Thực Hành Terraform AWS: Xây Dựng Hệ Thống 2-Tier HA (EC2, RDS, S3, ALB)

brew install awscli

msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

aws --version
# Kết quả mong đợi: aws-cli/2.x.x Python/3.x.x ...

ssh-keygen -t rsa -b 4096 -f ~/.ssh/tobi-aws

brew tap hashicorp/tap
brew install hashicorp/tap/terraform

choco install terraform

sudo apt-get update && sudo apt-get install -y gnupg software-properties-common
wget -O- https://apt.releases.hashicorp.com/gpg | \
gpg --dearmor | \
sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update
sudo apt-get install terraform

terraform -version
# Kết quả mong đợi: Terraform v1.x.x

aws configure

aws sts get-caller-identity

variable "aws_region" {
  default = "ap-southeast-1"
}

variable "instance_type" {
  default = "t3.micro" # Nằm trong Free Tier
}

variable "instance_count" {
  description = "Số lượng máy ảo muốn tạo"
  type        = number
  default     = 2
}

variable "db_username" {
  description = "Username cho Database"
  type        = string
  default     = "admin"
}

variable "db_password" {
  description = "Password cho Database"
  type        = string
  sensitive   = true
  default     = "Tobi123456" # Thực tế nên dùng file .tfvars hoặc AWS Secrets Manager
}

provider "aws" {
  region = var.aws_region
}

# 1. Tìm AMI Ubuntu 24.04 mới nhất
data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"] 
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]
  }
}

# 2. Key Pair (Chìa khóa SSH)
resource "aws_key_pair" "tobi_key" {
  key_name   = "tobi-key-singapore"
  public_key = file("~/.ssh/tobi-aws.pub") 
}

# 3. Security Group cho EC2 (Mở port 22 và 80)
resource "aws_security_group" "web_sg" {
  name        = "tobi-allow-ssh-http"
  description = "Allow SSH and HTTP traffic"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# 4. IAM Role cho phép EC2 truy cập S3 không cần Access Key
resource "aws_iam_role" "ec2_s3_access_role" {
  name = "tobi-ec2-s3-access-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "s3_full_access" {
  role       = aws_iam_role.ec2_s3_access_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}

resource "aws_iam_instance_profile" "ec2_s3_profile" {
  name = "tobi-ec2-s3-profile"
  role = aws_iam_role.ec2_s3_access_role.name
}

# 5. Tạo EC2 Instances (Nhân bản bằng vòng lặp count)
resource "aws_instance" "my_server" {
  count         = var.instance_count 
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  key_name      = aws_key_pair.tobi_key.key_name
  
  iam_instance_profile   = aws_iam_instance_profile.ec2_s3_profile.name
  vpc_security_group_ids = [aws_security_group.web_sg.id]

  # Cài đặt Docker và chạy Nginx tự động lúc khởi động
  user_data = <<-EOF
              #!/bin/bash
              sudo apt-get update
              sudo apt-get install -y docker.io
              sudo systemctl start docker
              sudo systemctl enable docker
              sudo usermod -aG docker ubuntu
              
              echo "<h1>Welcome to com.quyenlt - Server Node ${count.index}</h1>" > /home/ubuntu/index.html
              sudo docker run -d -p 80:80 --name my-web -v /home/ubuntu/index.html:/usr/share/nginx/html/index.html:ro nginx
              EOF

  tags = { Name = "Tobi-DevOps-Server-${count.index}" }
}

# 6. Security Group & Instance cho RDS MySQL
resource "aws_security_group" "db_sg" {
  name        = "tobi-db-sg"
  description = "Cho phep EC2 ket noi vao MySQL"
  ingress {
    from_port       = 3306
    to_port         = 3306
    protocol        = "tcp"
    security_groups = [aws_security_group.web_sg.id] # Chỉ cho EC2 truy cập
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_db_instance" "mysql_db" {
  allocated_storage    = 20
  engine               = "mysql"
  engine_version       = "8.0"
  instance_class       = "db.t3.micro"
  db_name              = "orishop_db"
  username             = var.db_username
  password             = var.db_password
  parameter_group_name = "default.mysql8.0"
  skip_final_snapshot  = true
  publicly_accessible  = false 
  vpc_security_group_ids = [aws_security_group.db_sg.id]
}

# 7. S3 Bucket
resource "random_id" "bucket_suffix" { byte_length = 4 }

resource "aws_s3_bucket" "orishop_assets" {
  bucket        = "tobi-orishop-assets-${random_id.bucket_suffix.hex}"
  force_destroy = true 
}

resource "aws_s3_bucket_public_access_block" "orishop_assets_block" {
  bucket                  = aws_s3_bucket.orishop_assets.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# 8. Application Load Balancer (ALB)
data "aws_subnets" "default" {
  filter {
    name   = "vpc-id"
    values = [aws_security_group.web_sg.vpc_id]
  }
}

resource "aws_lb" "orishop_alb" {
  name               = "orishop-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.web_sg.id]
  subnets            = data.aws_subnets.default.ids
}

resource "aws_lb_target_group" "orishop_tg" {
  name     = "orishop-target-group"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_security_group.web_sg.vpc_id
  health_check { path = "/" }
}

resource "aws_lb_listener" "front_end" {
  load_balancer_arn = aws_lb.orishop_alb.arn
  port              = "80"
  protocol          = "HTTP"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.orishop_tg.arn
  }
}

resource "aws_lb_target_group_attachment" "tg_attachment" {
  count            = var.instance_count
  target_group_arn = aws_lb_target_group.orishop_tg.arn
  target_id        = aws_instance.my_server[count.index].id
  port             = 80
}

output "alb_dns_name" {
  description = "Truy cập trang web qua DNS này"
  value       = aws_lb.orishop_alb.dns_name
}

output "server_public_ips" {
  description = "IP của các máy ảo EC2"
  value       = aws_instance.my_server[*].public_ip
}

output "db_endpoint" {
  description = "Địa chỉ kết nối MySQL"
  value       = aws_db_instance.mysql_db.endpoint
}

output "s3_bucket_name" {
  description = "Tên Bucket chứa file tĩnh"
  value       = aws_s3_bucket.orishop_assets.id
}

# Thông tin đăng nhập Database (Đừng chia sẻ file này cho ai)
db_username = "admin"
db_password = "Tobi_Super_Secret_Password_123!" 

# Bạn cũng có thể ghi đè các biến khác ở đây nếu muốn
instance_count = 2
aws_region     = "ap-southeast-1"

# Bỏ qua file chứa mật khẩu
terraform.tfvars

# Bỏ qua các thư mục và file cấu hình nội bộ của Terraform
.terraform/
.terraform.lock.hcl
terraform.tfstate
terraform.tfstate.backup

terraform destroy -auto-approve

variable "aws_region" { default = "ap-southeast-1" }
variable "instance_type" { default = "t3.micro" }
variable "instance_count" { default = 2 } # Tự động tạo 2 máy ảo để làm HA
variable "db_username" { default = "admin" }
variable "db_password" { sensitive = true }

# File: terraform.tfvars
db_password    = "MatKhauSieuKho123!"
instance_count = 2

provider "aws" { region = var.aws_region }

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"] 
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]
  }
}

resource "aws_key_pair" "tobi_key" {
  key_name   = "tobi-key-singapore"
  public_key = file("~/.ssh/tobi-aws.pub") 
}

resource "aws_security_group" "web_sg" {
  name        = "tobi-allow-ssh-http"
  ingress { from_port = 22, to_port = 22, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] }
  ingress { from_port = 80, to_port = 80, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] }
  egress  { from_port = 0, to_port = 0, protocol = "-1", cidr_blocks = ["0.0.0.0/0"] }
}

resource "aws_security_group" "db_sg" {
  name        = "tobi-db-sg"
  ingress {
    from_port       = 3306
    to_port         = 3306
    protocol        = "tcp"
    security_groups = [aws_security_group.web_sg.id] # Ép buộc chỉ nhận traffic từ EC2
  }
}

resource "aws_instance" "my_server" {
  count                  = var.instance_count 
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = var.instance_type
  key_name               = aws_key_pair.tobi_key.key_name
  iam_instance_profile   = aws_iam_instance_profile.ec2_s3_profile.name
  vpc_security_group_ids = [aws_security_group.web_sg.id]

  user_data = <<-EOF
              #!/bin/bash
              sudo apt-get update && sudo apt-get install -y docker.io
              sudo systemctl start docker && sudo systemctl enable docker
              sudo usermod -aG docker ubuntu
              echo "<h1>Welcome to com.quyenlt - Server Node ${count.index}</h1>" > /home/ubuntu/index.html
              sudo docker run -d -p 80:80 --name my-web -v /home/ubuntu/index.html:/usr/share/nginx/html/index.html:ro nginx
              EOF
  tags = { Name = "Tobi-DevOps-Server-${count.index}" }
}

resource "aws_db_instance" "mysql_db" {
  allocated_storage    = 20
  engine               = "mysql"
  engine_version       = "8.0"
  instance_class       = "db.t3.micro"
  db_name              = "orishop_db"
  username             = var.db_username
  password             = var.db_password
  skip_final_snapshot  = true
  publicly_accessible  = false 
  vpc_security_group_ids = [aws_security_group.db_sg.id]
}

data "aws_subnets" "default" {
  filter { name = "vpc-id", values = [aws_security_group.web_sg.vpc_id] }
}

resource "aws_lb" "orishop_alb" {
  name               = "orishop-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.web_sg.id]
  subnets            = data.aws_subnets.default.ids
}

resource "aws_lb_target_group" "orishop_tg" {
  name     = "orishop-target-group"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_security_group.web_sg.vpc_id
}

resource "aws_lb_listener" "front_end" {
  load_balancer_arn = aws_lb.orishop_alb.arn
  port              = "80"
  protocol          = "HTTP"
  default_action { type = "forward", target_group_arn = aws_lb_target_group.orishop_tg.arn }
}

resource "aws_lb_target_group_attachment" "tg_attachment" {
  count            = var.instance_count
  target_group_arn = aws_lb_target_group.orishop_tg.arn
  target_id        = aws_instance.my_server[count.index].id
  port             = 80
}

resource "random_id" "bucket_suffix" { byte_length = 4 }

resource "aws_s3_bucket" "orishop_assets" {
  bucket        = "tobi-orishop-assets-${random_id.bucket_suffix.hex}"
  force_destroy = true 
}

resource "aws_iam_role" "ec2_s3_access_role" {
  name = "tobi-ec2-s3-access-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17", Statement = [{ Action = "sts:AssumeRole", Effect = "Allow", Principal = { Service = "ec2.amazonaws.com" } }]
  })
}

resource "aws_iam_role_policy_attachment" "s3_full_access" {
  role       = aws_iam_role.ec2_s3_access_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}

resource "aws_iam_instance_profile" "ec2_s3_profile" {
  name = "tobi-ec2-s3-profile"
  role = aws_iam_role.ec2_s3_access_role.name
}

output "alb_dns_name" { value = aws_lb.orishop_alb.dns_name }
output "server_public_ips" { value = aws_instance.my_server[*].public_ip }
output "db_endpoint" { value = aws_db_instance.mysql_db.endpoint }