diff --git a/iac-template/terraform-standard/config/resources/dev-object/s3.yaml b/iac-template/terraform-standard/config/resources/dev-object/s3.yaml new file mode 100644 index 00000000..0fde099d --- /dev/null +++ b/iac-template/terraform-standard/config/resources/dev-object/s3.yaml @@ -0,0 +1,10 @@ +bucket_name: "svc-plus-dev-objects" + +# 是否开启版本管理(默认建议开启) +enable_versioning: true + +# 是否启用加密,之后如果你想加 KMS 可以扩展 +enable_encryption: false + +# Public Access Block(通常建议保持 true) +block_public_access: true diff --git a/iac-template/terraform-standard/envs/dev-object/Makefile b/iac-template/terraform-standard/envs/dev-object/Makefile new file mode 100644 index 00000000..0b047ac2 --- /dev/null +++ b/iac-template/terraform-standard/envs/dev-object/Makefile @@ -0,0 +1,11 @@ +init: + terraform init --upgrade + +plan: + terraform plan + +apply: + terraform apply -auto-approve + +destroy: + terraform destroy -auto-approve diff --git a/iac-template/terraform-standard/envs/dev-object/backend.tf b/iac-template/terraform-standard/envs/dev-object/backend.tf new file mode 100644 index 00000000..aad095bf --- /dev/null +++ b/iac-template/terraform-standard/envs/dev-object/backend.tf @@ -0,0 +1,9 @@ +terraform { + backend "s3" { + bucket = "svc-plus-iac-state" + key = "account/dev/iam/terraform.tfstate" + region = "ap-northeast-1" + dynamodb_table = "svc-plus-iac-state-dynamodb-lock" + } +} + diff --git a/iac-template/terraform-standard/envs/dev-object/main.tf b/iac-template/terraform-standard/envs/dev-object/main.tf new file mode 100644 index 00000000..8f8253d5 --- /dev/null +++ b/iac-template/terraform-standard/envs/dev-object/main.tf @@ -0,0 +1,18 @@ +locals { + account = yamldecode( + file("${path.root}/../../config/accounts/dev.yaml") + ) + + s3_conf = yamldecode( + file("${path.root}/../../config/resources/dev-object/bucket.yaml") + ) +} + +module "s3" { + source = "../../modules/s3" + + bucket_name = local.s3_conf.bucket_name + enable_versioning = local.s3_conf.enable_versioning + tags = local.account.tags +} + diff --git a/iac-template/terraform-standard/envs/dev-object/outputs.tf b/iac-template/terraform-standard/envs/dev-object/outputs.tf new file mode 100644 index 00000000..f0cd41a0 --- /dev/null +++ b/iac-template/terraform-standard/envs/dev-object/outputs.tf @@ -0,0 +1,8 @@ +output "bucket_id" { + value = module.s3.bucket_id +} + +output "bucket_arn" { + value = module.s3.bucket_arn +} + diff --git a/iac-template/terraform-standard/envs/dev-object/provider.tf b/iac-template/terraform-standard/envs/dev-object/provider.tf new file mode 100644 index 00000000..7bddf948 --- /dev/null +++ b/iac-template/terraform-standard/envs/dev-object/provider.tf @@ -0,0 +1,20 @@ +terraform { + required_version = ">= 1.2" + + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.92.0" + } + } +} + +provider "aws" { + region = local.account.region + + assume_role { + role_arn = "arn:aws:iam::730335654753:role/TerraformDeployRole-Dev" + session_name = "TerraformDevSession" + } +} + diff --git a/iac-template/terraform-standard/modules/s3/main.tf b/iac-template/terraform-standard/modules/s3/main.tf new file mode 100644 index 00000000..32f414f2 --- /dev/null +++ b/iac-template/terraform-standard/modules/s3/main.tf @@ -0,0 +1,24 @@ +resource "aws_s3_bucket" "this" { + bucket = var.bucket_name + + tags = merge(var.tags, { + Name = var.bucket_name + }) +} + +resource "aws_s3_bucket_versioning" "this" { + bucket = aws_s3_bucket.this.id + + versioning_configuration { + status = var.enable_versioning ? "Enabled" : "Suspended" + } +} + +resource "aws_s3_bucket_public_access_block" "this" { + bucket = aws_s3_bucket.this.id + block_public_acls = true + block_public_policy = true + ignore_public_acls = true + restrict_public_buckets = true +} + diff --git a/iac-template/terraform-standard/modules/s3/outputs.tf b/iac-template/terraform-standard/modules/s3/outputs.tf new file mode 100644 index 00000000..0bb757e2 --- /dev/null +++ b/iac-template/terraform-standard/modules/s3/outputs.tf @@ -0,0 +1,8 @@ +output "bucket_id" { + value = aws_s3_bucket.this.id +} + +output "bucket_arn" { + value = aws_s3_bucket.this.arn +} + diff --git a/iac-template/terraform-standard/modules/s3/variables.tf b/iac-template/terraform-standard/modules/s3/variables.tf new file mode 100644 index 00000000..ec820375 --- /dev/null +++ b/iac-template/terraform-standard/modules/s3/variables.tf @@ -0,0 +1,16 @@ +variable "bucket_name" { + description = "S3 bucket name (must be globally unique)" + type = string +} + +variable "enable_versioning" { + description = "Whether to enable S3 versioning" + type = bool + default = true +} + +variable "tags" { + description = "Common tags" + type = map(string) +} +