Terraform Grundlagen: IaC für Linux-Administratoren und DevOps

┌ In die AWS-Konsole einloggen
├ VPC erstellen: Name eingeben, CIDR-Block auswählen, DNS-Auflösung aktivieren
├ Subnets erstellen: Public-Subnet 10.0.1.0/24, Private-Subnet 10.0.2.0/24
├ Internet Gateway erstellen und an VPC anhängen
├ Route Tables konfigurieren
├ Security Groups definieren: Web-Traffic auf Port 80/443, SSH auf Port 22
├ EC2-Instanz starten: AMI auswählen, Instance-Type festlegen, Key-Pair zuweisen
├ Load Balancer konfigurieren: Application Load Balancer, Target Groups, Health Checks
└ RDS-Instanz erstellen: Engine auswählen, Instance-Class, Storage, Backup-Einstellungen

┌ Tag 1: Klicken, konfigurieren, testen ✓
├ Tag 30: "Wie hatte ich das nochmal gemacht?" ❌
├ Tag 60: "Kollege braucht dasselbe" → 3 Stunden Klickarbeit ❌
└ Tag 90: "Backup-Region aufbauen" → 6 Stunden Klickarbeit ❌

# VPC erstellen
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "staging-vpc"
  }
}

# Public Subnet
resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-west-2a"
  map_public_ip_on_launch = true

  tags = {
    Name = "staging-public-subnet"
  }
}

┌ Tag 1: Code schreiben, testen, committen ✓
├ Tag 30: Git-History anschauen → sofort verstehen ✓
├ Tag 60: Kollege führt `terraform apply` aus → 5 Minuten ✓
└ Tag 90: Backup-Region → Variable ändern → 10 Minuten ✓

┌ Deklarativ: Du sagst, was du willst, nicht wie du es bekommst
├ Versioniert: Jede Änderung wird in Git getrackt
├ Reproduzierbar: Identische Umgebungen garantiert
├ Testbar: Infrastruktur-Code kann wie Application-Code getestet werden
└ Dokumentiert: Der Code ist die Dokumentation

resource "aws_db_instance" "main" {
  engine         = "mysql"
  engine_version = "8.0"
  instance_class = var.db_instance_class
  allocated_storage = var.db_storage

  db_name  = var.db_name
  username = var.db_username
  password = var.db_password

  vpc_security_group_ids = [aws_security_group.db.id]
  db_subnet_group_name   = aws_db_subnet_group.main.name

  backup_retention_period = var.backup_retention
  backup_window          = "03:00-04:00"

  tags = {
    Name = "${var.environment}-database"
  }
}

# Aktuelle Änderungen anzeigen
git log --oneline -10
a1b2c3d Update security group rules for web tier
d4e5f6g Add new RDS instance for analytics
g7h8i9j Update ALB target group health check

# Problem in der Produktion? Zurück zur vorherigen Version
git revert a1b2c3d
terraform plan   # Zeigt, was rückgängig gemacht wird
terraform apply  # Führt das Rollback aus

# Web-Tier Security Group
resource "aws_security_group" "web" {
  name_prefix = "${var.environment}-web-"
  vpc_id      = aws_vpc.main.id

  # HTTP-Traffic von überall
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # HTTPS-Traffic von überall
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # SSH nur aus dem Management-Subnet
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [aws_subnet.management.cidr_block]
  }

  # Ausgehender Traffic komplett erlaubt
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.environment}-web-sg"
    Tier = "web"
  }
}

stages:
  - validate
  - plan
  - apply

terraform-validate:
  stage: validate
  script:
    - terraform init
    - terraform validate
    - terraform fmt -check

terraform-plan:
  stage: plan
  script:
    - terraform plan -out=tfplan
  artifacts:
    paths:
      - tfplan

terraform-apply:
  stage: apply
  script:
    - terraform apply tfplan
  when: manual
  only:
    - main

# Entwicklungsumgebung am Feierabend herunterfahren
terraform destroy -target=aws_instance.dev_servers

# Am nächsten Morgen wieder hochfahren
terraform apply -target=aws_instance.dev_servers

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1d0"
  instance_type = "t3.micro"

  provisioner "remote-exec" {
    inline = [
      "sudo apt update",
      "sudo apt install -y python3"
    ]
  }

  provisioner "local-exec" {
    command = "ansible-playbook -i '${self.public_ip},' webserver.yml"
  }
}

Resources:
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0c55b159cbfafe1d0
      InstanceType: t3.micro
      KeyName: !Ref KeyName
      SecurityGroups:
        - !Ref WebServerSecurityGroup
      Tags:
        - Key: Name
          Value: WebServer

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1d0"
  instance_type = "t3.micro"
  key_name      = var.key_name
  security_groups = [aws_security_group.web.name]

  tags = {
    Name = "WebServer"
  }
}

# AWS-Ressourcen
resource "aws_instance" "web" {
  provider = aws.us_east_1
  ami           = "ami-0c55b159cbfafe1d0"
  instance_type = "t3.micro"
}

# Azure-Ressourcen
resource "azurerm_virtual_machine" "web" {
  provider = azurerm.west_europe
  name     = "web-vm"
  location = "West Europe"
}

# DNS bei Cloudflare
resource "cloudflare_record" "web" {
  zone_id = var.cloudflare_zone_id
  name    = "web"
  value   = aws_instance.web.public_ip
  type    = "A"
}

import pulumi_aws as aws

# Dynamisch Subnets für alle AZs erstellen
azs = aws.get_availability_zones()
subnets = []

for i, az in enumerate(azs.names):
    if i < 3:  # Nur erste 3 AZs
        subnet = aws.ec2.Subnet(f"subnet-{i}",
            vpc_id=vpc.id,
            cidr_block=f"10.0.{i+1}.0/24",
            availability_zone=az,
            tags={
                "Name": f"subnet-{az}",
                "Tier": "public" if i % 2 == 0 else "private"
            }
        )
        subnets.append(subnet)

# Conditional Logic für Environment
if pulumi.get_stack() == "production":
    instance_type = "t3.large"
    instance_count = 3
else:
    instance_type = "t3.micro"
    instance_count = 1

data "aws_availability_zones" "available" {}

locals {
  azs = slice(data.aws_availability_zones.available.names, 0, 3)
}

resource "aws_subnet" "main" {
  count = length(local.azs)

  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index + 1}.0/24"
  availability_zone = local.azs[count.index]

  tags = {
    Name = "subnet-${local.azs[count.index]}"
    Tier = count.index % 2 == 0 ? "public" : "private"
  }
}

locals {
  instance_config = {
    production = {
      type  = "t3.large"
      count = 3
    }
    staging = {
      type  = "t3.micro"
      count = 1
    }
  }
}

import unittest
import pulumi

class TestInfrastructure(unittest.TestCase):
    @pulumi.runtime.test
    def test_vpc_cidr(self):
        def check_cidr(args):
            vpc, = args
            self.assertEqual(vpc.cidr_block, "10.0.0.0/16")

        return pulumi.Output.all(vpc).apply(check_cidr)

# Terraform erstellt die Infrastruktur
resource "aws_instance" "web" {
  count = var.instance_count
  ami           = "ami-0c55b159cbfafe1d0"
  instance_type = "t3.micro"

  tags = {
    Name = "web-${count.index}"
  }
}

# Ansible-Inventar generieren
resource "local_file" "ansible_inventory" {
  content = templatefile("inventory.tpl", {
    web_servers = aws_instance.web[*].public_ip
  })
  filename = "ansible/inventory"
}

# Ansible-Playbook ausführen
resource "null_resource" "configure_servers" {
  depends_on = [local_file.ansible_inventory]

  provisioner "local-exec" {
    command = "cd ansible && ansible-playbook -i inventory site.yml"
  }

  triggers = {
    instance_ids = join(",", aws_instance.web[*].id)
  }
}

terraform plan

Terraform will perform the following actions:

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami           = "ami-0c55b159cbfafe1d0"
      + instance_type = "t3.micro"
      + key_name      = "my-key"
      + public_ip     = (known after apply)
      + tags          = {
          + "Name" = "web-server"
        }
    }

  # aws_security_group.web will be modified
  ~ resource "aws_security_group" "web" {
        id = "sg-12345678"
      ~ ingress {
          + from_port = 443
          + to_port   = 443
            protocol  = "tcp"
            cidr_blocks = ["0.0.0.0/0"]
        }
    }

Plan: 1 to add, 1 to change, 0 to destroy.

# Methode 1: Direkte Konfiguration (nicht empfohlen für Produktion)
provider "aws" {
  region     = "us-west-2"
  access_key = "AKIA..."
  secret_key = "..."
}

# Methode 2: Umgebungsvariablen
provider "aws" {
  region = "us-west-2"
  # AWS_ACCESS_KEY_ID und AWS_SECRET_ACCESS_KEY aus Environment
}

# Methode 3: AWS Profile
provider "aws" {
  region  = "us-west-2"
  profile = "default"
}

# Methode 4: IAM Roles (empfohlen für EC2/ECS)
provider "aws" {
  region = "us-west-2"
  # Automatisch von Instance Metadata Service
}

# Methode 5: Assume Role
provider "aws" {
  region = "us-west-2"

  assume_role {
    role_arn = "arn:aws:iam::123456789012:role/TerraformRole"
  }
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
    github = {
      source  = "integrations/github"
      version = "~> 5.0"
    }
  }
}

# Mehrere AWS-Regionen
provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}

provider "aws" {
  alias  = "us_west_2"
  region = "us-west-2"
}

# Cloudflare für DNS
provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

# GitHub für Repository Management
provider "github" {
  token = var.github_token
  owner = var.github_organization
}

provider "aws" {
  region = "us-west-2"

  # Performance-Optimierungen
  max_retries = 3

  # Request-Timeouts
  http_timeout = "30s"

  # Für große Deployments
  skip_metadata_api_check = true
  skip_region_validation  = true

  # Default Tags für alle Ressourcen
  default_tags {
    tags = {
      Environment = var.environment
      Project     = var.project_name
      ManagedBy   = "terraform"
      CreatedAt   = timestamp()
    }
  }
}

┌ Resource Lifecycle
├─────────────────────
│  CREATE → READ → UPDATE → DELETE (CRUD)
│     ↓       ↓       ↓        ↓
│   apply   refresh  apply   destroy
│
│  Zusätzliche Aktionen:
│  • Import (bestehende Ressourcen übernehmen)
│  • Taint (Ressource zum Neuerstellen markieren)
│  • Untaint (Taint-Markierung entfernen)
│  • Replace (Ressource ersetzen)

# EC2-Instanz mit erweiterten Eigenschaften
resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  key_name      = aws_key_pair.deployer.key_name

  # Netzwerk-Konfiguration
  vpc_security_group_ids = [
    aws_security_group.web.id,
    aws_security_group.ssh.id
  ]
  subnet_id                   = aws_subnet.public.id
  associate_public_ip_address = true

  # Storage-Konfiguration
  root_block_device {
    volume_type           = "gp3"
    volume_size           = 20
    encrypted             = true
    delete_on_termination = true

    tags = {
      Name = "root-volume"
    }
  }

  # Zusätzliche EBS-Volumes
  ebs_block_device {
    device_name           = "/dev/sdb"
    volume_type           = "gp3"
    volume_size           = 100
    encrypted             = true
    delete_on_termination = false

    tags = {
      Name = "data-volume"
    }
  }

  # Monitoring
  monitoring = true

  # Placement
  availability_zone = data.aws_availability_zones.available.names[0]

  # User Data Script
  user_data = base64encode(templatefile("${path.module}/userdata.sh", {
    db_host = aws_db_instance.main.endpoint
    app_env = var.environment
  }))

  # Lifecycle-Regeln
  lifecycle {
    create_before_destroy = true
    ignore_changes = [
      ami,  # AMI-Updates ignorieren
      user_data,  # User Data Änderungen ignorieren
    ]
  }

  # Detaillierte Tags
  tags = {
    Name        = "${var.project}-web-${var.environment}"
    Environment = var.environment
    Project     = var.project
    Role        = "webserver"
    Backup      = "daily"
    Monitoring  = "enabled"
  }
}

# Security Group mit detaillierten Regeln
resource "aws_security_group" "web" {
  name_prefix = "${var.project}-web-"
  description = "Security group for web servers"
  vpc_id      = aws_vpc.main.id

  # HTTP von überall
  ingress {
    description = "HTTP from internet"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # HTTPS von überall
  ingress {
    description = "HTTPS from internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # SSH nur von Management-Subnet
  ingress {
    description = "SSH from management"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [aws_subnet.management.cidr_block]
  }

  # Application Port von Load Balancer
  ingress {
    description     = "App port from ALB"
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }

  # Ausgehender Traffic
  egress {
    description = "All outbound traffic"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Lifecycle-Regeln
  lifecycle {
    create_before_destroy = true
  }

  tags = {
    Name = "${var.project}-web-sg"
  }
}

┌ Dependency Resolution
├────────────────────────────────────────────
│
│   VPC ──────────────────────────────────────┐
│    │                                        │
│    ├─→ Internet Gateway                     │
│    │                                        │
│    ├─→ Subnets ──────────────────────────┐  │
│    │    │                                │  │
│    │    ├─→ Route Tables                 │  │
│    │    │                                │  │
│    │    └─→ NAT Gateways                 │  │
│    │                                     │  │
│    └─→ Security Groups ──────────────────┼──┘
│                     │                    │
│                     └─→ EC2 Instances ←──┘
│                              │
│                              └─→ Load Balancer

# Count-basierte Ressourcen
resource "aws_instance" "web" {
  count = var.instance_count

  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"

  tags = {
    Name = "web-${count.index + 1}"
  }
}

# For_Each-basierte Ressourcen (flexibler)
resource "aws_instance" "app" {
  for_each = var.applications

  ami           = data.aws_ami.ubuntu.id
  instance_type = each.value.instance_type

  tags = {
    Name        = "app-${each.key}"
    Application = each.key
    Environment = each.value.environment
  }
}

# Variable für For_Each
variable "applications" {
  type = map(object({
    instance_type = string
    environment   = string
  }))

  default = {
    frontend = {
      instance_type = "t3.micro"
      environment   = "production"
    }
    backend = {
      instance_type = "t3.small"
      environment   = "production"
    }
    worker = {
      instance_type = "t3.medium"
      environment   = "production"
    }
  }
}

# Bestehende VPC mit komplexen Filtern
data "aws_vpc" "existing" {
  filter {
    name   = "tag:Environment"
    values = ["production"]
  }

  filter {
    name   = "tag:Team"
    values = ["platform"]
  }

  filter {
    name   = "state"
    values = ["available"]
  }
}

# Verfügbare Availability Zones mit Filtern
data "aws_availability_zones" "available" {
  state = "available"

  filter {
    name   = "zone-type"
    values = ["availability-zone"]
  }

  exclude_names = ["us-west-2d"]  # Problematische AZ ausschließen
}

# Neueste AMI mit komplexen Kriterien
data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]  # Canonical

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  filter {
    name   = "state"
    values = ["available"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }
}

# Subnets mit dynamischer Auswahl
data "aws_subnets" "private" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.existing.id]
  }

  filter {
    name   = "tag:Type"
    values = ["private"]
  }

  filter {
    name   = "availability-zone"
    values = data.aws_availability_zones.available.names
  }
}

# Security Groups mit komplexen Filtern
data "aws_security_groups" "web" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.existing.id]
  }

  filter {
    name   = "tag:Purpose"
    values = ["web", "frontend"]
  }

  filter {
    name   = "group-name"
    values = ["*-web-*"]
  }
}

# Externe API-Aufrufe
data "http" "my_public_ip" {
  url = "https://ifconfig.me/ip"

  request_headers = {
    Accept = "text/plain"
  }
}

# Externe Skripte ausführen
data "external" "vault_token" {
  program = ["bash", "${path.module}/scripts/get_vault_token.sh"]

  query = {
    vault_addr = var.vault_addr
    role_id    = var.vault_role_id
  }
}

# SSL-Zertifikat-Informationen
data "aws_acm_certificate" "main" {
  domain      = "*.${var.domain_name}"
  statuses    = ["ISSUED"]
  most_recent = true
}

# Route53 Hosted Zone
data "aws_route53_zone" "main" {
  name         = var.domain_name
  private_zone = false
}

# Lokale Werte für bessere Performance
locals {
  vpc_id = data.aws_vpc.existing.id
  subnet_ids = data.aws_subnets.private.ids

  # Berechnete Werte
  az_count = length(data.aws_availability_zones.available.names)

  # Conditional Logic
  use_existing_vpc = var.vpc_id != "" ? var.vpc_id : data.aws_vpc.existing.id
}

# Ressourcen mit Data Source-Referenzen
resource "aws_instance" "web" {
  count = local.az_count

  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"
  subnet_id     = local.subnet_ids[count.index]

  vpc_security_group_ids = data.aws_security_groups.web.ids

  tags = {
    Name = "web-${count.index + 1}"
    AZ   = data.aws_availability_zones.available.names[count.index]
  }
}

# Load Balancer mit Data Source-Konfiguration
resource "aws_lb" "main" {
  name               = "main-alb"
  internal           = false
  load_balancer_type = "application"

  subnets = data.aws_subnets.private.ids

  security_groups = data.aws_security_groups.web.ids

  tags = {
    VPC = data.aws_vpc.existing.tags.Name
  }
}

# Route53 Record mit externen Daten
resource "aws_route53_record" "api" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = "api.${data.aws_route53_zone.main.name}"
  type    = "A"

  alias {
    name                   = aws_lb.main.dns_name
    zone_id                = aws_lb.main.zone_id
    evaluate_target_health = true
  }
}

┌ Module Architecture
├─────────────────────────────────────────────
│
│  Root Module (main.tf)
│  ├─── Local Module (./modules/vpc)
│  │    ├─── variables.tf
│  │    ├─── main.tf
│  │    ├─── outputs.tf
│  │    └─── versions.tf
│  │
│  ├─── Remote Module (terraform-aws-modules/eks/aws)
│  │    └─── Version: 19.0.0
│  │
│  └─── Private Module (company.com/modules/security)
│       └─── Version: 1.2.3

modules/vpc/
├── main.tf                 # Hauptkonfiguration
├── variables.tf            # Input-Variablen
├── outputs.tf              # Output-Werte
├── versions.tf             # Provider-Anforderungen
├── locals.tf               # Lokale Berechnungen
└── README.md               # Dokumentation

variable "name" {
  description = "Name for the VPC and related resources"
  type        = string
  validation {
    condition     = length(var.name) > 0 && length(var.name) <= 32
    error_message = "VPC name must be between 1 and 32 characters."
  }
}

variable "cidr_block" {
  description = "CIDR block for the VPC"
  type        = string
  validation {
    condition     = can(cidrhost(var.cidr_block, 0))
    error_message = "CIDR block must be a valid IPv4 CIDR."
  }
}

variable "availability_zones" {
  description = "List of availability zones"
  type        = list(string)
  validation {
    condition     = length(var.availability_zones) >= 2
    error_message = "At least 2 availability zones are required."
  }
}

variable "public_subnets" {
  description = "List of public subnet CIDR blocks"
  type        = list(string)
  default     = []
}

variable "private_subnets" {
  description = "List of private subnet CIDR blocks"
  type        = list(string)
  default     = []
}

variable "enable_nat_gateway" {
  description = "Enable NAT gateway for private subnets"
  type        = bool
  default     = true
}

variable "single_nat_gateway" {
  description = "Use single NAT gateway for all private subnets"
  type        = bool
  default     = false
}

variable "enable_dns_hostnames" {
  description = "Enable DNS hostnames in the VPC"
  type        = bool
  default     = true
}

variable "enable_dns_support" {
  description = "Enable DNS support in the VPC"
  type        = bool
  default     = true
}

variable "tags" {
  description = "Additional tags for all resources"
  type        = map(string)
  default     = {}
}

locals {
  # Berechne Anzahl der AZs
  az_count = length(var.availability_zones)

  # NAT Gateway-Anzahl
  nat_gateway_count = var.single_nat_gateway ? 1 : local.az_count

  # Gemeinsame Tags
  common_tags = merge(
    var.tags,
    {
      ManagedBy = "terraform"
      Module    = "vpc"
    }
  )

  # Subnet-Berechnungen
  public_subnet_count  = length(var.public_subnets)
  private_subnet_count = length(var.private_subnets)

  # Validierung
  has_public_subnets  = local.public_subnet_count > 0
  has_private_subnets = local.private_subnet_count > 0

  # Route Table-Zuordnungen
  private_route_table_ids = var.single_nat_gateway ? [aws_route_table.private[0].id] : aws_route_table.private[*].id
}

# VPC erstellen
resource "aws_vpc" "main" {
  cidr_block           = var.cidr_block
  enable_dns_hostnames = var.enable_dns_hostnames
  enable_dns_support   = var.enable_dns_support

  tags = merge(
    local.common_tags,
    {
      Name = var.name
    }
  )
}

# Internet Gateway
resource "aws_internet_gateway" "main" {
  count = local.has_public_subnets ? 1 : 0

  vpc_id = aws_vpc.main.id

  tags = merge(
    local.common_tags,
    {
      Name = "${var.name}-igw"
    }
  )
}

# Public Subnets
resource "aws_subnet" "public" {
  count = local.public_subnet_count

  vpc_id                  = aws_vpc.main.id
  cidr_block              = var.public_subnets[count.index]
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true

  tags = merge(
    local.common_tags,
    {
      Name = "${var.name}-public-${count.index + 1}"
      Type = "public"
    }
  )
}

# Private Subnets
resource "aws_subnet" "private" {
  count = local.private_subnet_count

  vpc_id            = aws_vpc.main.id
  cidr_block        = var.private_subnets[count.index]
  availability_zone = var.availability_zones[count.index]

  tags = merge(
    local.common_tags,
    {
      Name = "${var.name}-private-${count.index + 1}"
      Type = "private"
    }
  )
}

# Elastic IPs für NAT Gateways
resource "aws_eip" "nat" {
  count = local.has_private_subnets && var.enable_nat_gateway ? local.nat_gateway_count : 0

  domain = "vpc"

  depends_on = [aws_internet_gateway.main]

  tags = merge(
    local.common_tags,
    {
      Name = "${var.name}-nat-eip-${count.index + 1}"
    }
  )
}

# NAT Gateways
resource "aws_nat_gateway" "main" {
  count = local.has_private_subnets && var.enable_nat_gateway ? local.nat_gateway_count : 0

  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id

  depends_on = [aws_internet_gateway.main]

  tags = merge(
    local.common_tags,
    {
      Name = "${var.name}-nat-${count.index + 1}"
    }
  )
}

# Public Route Table
resource "aws_route_table" "public" {
  count = local.has_public_subnets ? 1 : 0

  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main[0].id
  }

  tags = merge(
    local.common_tags,
    {
      Name = "${var.name}-public-rt"
    }
  )
}

# Private Route Tables
resource "aws_route_table" "private" {
  count = local.has_private_subnets ? local.nat_gateway_count : 0

  vpc_id = aws_vpc.main.id

  dynamic "route" {
    for_each = var.enable_nat_gateway ? [1] : []
    content {
      cidr_block     = "0.0.0.0/0"
      nat_gateway_id = aws_nat_gateway.main[count.index].id
    }
  }

  tags = merge(
    local.common_tags,
    {
      Name = "${var.name}-private-rt-${count.index + 1}"
    }
  )
}

# Public Route Table Associations
resource "aws_route_table_association" "public" {
  count = local.public_subnet_count

  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public[0].id
}

# Private Route Table Associations
resource "aws_route_table_association" "private" {
  count = local.private_subnet_count

  subnet_id      = aws_subnet.private[count.index].id
  route_table_id = local.private_route_table_ids[var.single_nat_gateway ? 0 : count.index]
}

output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.main.id
}

output "vpc_cidr_block" {
  description = "CIDR block of the VPC"
  value       = aws_vpc.main.cidr_block
}

output "public_subnet_ids" {
  description = "IDs of the public subnets"
  value       = aws_subnet.public[*].id
}

output "private_subnet_ids" {
  description = "IDs of the private subnets"
  value       = aws_subnet.private[*].id
}

output "internet_gateway_id" {
  description = "ID of the internet gateway"
  value       = local.has_public_subnets ? aws_internet_gateway.main[0].id : null
}

output "nat_gateway_ids" {
  description = "IDs of the NAT gateways"
  value       = aws_nat_gateway.main[*].id
}

output "public_route_table_id" {
  description = "ID of the public route table"
  value       = local.has_public_subnets ? aws_route_table.public[0].id : null
}

output "private_route_table_ids" {
  description = "IDs of the private route tables"
  value       = aws_route_table.private[*].id
}

output "availability_zones" {
  description = "List of availability zones used"
  value       = var.availability_zones
}

# Entwicklungsumgebung
module "vpc_dev" {
  source = "./modules/vpc"

  name               = "dev-vpc"
  cidr_block         = "10.0.0.0/16"
  availability_zones = ["us-west-2a", "us-west-2b"]

  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]
  private_subnets = ["10.0.10.0/24", "10.0.20.0/24"]

  enable_nat_gateway  = true
  single_nat_gateway  = true  # Kosteneinsparung

  tags = {
    Environment = "development"
    Project     = "my-app"
  }
}

# Produktionsumgebung
module "vpc_prod" {
  source = "./modules/vpc"

  name               = "prod-vpc"
  cidr_block         = "10.1.0.0/16"
  availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]

  public_subnets  = ["10.1.1.0/24", "10.1.2.0/24", "10.1.3.0/24"]
  private_subnets = ["10.1.10.0/24", "10.1.20.0/24", "10.1.30.0/24"]

  enable_nat_gateway  = true
  single_nat_gateway  = false  # Hochverfügbarkeit

  tags = {
    Environment = "production"
    Project     = "my-app"
  }
}

# Remote Module aus Registry
module "eks" {
  source = "terraform-aws-modules/eks/aws"
  version = "19.0.0"

  cluster_name    = "my-cluster"
  cluster_version = "1.24"

  vpc_id     = module.vpc_prod.vpc_id
  subnet_ids = module.vpc_prod.private_subnet_ids

  eks_managed_node_groups = {
    main = {
      instance_types = ["t3.medium"]
      min_size       = 1
      max_size       = 3
      desired_size   = 2
    }
  }

  tags = {
    Environment = "production"
  }
}

┌ Component Interaction Flow
├─────────────────────────────────────────────
│
│  1. Provider ←── Authentication ──→ Cloud APIs
│      ↓
│  2. Data Sources ←── Query ──→ Existing Infrastructure
│      ↓
│  3. Resources ←── Create/Update/Delete ──→ Infrastructure
│      ↓
│  4. Modules ←── Encapsulate ──→ Reusable Components
│      ↓
│  5. State File ←── Track ──→ Current State

1. WRITE (Konfiguration)
   ├─ .tf Dateien erstellen
   ├─ Variablen definieren
   └─ Module einbinden
              ↓
2. INIT (Initialisierung)
   ├─ Provider herunterladen
   ├─ Backend konfigurieren
   └─ Module initialisieren
              ↓
3. PLAN (Planung)
   ├─ Änderungen berechnen
   ├─ Dependency Graph erstellen
   └─ Preview anzeigen
              ↓
4. APPLY (Anwendung)
   ├─ Änderungen ausführen
   ├─ State aktualisieren
   └─ Outputs anzeigen
              ↓
5. DESTROY (Aufräumen)
   ├─ Ressourcen löschen
   ├─ State bereinigen
   └─ Kosten sparen

project/
├── main.tf                      # Hauptkonfiguration
├── variables.tf                 # Input-Variablen
├── outputs.tf                   # Output-Werte
├── versions.tf                  # Provider-Versionen
├── terraform.tfvars             # Variablen-Werte
├── modules/                     # Lokale Module
│   └── vpc/
│       ├── main.tf
│       ├── variables.tf
│       └── outputs.tf
└── environments/                # Umgebungsspezifische Configs
    ├── dev/   
    │   └── terraform.tfvars
    └── prod/
        └── terraform.tfvars

terraform {
  required_version = ">= 1.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.1"
    }
  }

  # Backend-Konfiguration
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "infrastructure/terraform.tfstate"
    region = "us-west-2"
  }
}

variable "environment" {
  description = "Environment name (dev, staging, prod)"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

variable "project_name" {
  description = "Name of the project"
  type        = string
  validation {
    condition     = can(regex("^[a-zA-Z0-9-]+$", var.project_name))
    error_message = "Project name must contain only alphanumeric characters and hyphens."
  }
}

variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
  default     = "10.0.0.0/16"
  validation {
    condition     = can(cidrhost(var.vpc_cidr, 0))
    error_message = "VPC CIDR must be a valid IPv4 CIDR block."
  }
}

variable "availability_zones" {
  description = "List of availability zones"
  type        = list(string)
  default     = ["us-west-2a", "us-west-2b"]
}

variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"
}

variable "enable_monitoring" {
  description = "Enable CloudWatch monitoring"
  type        = bool
  default     = true
}

variable "tags" {
  description = "Common tags for all resources"
  type        = map(string)
  default     = {}
}

# Lokale Berechnungen
locals {
  common_tags = merge(
    var.tags,
    {
      Environment = var.environment
      Project     = var.project_name
      ManagedBy   = "terraform"
      CreatedAt   = timestamp()
    }
  )

  # Berechnete Werte
  vpc_name = "${var.project_name}-${var.environment}-vpc"

  # Subnet-Berechnung
  public_subnets  = [for i, az in var.availability_zones : cidrsubnet(var.vpc_cidr, 8, i)]
  private_subnets = [for i, az in var.availability_zones : cidrsubnet(var.vpc_cidr, 8, i + 10)]
}

# VPC Module
module "vpc" {
  source = "./modules/vpc"

  name               = local.vpc_name
  cidr_block         = var.vpc_cidr
  availability_zones = var.availability_zones

  public_subnets  = local.public_subnets
  private_subnets = local.private_subnets

  enable_nat_gateway = var.environment == "prod" ? true : false
  single_nat_gateway = var.environment != "prod" ? true : false

  tags = local.common_tags
}

# Security Group für Web-Server
resource "aws_security_group" "web" {
  name_prefix = "${var.project_name}-${var.environment}-web-"
  description = "Security group for web servers"
  vpc_id      = module.vpc.vpc_id

  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "HTTPS"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "All outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    local.common_tags,
    {
      Name = "${var.project_name}-${var.environment}-web-sg"
    }
  )

  lifecycle {
    create_before_destroy = true
  }
}

# Launch Template für Auto Scaling
resource "aws_launch_template" "web" {
  name_prefix   = "${var.project_name}-${var.environment}-web-"
  image_id      = data.aws_ami.ubuntu.id
  instance_type = var.instance_type

  vpc_security_group_ids = [aws_security_group.web.id]

  user_data = base64encode(templatefile("${path.module}/userdata.sh", {
    project_name = var.project_name
    environment  = var.environment
  }))

  monitoring {
    enabled = var.enable_monitoring
  }

  tag_specifications {
    resource_type = "instance"
    tags = merge(
      local.common_tags,
      {
        Name = "${var.project_name}-${var.environment}-web"
      }
    )
  }

  lifecycle {
    create_before_destroy = true
  }
}

1. Backend-Konfiguration
┌ Backend-Type prüfen
├ Credentials validieren
└ State-Location konfigurieren

2. Provider-Installation
┌ Provider-Anforderungen lesen
├ Kompatible Versionen finden
├ Binaries herunterladen
└ .terraform/-Verzeichnis erstellen

3. Module-Verarbeitung
┌ Module-Quellen analysieren
├ Lokale Module kopieren
├ Remote Module herunterladen
└ Module-Abhängigkeiten auflösen

4. Lock-File erstellen
┌ Provider-Versionen fixieren
├ Hashes berechnen
└ .terraform.lock.hcl erstellen

terraform init

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 5.0"...
- Finding hashicorp/random versions matching "~> 3.1"...
- Installing hashicorp/aws v5.31.0...
- Installing hashicorp/random v3.4.3...

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Initializing modules...
- vpc in modules/vpc

Terraform has been successfully initialized!

# S3 Backend mit DynamoDB-Locking
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "infrastructure/terraform.tfstate"
    region         = "us-west-2"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.

provider "registry.terraform.io/hashicorp/aws" {
  version     = "5.31.0"
  constraints = "~> 5.0"
  hashes = [
    "h1:ltxyuBWIy9cq0k9gMCcE7c7wgmPHJaZGlb5lOEjqITE=",
    "zh:0cdb9c2083681ddf2c1f1b0e1e2e2e0b4e5e8f7a7b0a1b2c3d4e5f6789abcdef...",
  ]
}

1. Konfiguration parsen
┌ HCL-Files lesen
├ Variablen auflösen
└ Module expandieren

2. State analysieren
├ Aktuellen State lesen
├ Ressourcen-Status prüfen
└ Drift-Detection

3. Dependency-Graph erstellen
┌ Ressourcen-Abhängigkeiten
├ Parallelisierung planen
└ Ausführungsreihenfolge

4. Änderungen berechnen
┌ Create (neue Ressourcen)
├ Update (geänderte Ressourcen)
├ Delete (gelöschte Ressourcen)
└ Replace (neu erstellte Ressourcen)

5. Plan-Output generieren
┌ Änderungen formatieren
├ Farbcodes für Aktionen
└ Zusammenfassung erstellen

terraform plan

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy
  -/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami                                  = "ami-0c55b159cbfafe1d0"
      + instance_type                        = "t3.micro"
      + tags                                 = {
          + "Environment" = "dev"
          + "Name"        = "web-server"
          + "Project"     = "my-app"
        }
    }

  # aws_security_group.web will be updated in-place
  ~ resource "aws_security_group" "web" {
        id = "sg-12345678"
      ~ ingress {
          ~ cidr_blocks = [
              - "10.0.0.0/16",
              + "0.0.0.0/0",
            ]
            from_port = 443
            protocol  = "tcp"
            to_port   = 443
        }
    }

  # aws_instance.old will be destroyed
  - resource "aws_instance" "old" {
      - ami           = "ami-0abcdef1234567890" -> null
      - instance_type = "t2.micro" -> null
      - id            = "i-1234567890abcdef0" -> null
    }

Plan: 1 to add, 1 to change, 1 to destroy.

# Plan mit Details
terraform plan -detailed-exitcode

# Exit-Codes:
# 0 = No changes
# 1 = Error
# 2 = Changes present

# Plan in Datei speichern
terraform plan -out=tfplan

# Gespeicherten Plan anzeigen
terraform show tfplan

# Plan als JSON
terraform show -json tfplan | jq .

1. Plan validieren
┌ Gespeicherten Plan laden ODER
├ Neuen Plan erstellen
└ Bestätigung vom User

2. Dependency-Graph abarbeiten
┌ Parallelisierung (max 10 gleichzeitig)
├ Abhängigkeiten respektieren
└ Errorbehandlung

3. Ressourcen-Operationen
┌ API-Calls an Provider
├ Retry-Mechanismen
├ Timeout-Handling
└ Error-Recovery

4. State-Updates
┌ State-File aktualisieren
├ Outputs berechnen
└ State-Locks freigeben

5. Ergebnisse anzeigen
┌ Erfolgreiche Operationen
├ Fehler und Warnungen
└ Output-Werte

terraform apply

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami           = "ami-0c55b159cbfafe1d0"
      + instance_type = "t3.micro"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_instance.web: Creating...
aws_instance.web: Still creating... [10s elapsed]
aws_instance.web: Still creating... [20s elapsed]
aws_instance.web: Creation complete after 23s [id=i-0123456789abcdef0]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

instance_id = "i-0123456789abcdef0"
instance_ip = "54.123.45.67"

# Plan erstellen und speichern
terraform plan -out=tfplan

# Gespeicherten Plan anwenden (ohne Bestätigung)
terraform apply tfplan

aws_instance.web: Creating...
aws_instance.web: Creation complete after 23s [id=i-0123456789abcdef0]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

# Automatische Bestätigung (für CI/CD)
terraform apply -auto-approve

# Parallelität reduzieren (für Rate-Limits)
terraform apply -parallelism=3

# Spezifische Ressource ersetzen
terraform apply -replace=aws_instance.web

# Mit Variables-File
terraform apply -var-file=production.tfvars

# Target-spezifisches Apply
terraform apply -target=module.vpc

# Detaillierte Logs
TF_LOG=DEBUG terraform apply

# Logs in Datei
TF_LOG=INFO TF_LOG_PATH=./terraform.log terraform apply

# JSON-Output für Parsing
terraform apply -json | jq .

terraform destroy

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # aws_instance.web will be destroyed
  - resource "aws_instance" "web" {
      - ami           = "ami-0c55b159cbfafe1d0" -> null
      - instance_type = "t3.micro" -> null
      - id            = "i-0123456789abcdef0" -> null
    }

  # aws_security_group.web will be destroyed
  - resource "aws_security_group" "web" {
      - id   = "sg-12345678" -> null
      - name = "web-sg" -> null
    }

Plan: 0 to add, 0 to change, 2 to destroy.

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

aws_instance.web: Destroying... [id=i-0123456789abcdef0]
aws_instance.web: Still destroying... [id=i-0123456789abcdef0, 10s elapsed]
aws_instance.web: Destruction complete after 23s
aws_security_group.web: Destroying... [id=sg-12345678]
aws_security_group.web: Destruction complete after 1s

Destroy complete! Resources: 2 destroyed.

# Nur eine spezifische Ressource
terraform destroy -target=aws_instance.web

# Mehrere Ressourcen
terraform destroy -target=aws_instance.web -target=aws_security_group.web

# Mit automatischer Bestätigung
terraform destroy -auto-approve

resource "aws_db_instance" "main" {
  # ... Konfiguration

  lifecycle {
    prevent_destroy = true
  }
}

# Aktuelle Version ermitteln
TERRAFORM_VERSION=$(curl -s https://api.github.com/repos/hashicorp/terraform/releases/latest | grep tag_name | cut -d '"' -f 4 | sed 's/v//')

# Download und Installation
wget "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
unzip "terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
sudo mv terraform /usr/local/bin/
sudo chmod +x /usr/local/bin/terraform

# Verifikation
terraform version
terraform -help

# Voraussetzungen installieren
sudo apt update
sudo apt install -y gnupg software-properties-common curl

# HashiCorp GPG Key hinzufügen
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -

# HashiCorp Repository hinzufügen
sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"

# Installation
sudo apt update
sudo apt install terraform

# Verifizierung
terraform version
terraform -help

# HashiCorp Repository konfigurieren
sudo yum install -y yum-utils
sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo

# Installation
sudo yum install terraform

# Verifizierung
terraform version

# HashiCorp Repository hinzufügen
sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://rpm.releases.hashicorp.com/fedora/hashicorp.repo

# Installation
sudo dnf install terraform

# Verifizierung
terraform version

# AUR Helper verwenden (z.B. yay)
yay -S terraform

# Oder manuell aus AUR
git clone https://aur.archlinux.org/terraform.git
cd terraform
makepkg -si

# tfenv Repository klonen
git clone https://github.com/tfutils/tfenv.git ~/.tfenv

# PATH permanent erweitern
echo 'export PATH="$HOME/.tfenv/bin:$PATH"' >> ~/.bashrc
echo 'export PATH="$HOME/.tfenv/bin:$PATH"' >> ~/.zshrc

# Aktuelle Session aktualisieren
source ~/.bashrc  # oder ~/.zshrc

# Installation verifizieren
tfenv --version

# System-Installation entfernen
sudo apt remove terraform  # Ubuntu/Debian
sudo yum remove terraform  # CentOS/RHEL

# Manuelle Installation entfernen
sudo rm -f /usr/local/bin/terraform
sudo rm -f /usr/bin/terraform

# Verifizieren, dass keine Terraform-Binary mehr vorhanden ist
which terraform  # Sollte nichts zurückgeben

# Verschiedene Versionen installieren
tfenv install 1.6.0      # Neueste für neue Projekte
tfenv install 1.5.7      # Für bestehende Projekte
tfenv install 1.4.6      # Für Legacy-Projekte

# Installierte Versionen anzeigen
tfenv list
# * 1.6.0 (set by /home/user/.tfenv/version)
#   1.5.7
#   1.4.6

# Projekt A (neue Version)
cd ~/projects/project-a
tfenv use 1.6.0
echo "1.6.0" > .terraform-version
terraform version
# Terraform v1.6.0

# Projekt B (Legacy)
cd ~/projects/project-b
tfenv use 1.4.6
echo "1.4.6" > .terraform-version
terraform version
# Terraform v1.4.6

# .terraform-version Datei erstellen
cd ~/projects/my-project
echo "1.5.7" > .terraform-version

# tfenv erkennt automatisch die gewünschte Version
tfenv install  # Installiert 1.5.7 falls nicht vorhanden
tfenv use      # Aktiviert 1.5.7

# Verifizierung
terraform version
# Terraform v1.5.7

# In Projektverzeichnis
cd ~/projects/team-project

# .terraform-version commiten
echo "1.6.0" > .terraform-version
git add .terraform-version
git commit -m "Pin Terraform version to 1.6.0"

# Team-Mitglieder können jetzt:
git pull
tfenv install  # Installiert automatisch 1.6.0
tfenv use      # Aktiviert 1.6.0

# ~/.tfenv/version für globale Default-Version
echo "1.6.0" > ~/.tfenv/version

# Oder per Befehl
tfenv use 1.6.0

# ~/.terraformrc erstellen
cat > ~/.terraformrc << 'EOF'
# Plugin-Cache Verzeichnis (spart Download-Zeit)
plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"

# Telemetrie deaktivieren (Privacy)
disable_checkpoint = true

# Logging-Konfiguration
log_level = "INFO"

# Provider-Installation-Konfiguration
provider_installation {
  # Lokaler Cache hat Priorität
  filesystem_mirror {
    path    = "/home/user/.terraform.d/providers"
    include = ["registry.terraform.io/*/*"]
  }

  # Fallback zu direktem Download
  direct {
    exclude = []
  }
}

# Credentials für Private Registries
credentials "private-registry.company.com" {
  token = "YOUR_TOKEN_HERE"
}
EOF

# Plugin-Cache Verzeichnis erstellen
mkdir -p ~/.terraform.d/plugin-cache

# Berechtigungen setzen
chmod 755 ~/.terraform.d/plugin-cache

# Cache-Größe prüfen (nach einiger Nutzung)
du -sh ~/.terraform.d/plugin-cache

# ~/.bashrc oder ~/.zshrc ergänzen
cat >> ~/.bashrc << 'EOF'

# Terraform-Konfiguration
export TF_DATA_DIR="$HOME/.terraform.d"
export TF_PLUGIN_CACHE_DIR="$HOME/.terraform.d/plugin-cache"

# Logging (nur für Debugging aktivieren)
# export TF_LOG=INFO
# export TF_LOG_PATH="./terraform.log"

# Performance-Optimierungen
export TF_CLI_ARGS_plan="-parallelism=10"
export TF_CLI_ARGS_apply="-parallelism=10"

# Input-Deaktivierung für CI/CD
# export TF_INPUT=false

# Credential-Management
export TF_VAR_aws_region="us-west-2"
# export TF_VAR_access_key="your-access-key"  # Nicht empfohlen!

EOF

# Änderungen laden
source ~/.bashrc

# Terraform-Completion installieren
terraform -install-autocomplete

# Manuell für verschiedene Shells
echo 'complete -C terraform terraform' >> ~/.bashrc  # Bash
echo 'autoload -U +X bashcompinit && bashcompinit' >> ~/.zshrc  # Zsh
echo 'complete -C terraform terraform' >> ~/.zshrc

# Completion testen
terraform <TAB><TAB>
# apply  console  destroy  fmt  get  graph  import  init  output  plan  providers  refresh  show  state  taint  untaint  validate  version  workspace

# Terraform-Projekte organisieren
mkdir -p ~/terraform-projects/{personal,work,learning}

# Template-Verzeichnis für neue Projekte
mkdir -p ~/terraform-templates/basic-aws
cd ~/terraform-templates/basic-aws

# Basis-Template erstellen
cat > main.tf << 'EOF'
terraform {
  required_version = ">= 1.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}
EOF

cat > variables.tf << 'EOF'
variable "aws_region" {
  description = "AWS region"
  type        = string
  default     = "us-west-2"
}
EOF

cat > outputs.tf << 'EOF'
# Outputs werden hier definiert
EOF

cat > terraform.tfvars.example << 'EOF'
aws_region = "us-west-2"
EOF

# Test-Projekt erstellen
mkdir ~/terraform-test
cd ~/terraform-test

# Minimale Konfiguration
cat > main.tf << 'EOF'
terraform {
  required_version = ">= 1.0"
}

output "hello" {
  value = "Terraform configuration working!"
}
EOF

# Plugin-Cache testen
terraform init
# Sollte zeigen: "Terraform has been successfully initialized!"

# Konfiguration validieren
terraform validate
# Sollte zeigen: "Success! The configuration is valid."

# Plan erstellen
terraform plan
# Sollte Outputs zeigen

# Apply ausführen
terraform apply -auto-approve
# Sollte "hello = Terraform configuration working!" zeigen

# Aufräumen
cd ..
rm -rf ~/terraform-test

# Team-weite Konfiguration
cat > ~/.terraformrc << 'EOF'
# Plugin-Cache
plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"

# Disable-Features für CI/CD
disable_checkpoint = true

# Private Registry für Firmen-Module
provider_installation {
  network_mirror {
    url = "https://terraform-mirror.company.com/"
  }
}

# Credentials für Private Registries
credentials "terraform-registry.company.com" {
  token = "TEAM_REGISTRY_TOKEN"
}

# Default-Konfiguration für alle Projekte
host "app.terraform.io" {
  token = "TERRAFORM_CLOUD_TOKEN"
}
EOF

# CI/CD-spezifische Umgebungsvariablen
export TF_IN_AUTOMATION=true
export TF_INPUT=false
export TF_CLI_ARGS_init="-backend-config=bucket=ci-terraform-state"
export TF_CLI_ARGS_plan="-parallelism=3"
export TF_CLI_ARGS_apply="-parallelism=3"

# Alle Konfigurationen testen
terraform version
terraform -help

# Plugin-Cache testen
ls -la ~/.terraform.d/plugin-cache

# Umgebungsvariablen prüfen
env | grep TF_

# Completion testen
terraform d<TAB>  # Sollte "destroy" vervollständigen

# Template-Projekt erstellen
cp -r ~/terraform-templates/basic-aws ~/terraform-projects/personal/test-project
cd ~/terraform-projects/personal/test-project
terraform init
terraform validate

my-first-terraform-project/
├── main.tf                           # Hauptkonfiguration
├── variables.tf                      # Input-Variablen
├── outputs.tf                        # Output-Werte
├── versions.tf                       # Provider-Versionen
├── terraform.tfvars                  # Variable-Werte (nicht in Git!)
├── terraform.tfvars.example          # Beispiel-Werte (in Git)
├── .terraform-version                # Terraform-Version (für tfenv)
├── .gitignore                        # Git-Ignore-Regeln
└── README.md                         # Projekt-Dokumentation

# Projektverzeichnis erstellen
mkdir ~/terraform-projects/my-first-project
cd ~/terraform-projects/my-first-project

# Terraform-Version festlegen (wenn tfenv verwendet)
echo "1.6.0" > .terraform-version

# Git-Repository initialisieren
git init

# .gitignore erstellen
cat > .gitignore << 'EOF'
# Terraform-spezifische Dateien
.terraform/
.terraform.lock.hcl
*.tfstate
*.tfstate.*
*.tfplan
*.tfplan.*

# Sensitive Dateien
terraform.tfvars
*.auto.tfvars
override.tf
override.tf.json
*_override.tf
*_override.tf.json

# Crash-Logs
crash.log
crash.*.log

# IDE-Dateien
.vscode/
.idea/
*.swp
*.swo

# OS-Dateien
.DS_Store
Thumbs.db
EOF

advanced-terraform-project/
├── environments/                # Umgebungsspezifische Configs
│   ├── dev/
│   │   ├── terraform.tfvars
│   │   └── backend.tf
│   ├── staging/
│   │   ├── terraform.tfvars
│   │   └── backend.tf
│   └── prod/
│       ├── terraform.tfvars
│       └── backend.tf
├── modules/                     # Lokale Module
│   ├── vpc/
│   ├── security/
│   └── compute/
├── scripts/                     # Hilfsskripte
│   ├── deploy.sh
│   └── validate.sh
├── docs/                        # Dokumentation
│   └── architecture.md
├── tests/                       # Terraform-Tests
│   └── basic_test.go
└── [Standard-Dateien]

# versions.tf
terraform {
  required_version = ">= 1.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.4"
    }
  }

  # Backend-Konfiguration (später)
  # backend "s3" {
  #   bucket = "my-terraform-state"
  #   key    = "first-project/terraform.tfstate"
  #   region = "us-west-2"
  # }
}

# main.tf - Provider-Konfiguration
provider "aws" {
  region = var.aws_region

  # Default-Tags für alle Ressourcen
  default_tags {
    tags = {
      Project     = var.project_name
      Environment = var.environment
      ManagedBy   = "terraform"
      CreatedAt   = timestamp()
    }
  }
}

# Random-Provider für eindeutige Namen
provider "random" {
  # Keine spezielle Konfiguration nötig
}

# Mehrere AWS-Regionen
provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}

provider "aws" {
  alias  = "us_west_2"
  region = "us-west-2"
}

# Cloudflare für DNS
provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

# Umgebungsvariablen (empfohlen)
export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_DEFAULT_REGION="us-west-2"

# AWS CLI-Profile verwenden
aws configure --profile terraform
export AWS_PROFILE=terraform

# Verifizierung
aws sts get-caller-identity

# variables.tf
variable "project_name" {
  description = "Name of the project"
  type        = string
  default     = "my-first-terraform"

  validation {
    condition     = can(regex("^[a-zA-Z0-9-]+$", var.project_name))
    error_message = "Project name must contain only alphanumeric characters and hyphens."
  }
}

variable "environment" {
  description = "Environment name"
  type        = string
  default     = "dev"

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

variable "aws_region" {
  description = "AWS region"
  type        = string
  default     = "us-west-2"

  validation {
    condition     = can(regex("^[a-z0-9-]+$", var.aws_region))
    error_message = "AWS region must be a valid region identifier."
  }
}

variable "enable_versioning" {
  description = "Enable S3 bucket versioning"
  type        = bool
  default     = true
}

variable "tags" {
  description = "Additional tags for resources"
  type        = map(string)
  default     = {}
}

# main.tf
# Lokale Berechnungen
locals {
  # Eindeutiger Bucket-Name
  bucket_name = "${var.project_name}-${var.environment}-${random_id.bucket_suffix.hex}"

  # Gemeinsame Tags
  common_tags = merge(
    var.tags,
    {
      Project     = var.project_name
      Environment = var.environment
      ManagedBy   = "terraform"
      CreatedAt   = timestamp()
    }
  )
}

# Random-ID für eindeutige Namen
resource "random_id" "bucket_suffix" {
  byte_length = 4
}

# S3-Bucket erstellen
resource "aws_s3_bucket" "main" {
  bucket = local.bucket_name

  tags = merge(
    local.common_tags,
    {
      Name = local.bucket_name
      Type = "storage"
    }
  )
}

# Bucket-Versioning konfigurieren
resource "aws_s3_bucket_versioning" "main" {
  bucket = aws_s3_bucket.main.id

  versioning_configuration {
    status = var.enable_versioning ? "Enabled" : "Disabled"
  }
}

# Bucket-Verschlüsselung aktivieren
resource "aws_s3_bucket_server_side_encryption_configuration" "main" {
  bucket = aws_s3_bucket.main.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# Public Access blockieren
resource "aws_s3_bucket_public_access_block" "main" {
  bucket = aws_s3_bucket.main.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Beispiel-Objekt hochladen
resource "aws_s3_object" "welcome" {
  bucket = aws_s3_bucket.main.id
  key    = "welcome.txt"
  content = "Hello from Terraform! Created at ${timestamp()}"

  tags = local.common_tags
}

┌ Resource Dependencies
├────────────────────────────────────────────
│
│  random_id.bucket_suffix
│           ↓
│  aws_s3_bucket.main ──────────────────────┐
│           ↓                               │
│  ├─ aws_s3_bucket_versioning.main         │
│  ├─ aws_s3_bucket_server_side_encryption  │
│  ├─ aws_s3_bucket_public_access_block     │
│  └─ aws_s3_object.welcome ←───────────────┘

# outputs.tf
output "bucket_name" {
  description = "Name of the created S3 bucket"
  value       = aws_s3_bucket.main.bucket
}

output "bucket_arn" {
  description = "ARN of the created S3 bucket"
  value       = aws_s3_bucket.main.arn
}

output "bucket_region" {
  description = "Region of the S3 bucket"
  value       = aws_s3_bucket.main.region
}

output "bucket_domain_name" {
  description = "Domain name of the S3 bucket"
  value       = aws_s3_bucket.main.bucket_domain_name
}

output "welcome_object_url" {
  description = "URL of the welcome object"
  value       = "s3://${aws_s3_bucket.main.bucket}/${aws_s3_object.welcome.key}"
}

output "project_info" {
  description = "Project information"
  value = {
    name        = var.project_name
    environment = var.environment
    region      = var.aws_region
    created_at  = timestamp()
  }
}

# terraform.tfvars.example
project_name     = "my-first-terraform"
environment      = "dev"
aws_region       = "us-west-2"
enable_versioning = true

tags = {
  Owner = "your-name"
  Team  = "platform"
}

# Ins Projektverzeichnis wechseln
cd ~/terraform-projects/my-first-project

# Terraform-Version prüfen (falls tfenv verwendet)
terraform version

# Variable-Datei erstellen
cp terraform.tfvars.example terraform.tfvars

# Anpassen der Werte
nano terraform.tfvars

project_name     = "my-first-terraform"
environment      = "dev"
aws_region       = "us-west-2"
enable_versioning = true

tags = {
  Owner = "dein-name"
  Team  = "learning"
}

# Terraform initialisieren
terraform init

# Erwartete Ausgabe:
# Initializing the backend...
# Initializing provider plugins...
# - Finding hashicorp/aws versions matching "~> 5.0"...
# - Finding hashicorp/random versions matching "~> 3.4"...
# - Installing hashicorp/aws v5.31.0...
# - Installing hashicorp/random v3.4.3...
#
# Terraform has been successfully initialized!

# Konfiguration validieren
terraform validate

# Erwartete Ausgabe:
# Success! The configuration is valid.

# Execution Plan erstellen
terraform plan

# Detaillierte Ausgabe mit Datei speichern
terraform plan -out=tfplan

# Plan analysieren
terraform show tfplan

# Änderungen anwenden
terraform apply

# Oder mit gespeichertem Plan
terraform apply tfplan

# Automatische Bestätigung (nur für Tests)
terraform apply -auto-approve

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

random_id.bucket_suffix: Creating...
random_id.bucket_suffix: Creation complete after 0s [id=oR7_Tg]
aws_s3_bucket.main: Creating...
aws_s3_bucket.main: Creation complete after 2s [id=my-first-terraform-dev-a11ef4e0]
aws_s3_bucket_versioning.main: Creating...
aws_s3_bucket_server_side_encryption_configuration.main: Creating...
aws_s3_bucket_public_access_block.main: Creating...
aws_s3_object.welcome: Creating...
aws_s3_bucket_versioning.main: Creation complete after 1s [id=my-first-terraform-dev-a11ef4e0]
aws_s3_bucket_server_side_encryption_configuration.main: Creation complete after 1s [id=my-first-terraform-dev-a11ef4e0]
aws_s3_bucket_public_access_block.main: Creation complete after 1s [id=my-first-terraform-dev-a11ef4e0]
aws_s3_object.welcome: Creation complete after 1s [id=welcome.txt]

Apply complete! Resources: 6 added, 0 changed, 0 destroyed.

Outputs:

bucket_arn = "arn:aws:s3:::my-first-terraform-dev-a11ef4e0"
bucket_domain_name = "my-first-terraform-dev-a11ef4e0.s3.amazonaws.com"
bucket_name = "my-first-terraform-dev-a11ef4e0"
bucket_region = "us-west-2"
project_info = {
  "created_at" = "2024-01-15T10:30:00Z"
  "environment" = "dev"
  "name" = "my-first-terraform"
  "region" = "us-west-2"
}
welcome_object_url = "s3://my-first-terraform-dev-a11ef4e0/welcome.txt"

# Terraform-State anzeigen
terraform show

# Spezifische Ressource anzeigen
terraform show aws_s3_bucket.main

# Outputs anzeigen
terraform output

# Spezifischen Output anzeigen
terraform output bucket_name

# AWS CLI zur Verifikation
aws s3 ls s3://$(terraform output -raw bucket_name)
aws s3 cp s3://$(terraform output -raw bucket_name)/welcome.txt -

# Workflow-Alias für .bashrc
alias tf='terraform'
alias tfi='terraform init'
alias tfp='terraform plan'
alias tfa='terraform apply'
alias tfs='terraform show'
alias tfo='terraform output'

# Workflow-Funktion
tfworkflow() {
    echo "🔄 Running Terraform workflow..."
    terraform init && \
    terraform validate && \
    terraform plan && \
    read -p "Apply changes? (y/N): " -n 1 -r && \
    echo && \
    [[ $REPLY =~ ^[Yy]$ ]] && terraform apply
}

# AWS-Konfiguration prüfen
aws configure list
aws sts get-caller-identity

# Terraform-Debug-Modus
TF_LOG=DEBUG terraform plan

# State-Datei prüfen
terraform state list
terraform state show aws_s3_bucket.main

# Provider-Versionen prüfen
terraform providers

# Infrastruktur wieder löschen
terraform destroy

# Bestätigung mit "yes"
# Alle Ressourcen werden gelöscht