f0",
        "instance_type": "t3.micro"
      }
    }
  }
}

resource "aws_instance" "web" {
  # ...
}

provider "aws" {
  # ...
}

variable "count" {
  # ...
}

count = 3
name = "server-${count.index}"
ips  = [for i in range(3) : cidrhost("10.0.0.0/24", i)]

length(var.list)
format("hello-%s", var.name)
jsonencode({foo = "bar"})

resource "aws_instance" "web" {
  instance_type = var.env == "prod" ? "t3.large" : "t3.micro"
}

resource "aws_instance" "web" {
  count = 3
  ami   = "ami-..."
}
# web[0], web[1], web[2]

resource "aws_instance" "web" {
  for_each = {
    web1 = "t3.micro"
    web2 = "t3.small"
    web3 = "t3.medium"
  }
  
  ami           = "ami-..."
  instance_type = each.value
  
  tags = {
    Name = each.key
  }
}
# web["web1"], web["web2"], ...

resource "aws_instance" "web" {
  ami = "ami-..."
}

resource "aws_eip" "web_ip" {
  instance = aws_instance.web.id  # 이 참조가 의존성 생성
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "public" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
}

                  aws_vpc.main
                /     |      \
               ↓      ↓       ↓
       aws_subnet  aws_igw   (참조)
       .public     .igw       ↓
                    └────────→aws_route_table.public

resource "aws_instance" "web1" {
  ami = "ami-..."
}

resource "aws_instance" "web2" {
  ami = "ami-..."
}

VPC 생성 → Subnet 생성 → Instance 생성

resource "a" "x" {
  b = b.y.id
}

resource "b" "y" {
  a = a.x.id  # 순환!
}

terraform graph | dot -Tpng > graph.png

resource "aws_subnet" "public" {
  vpc_id = aws_vpc.main.id  # 자동 감지
}

resource "aws_instance" "web" {
  # ...
  depends_on = [aws_security_group.web]
}

{
  "version": 4,
  "terraform_version": "1.6.0",
  "serial": 42,
  "lineage": "abc-123-xyz",
  "outputs": {
    "instance_ip": {
      "value": "54.123.45.67",
      "type": "string"
    }
  },
  "resources": [
    {
      "mode": "managed",
      "type": "aws_instance",
      "name": "web",
      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
      "instances": [
        {
          "schema_version": 1,
          "attributes": {
            "id": "i-0123456789abcdef0",
            "ami": "ami-0c55b159cbfafe1f0",
            "instance_type": "t3.micro",
            "tags": {
              "Name": "WebServer"
            }
          },
          "dependencies": ["aws_vpc.main"]
        }
      ]
    }
  ]
}

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
    prefix = "prod"
  }
}

terraform {
  backend "azurerm" {
    resource_group_name  = "tfstate"
    storage_account_name = "tfstate"
    container_name       = "tfstate"
    key                  = "prod.terraform.tfstate"
  }
}

terraform {
  cloud {
    organization = "my-org"
    workspaces {
      name = "prod"
    }
  }
}

{
  "LockID": "my-terraform-state/prod/terraform.tfstate-md5",
  "Info": "...",
  "Operation": "OperationTypeApply",
  "Who": "alice@laptop.local",
  "Version": "1.6.0",
  "Created": "2025-04-15T10:00:00Z"
}

Error: Error acquiring the state lock
Lock Info:
  ID:        abc-123
  Path:      my-terraform-state/prod/terraform.tfstate
  Operation: OperationTypeApply
  Who:       alice@laptop.local

terraform force-unlock abc-123

# 민감한 값 보기
terraform output -json

output "db_password" {
  value     = aws_db_instance.main.password
  sensitive = true
}

terraform state list
# aws_vpc.main
# aws_subnet.public
# aws_instance.web

terraform state show aws_instance.web

terraform state mv aws_instance.web aws_instance.web_server

terraform state rm aws_instance.legacy

terraform import aws_instance.web i-0123456789abcdef0

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
  
  default_tags {
    tags = {
      Environment = "prod"
    }
  }
}

Terraform Core ←→ gRPC ←→ Provider Plugin (별도 프로세스)

schema.Resource{
  Schema: map[string]*schema.Schema{
    "ami": {
      Type:     schema.TypeString,
      Required: true,
    },
    "instance_type": {
      Type:     schema.TypeString,
      Required: true,
    },
    // ...
  },
}

package main

import (
  "github.com/hashicorp/terraform-plugin-framework/providerserver"
  "context"
)

func main() {
  providerserver.Serve(context.Background(), NewProvider, ...)
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"  # 5.x, but not 6.0
    }
  }
}

Terraform will perform the following actions:

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami           = "ami-0c55b159cbfafe1f0"
      + instance_type = "t3.micro"
      + id            = (known after apply)
      + public_ip     = (known after apply)
    }

  # aws_vpc.main will be updated in-place
  ~ resource "aws_vpc" "main" {
        id         = "vpc-12345"
      ~ cidr_block = "10.0.0.0/16" -> "10.0.0.0/8"
    }

  # aws_eip.old will be destroyed
  - resource "aws_eip" "old" {
      - id = "eipalloc-12345"
    }

Plan: 1 to add, 1 to change, 1 to destroy.

For each resource in state:
  current = provider.Read(resource.id)
  if current != state:
    update state

terraform plan -out=plan.tfplan

terraform apply plan.tfplan

+ public_ip = (known after apply)
+ id        = (known after apply)

~ tags = {
    ~ "Name" = "Old" -> "New"
  }

-/+ resource "aws_instance" "web" {
    ~ availability_zone = "us-east-1a" -> "us-east-1b" # forces replacement
  }

resource "aws_instance" "web" {
  # ...
  lifecycle {
    create_before_destroy = true
  }
}

terraform apply -parallelism=20

terraform apply -parallelism=1

aws_vpc.main: Creating...
aws_subnet.public: Creating...
aws_subnet.private: Creating...
aws_subnet.public: Creation complete
aws_subnet.private: Error: AccessDenied

# 나쁨
terraform apply -auto-approve

# 좋음
terraform plan -out=plan.tfplan
terraform apply plan.tfplan

terraform refresh  # 또는 apply -refresh-only

terraform plan
# 예상하지 못한 변경이 있으면 drift

# modules/vpc/main.tf
variable "cidr_block" {
  type = string
}

resource "aws_vpc" "this" {
  cidr_block = var.cidr_block
}

output "vpc_id" {
  value = aws_vpc.this.id
}

module "vpc" {
  source = "./modules/vpc"
  
  cidr_block = "10.0.0.0/16"
}

# 출력 참조
output "my_vpc_id" {
  value = module.vpc.vpc_id
}

module "vpc" {
  source = "./modules/vpc"
}

module "vpc" {
  source = "git::https://github.com/myorg/modules.git//vpc?ref=v1.0"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.0"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.1.0"
  
  name = "my-vpc"
  cidr = "10.0.0.0/16"
  
  azs             = ["us-east-1a", "us-east-1b"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
  
  enable_nat_gateway = true
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.1.0"  # 5.1.x
}

source = "git::...repo.git?ref=v1.2.3"

module "everything" {
  source = "./modules/full-stack"
  # VPC, EKS, RDS, ALB, CloudFront, ...
}

module "vpc" { ... }
module "eks" { ... }
module "rds" { ... }

module "vpc" {
  source = "./vpc"
  # ...
}

module "eks" {
  source     = "./eks"
  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnet_ids
}

variable "instance_type" {
  type    = string
  default = "t3.micro"
}

variable "tags" {
  type    = map(string)
  default = {}
}

output "vpc_id" {}
output "subnet_ids" {}
output "security_group_id" {}

func TestVPC(t *testing.T) {
    opts := &terraform.Options{
        TerraformDir: "./modules/vpc",
    }
    defer terraform.Destroy(t, opts)
    terraform.InitAndApply(t, opts)
    
    vpcID := terraform.Output(t, opts, "vpc_id")
    assert.NotEmpty(t, vpcID)
}

# tests/basic.tftest.hcl
run "create_vpc" {
  command = plan
  
  assert {
    condition     = aws_vpc.this.cidr_block == "10.0.0.0/16"
    error_message = "VPC CIDR mismatch"
  }
}

terraform workspace list
# * default
#   dev
#   staging
#   prod

terraform workspace new prod
terraform workspace select prod

resource "aws_instance" "web" {
  instance_type = terraform.workspace == "prod" ? "t3.large" : "t3.micro"
}

environments/
├── dev/
│   ├── main.tf
│   └── terraform.tfvars
├── staging/
│   ├── main.tf
│   └── terraform.tfvars
└── prod/
    ├── main.tf
    └── terraform.tfvars

terraform plan

~ resource "aws_instance" "web" {
    id            = "i-0123456789abcdef0"
  ~ instance_type = "t3.micro" -> "t3.small"  # 누군가 콘솔에서 변경!
  }

instance_type = "t3.small"

terraform apply

terraform apply -refresh-only

name: Terraform
on:
  pull_request:
  push:
    branches: [main]

jobs:
  terraform:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./terraform
    
    steps:
      - uses: actions/checkout@v4
      
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.0
      
      - run: terraform init
      
      - run: terraform fmt -check
      
      - run: terraform validate
      
      - name: Terraform Plan
        run: terraform plan -out=tfplan
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY }}
      
      - name: Terraform Apply
        if: github.ref == 'refs/heads/main'
        run: terraform apply -auto-approve tfplan

terraform apply -lock-timeout=10m

terraform apply -target=aws_instance.web

# Terraform → OpenTofu
tofu init
tofu plan
tofu apply

# 나쁨
provider "aws" {
  access_key = "AKIAIOSFODNN7EXAMPLE"
  secret_key = "wJalrXUtnFEMI/K7MDENG/..."
}

# 좋음: Environment variables
# AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY

terraform {
  required_version = "~> 1.6.0"
}

terraform force-unlock <lock_id>

terraform plan
# Review changes
terraform apply -refresh-only

# Debug
TF_LOG=DEBUG terraform plan

terraform graph | grep -i cycle

terraform apply -parallelism=20

terraform plan -target=module.vpc

terraform plan -refresh=false

export TF_PLUGIN_CACHE_DIR="$HOME/.terraform.d/plugin-cache"

modules/
├── vpc/              # VPC + subnets
├── eks/              # EKS cluster
├── rds/              # Database
├── alb/              # Load balancer
└── monitoring/       # CloudWatch, alarms

module "vpc" {
  source = "./modules/vpc"
}

module "eks" {
  source = "./modules/eks"
  vpc_id = module.vpc.vpc_id
}