OpenTofu 入门：用 IaC 在 AWS 创建 VPC 和 EC2

required_providers {
  aws = {
    source  = "hashicorp/aws"
    version = "~> 5.0"
  }
}

# 查询最新的 Amazon Linux 2023 AMI（不创建资源）
data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["137112412989"]
  filter {
    name   = "name"
    values = ["al2023-ami-2023.*-x86_64"]
  }
}

# 创建 EC2 实例（使用上面查到的 AMI ID）
resource "aws_instance" "server" {
  ami           = data.aws_ami.al2023.id
  instance_type = "t2.nano"
}

# variables.tf
variable "ssh_public_key" {
  type = string
}

# terraform.tfvars
ssh_public_key = "ssh-ed25519 AAAA..."

{
  "version": 4,
  "serial": 12,
  "lineage": "a1b2c3d4-...",
  "resources": [
    {
      "type": "aws_instance",
      "name": "server",
      "instances": [
        {
          "attributes": {
            "id": "i-0abc123def456",
            "instance_type": "t2.nano",
            "public_ip": "54.199.1.2"
          }
        }
      ]
    }
  ]
}

# 列出所有受管资源
tofu state list

# 查看某个资源的详细 state
tofu state show aws_instance.server

# 从 state 中移除资源记录（不删除云上资源）
tofu state rm aws_instance.server

# 将已有的云资源导入到 state
tofu import aws_instance.server i-0abc123def456

backend "s3" {
  bucket = "my-tofu-state"
  key    = "aws/ec2/terraform.tfstate"
  region = "ap-southeast-1"
}

ec2-tokyo/
├── providers.tf      # provider 声明、backend、region
├── variables.tf      # 变量声明
├── terraform.tfvars  # 变量实际值（不提交 git）
├── main.tf           # 资源定义
└── outputs.tf        # apply 完成后输出的信息

# VPC
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

# 公有子网
resource "aws_subnet" "public" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-northeast-1a"
}

# Internet Gateway：VPC 的网络出口，没有它流量出不去
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
}

# 路由表：告诉子网内流量如何转发
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
}

# 路由表关联到子网
resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

resource "aws_security_group" "server" {
  vpc_id = aws_vpc.main.id

  ingress { from_port = 22;  to_port = 22;  protocol = "tcp";  cidr_blocks = ["0.0.0.0/0"] }
  ingress { from_port = 80;  to_port = 80;  protocol = "tcp";  cidr_blocks = ["0.0.0.0/0"] }
  ingress { from_port = 443; to_port = 443; protocol = "tcp";  cidr_blocks = ["0.0.0.0/0"] }
  ingress { from_port = -1;  to_port = -1;  protocol = "icmp"; cidr_blocks = ["0.0.0.0/0"] }  # ping
  egress  { from_port = 0;   to_port = 0;   protocol = "-1";   cidr_blocks = ["0.0.0.0/0"] }
}

resource "aws_eip" "server" {
  instance = aws_instance.server.id
  domain   = "vpc"
}

data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["137112412989"]  # Amazon 官方
  filter {
    name   = "name"
    values = ["al2023-ami-2023.*-x86_64"]
  }
}

# 初始化（首次或更换 provider 后）
tofu init

# 预览变更（不实际执行）
tofu plan

# 应用变更
tofu apply

# 销毁所有资源
tofu destroy

# 查看当前 state
tofu show

# 查看输出值
tofu output

infra/stripe/opentofu/enx/
├── .terraform.lock.hcl          # provider versions + hashes, commit to git
└── .terraform/                  # local cache, do not commit
    ├── terraform.tfstate        # where the real state lives (backend config)
    ├── environment              # currently selected workspace, e.g. "live"
    └── providers/
        └── registry.opentofu.org/stripe/stripe/0.1.3/darwin_arm64/

Do you want to copy existing state to the new backend?

# Upgrade providers to the newest version allowed by the constraints, and rewrite the lock file
tofu init -upgrade

# Backend config changed: start fresh with the new config, do not migrate state
tofu init -reconfigure

# Backend config changed: copy the existing state to the new backend
tofu init -migrate-state

# Install providers only, skip the backend (e.g. for tofu validate in CI)
tofu init -backend=false

# Fail instead of updating the lock file (CI)
tofu init -lockfile=readonly

# Show the current workspace
tofu workspace show

# List all workspaces, the current one is marked with *
tofu workspace list

# Switch workspace
tofu workspace select live

# Create a new workspace
tofu workspace new live

# Select a workspace that does not exist yet: error, unless -or-create
tofu workspace select -or-create staging

# TF_WORKSPACE overrides the selected workspace for this shell only
TF_WORKSPACE=live tofu plan

OpenTofu will perform the following actions:

  # aws_instance.server will be created
  + resource "aws_instance" "server" {
      + ami           = "ami-0abcdef1234567890"
      + instance_type = "t2.nano"
      + id            = (known after apply)
      + public_ip     = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

  # aws_instance.server will be updated in-place
  ~ resource "aws_instance" "server" {
        id            = "i-0abc123def456"
      ~ instance_type = "t2.nano" -> "t2.micro"
    }

Plan: 0 to add, 1 to change, 0 to destroy.

  # aws_eip.server will be destroyed
  - resource "aws_eip" "server" {
      - id          = "eipalloc-0abc123" -> null
      - public_ip   = "54.199.1.2" -> null
      - instance    = "i-0abc123def456" -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

  # aws_instance.server must be replaced
-/+ resource "aws_instance" "server" {
      ~ id  = "i-0abc123def456" -> (known after apply)
      ~ ami = "ami-0000000000000001" -> "ami-0abcdef1234567890" # forces replacement
    }

Plan: 1 to add, 0 to change, 1 to destroy.