Infrastructure as Code 深度实践：Terraform、Pulumi 与 Ansible 多云部署

# modules/vpc/main.tf
terraform {
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

variable "vpc_cidr" { type = string }
variable "azs" { type = list(string) }
variable "env" { type = string }

locals { common_tags = { ManagedBy = "terraform", Environment = var.env } }

resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr
  tags       = merge(local.common_tags, { Name = "${var.env}-vpc" })
}

resource "aws_subnet" "public" {
  count             = length(var.azs)
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone = var.azs[count.index]
  tags              = merge(local.common_tags, { Name = "${var.env}-public-${count.index + 1}" })
}

resource "aws_subnet" "private" {
  count             = length(var.azs)
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + 100)
  availability_zone = var.azs[count.index]
  tags              = merge(local.common_tags, { Name = "${var.env}-private-${count.index + 1}" })
}

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
  tags   = merge(local.common_tags, { Name = "${var.env}-igw" })
}

output "vpc_id" { value = aws_vpc.main.id }
output "public_subnet_ids" { value = aws_subnet.public[*].id }
output "private_subnet_ids" { value = aws_subnet.private[*].id }

# environments/prod/main.tf
module "vpc" {
  source   = "git::https://github.com/org/tf-modules.git//modules/vpc?ref=v1.2.0"
  vpc_cidr = "10.1.0.0/16"
  azs      = ["us-east-1a", "us-east-1b", "us-east-1c"]
  env      = "production"
}

terraform {
  backend "s3" {
    bucket         = "my-org-terraform-states"
    key            = "prod/vpc/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
    kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/xxx"
  }
}

name: Terraform
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with: { terraform_version: "1.9.0" }
      - run: terraform init
      - run: terraform fmt -check -recursive
      - run: terraform validate
      - run: terraform plan -out=tfplan
      - uses: actions/upload-artifact@v4
        with: { name: terraform-plan, path: tfplan }
      - if: github.ref == 'refs/heads/main'
        run: terraform apply -auto-approve tfplan

import pulumi
import pulumi_aws as aws
import json

config = pulumi.Config()
env = config.get("environment") or "dev"

table = aws.dynamodb.Table("orders",
    name=f"orders-{env}",
    billing_mode="PAY_PER_REQUEST",
    hash_key="orderId",
    attributes=[aws.dynamodb.TableAttributeArgs(name="orderId", type="S")],
)

role = aws.iam.Role("lambda-role",
    assume_role_policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [{"Action": "sts:AssumeRole", "Effect": "Allow",
                       "Principal": {"Service": "lambda.amazonaws.com"}}]
    }),
    managed_policy_arns=["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],
)

fn = aws.lambda_.Function("order-handler",
    runtime="python3.11", handler="handler.lambda_handler",
    role=role.arn, code=pulumi.FileArchive("./lambda_src"),
    environment=aws.lambda_.FunctionEnvironmentArgs(
        variables={"TABLE_NAME": table.name, "ENVIRONMENT": env}),
    timeout=30, memory_size=256,
)

api = aws.apigatewayv2.Api("orders-api",
    protocol_type="HTTP", target=fn.arn, route_key="POST /orders")

pulumi.export("api_endpoint", api.api_endpoint)
pulumi.export("table_name", table.name)

pulumi login s3://my-pulumi-state-bucket
export PULUMI_CONFIG_PASSPHRASE="strong-passphrase"

# roles/nginx/tasks/main.yml
---
- name: 安装 Nginx
  ansible.builtin.apt:
    name: nginx
    state: present
    update_cache: true

- name: 部署 SSL 证书与私钥
  ansible.builtin.copy:
    src: "{{ item.src }}"
    dest: "/etc/nginx/ssl/{{ item.dest }}"
    mode: "{{ item.mode }}"
  loop:
    - { src: "{{ ssl_cert }}", dest: "cert.pem", mode: "0644" }
    - { src: "{{ ssl_key }}",  dest: "key.pem",  mode: "0600" }
  no_log: true
  notify: reload nginx

- name: 部署站点配置
  ansible.builtin.template:
    src: site.conf.j2
    dest: "/etc/nginx/sites-available/{{ site_name }}"
  notify: reload nginx

- name: 启用站点
  ansible.builtin.file:
    src: "/etc/nginx/sites-available/{{ site_name }}"
    dest: "/etc/nginx/sites-enabled/{{ site_name }}"
    state: link
  notify: reload nginx

- name: 启动 Nginx
  ansible.builtin.service:
    name: nginx
    state: started
    enabled: true

# roles/nginx/handlers/main.yml
---
- name: reload nginx
  ansible.builtin.service: { name: nginx, state: reloaded }

---
- name: 部署 Web 集群
  hosts: webservers
  become: true
  vars_files: [secrets/vault.yml]
  roles:
    - { role: common, tags: [common] }
    - { role: nginx,  tags: [nginx] }

plugin: amazon.aws.aws_ec2
regions: [us-east-1, eu-west-1]
filters:
  tag:Environment: [production]
keyed_groups:
  - key: tags.Role
    prefix: role
compose:
  ansible_host: public_ip_address | default(private_ip_address)

data "vault_kv_secret_v2" "db_creds" {
  mount = "secret"
  name  = "apps/production/database"
}

resource "aws_db_instance" "primary" {
  identifier = "prod-primary-db"
  engine     = "postgres"
  db_name    = "appdatabase"
  username   = data.vault_kv_secret_v2.db_creds.data["username"]
  password   = data.vault_kv_secret_v2.db_creds.data["password"]
}

vault secrets enable database

vault write database/config/postgresql \
    plugin_name=postgresql-database-plugin \
    allowed_roles="app-readonly" \
    connection_url="postgresql://{{username}}:{{password}}@db.internal:5432/appdb" \
    username="vaultadmin" \
    password="supersecret"

vault write database/roles/app-readonly \
    db_name=postgresql \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
    default_ttl="1h" \
    max_ttl="24h"

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  Env: { Type: String, AllowedValues: [dev, prod], Default: dev }
Resources:
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'myapp-${Env}-${AWS::AccountId}'
      VersioningConfiguration: { Status: Enabled }
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref Key
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  Key:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: true
Outputs:
  BucketArn:
    Value: !GetAtt Bucket.Arn
    Export:
      Name: !Sub '${AWS::StackName}-BucketArn'

from aws_cdk import App, Stack, RemovalPolicy, aws_s3 as s3, aws_kms as kms, Duration
from constructs import Construct

class BucketStack(Stack):
    def __init__(self, scope: Construct, id: str, **kwargs):
        super().__init__(scope, id, **kwargs)
        key = kms.Key(self, "Key", enable_key_rotation=True)
        s3.Bucket(self, "Bucket",
            encryption=s3.BucketEncryption.KMS,
            encryption_key=key,
            block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
            versioned=True,
            removal_policy=RemovalPolicy.RETAIN,
            lifecycle_rules=[s3.LifecycleRule(
                transitions=[s3.Transition(
                    storage_class=s3.StorageClass.INFREQUENT_ACCESS,
                    transition_after=Duration.days(90))])])

app = App()
BucketStack(app, "BucketStack",
    env={"account": "123456789012", "region": "us-east-1"})
app.synth()

infracost configure set api_key $INFRACOST_API_KEY
infracost breakdown --path .

# sentinel/policies/restrict-s3-public.sentinel
import "tfplan"

s3_buckets = filter tfplan.resource_changes as _, rc {
  rc.type is "aws_s3_bucket_public_access_block" and
  rc.mode is "managed"
}

allowed = rule {
  all s3_buckets as _, bucket {
    bucket.change.after.block_public_policy is true and
    bucket.change.after.block_public_acls   is true
  }
}

main = rule {
  allowed
}

module "vpc" {
  source  = "app.terraform.io/my-org/vpc/aws"
  version = "~> 2.1.0"
}

from pulumi import ComponentResource, ResourceOptions
import pulumi_aws as aws

class VpcClusterArgs:
    def __init__(self, cidr: str, azs: list, env: str):
        self.cidr = cidr
        self.azs = azs
        self.env = env

class VpcCluster(ComponentResource):
    def __init__(self, name: str, args: VpcClusterArgs, opts=None):
        super().__init__("my:module:VpcCluster", name, {}, opts)
        vpc = aws.ec2.Vpc(f"{name}-vpc",
            cidr_block=args.cidr,
            tags={"Environment": args.env},
            opts=ResourceOptions(parent=self))
        public_subnets = []
        for i, az in enumerate(args.azs):
            subnet = aws.ec2.Subnet(f"{name}-pub-{i}",
                vpc_id=vpc.id, availability_zone=az,
                cidr_block=f"10.{i}.0.0/24",
                opts=ResourceOptions(parent=self))
            public_subnets.append(subnet.id)
        self.register_outputs({"vpc_id": vpc.id, "public_subnet_ids": public_subnets})

from pulumi_policy import PolicyPack, ResourceValidationPolicy

def ebs_encrypted_validator(args, report_violation):
    if args.resource_type == "aws:ebs/volume:Volume":
        encrypted = args.props.get("encrypted", False)
        if not encrypted:
            report_violation("EBS volume must be encrypted")

PolicyPack(
    name="aws-security",
    enforcement_level="mandatory",
    policies=[
        ResourceValidationPolicy(
            name="ebs-encrypted",
            description="EBS volumes must be encrypted",
            validate=ebs_encrypted_validator,
        )
    ],
)

from pulumi.automation import LocalWorkspace, Stack, ConfigValue
import asyncio

async def deploy_stack():
    stack = await Stack.create_or_select("dev", LocalWorkspace(program_path="./infra"))
    await stack.set_config("aws:region", ConfigValue("us-east-1"))
    up_res = await stack.up(on_output=print)
    print(f"Updated resources: {len(up_res.summary.resource_changes)}")
    print(f"API endpoint: {up_res.outputs.get('api_endpoint', {}).get('value')}")

asyncio.run(deploy_stack())

import pulumi

network = pulumi.StackReference("my-org/network/dev")
vpc_id = network.get_output("vpc_id")
subnet_ids = network.get_output("public_subnet_ids")

# workflow 伪配置示意
- name: 蓝绿发布工作流
  steps:
    - job_template: 部署新版本到 green 组
      inventory: green_env
    - approval: 人工审批节点
    - job_template: 切换负载均衡至 green
    - job_template: 下线 blue 组旧版本
      condition: "previous_step_success"

# aws_ec2.yml
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
  - eu-central-1
filters:
  instance-state-name: running
  tag:Project: myplatform
  "tag:Environment": "production"
keyed_groups:
  - key: tags.Role
    prefix: env_role
  - key: placement.availability_zone
    prefix: az
compose:
  ansible_host: public_ip_address | default(private_ip_address)
  ansible_user: '"ec2-user"'

plugin: azure.azcollection.azure_rm
auth_source: env
include_vm_resource_groups:
  - rg-web-prod
conditional_groups:
  webservers: "'web' in tags.Role"

# plugins/callback/slack_notify.py
from ansible.plugins.callback import CallbackBase
import urllib.request, json

class CallbackModule(CallbackBase):
    CALLBACK_VERSION = 2.0
    CALLBACK_TYPE = "notification"
    CALLBACK_NAME = "slack_notify"

    def playbook_on_stats(self, stats):
        summary = {}
        for host in stats.processed.keys():
            summary[host] = {
                "ok": stats.ok.get(host, 0),
                "failures": stats.failures.get(host, 0)
            }
        payload = {"text": f"Playbook finished: {json.dumps(summary)}"}
        req = urllib.request.Request(
            self._plugin_options.get("webhook_url"),
            data=json.dumps(payload).encode(),
            headers={"Content-Type": "application/json"})
        urllib.request.urlopen(req)

Feature: 安全基线检查
  Scenario: 所有 AWS 安全组必须限制入站来源
    Given I have aws_security_group defined
    When it contains ingress
    Then it must contain cidr_blocks
    And its value must not be 0.0.0.0/0

terraform plan -out=tfplan
terraform-compliance -p tfplan -f compliance/

# .tflint.hcl
plugin "aws" {
  enabled = true
  version = "0.30.0"
  source  = "github.com/terraform-linters/tflint-ruleset-aws"
}

rule "terraform_unused_declarations" { enabled = true }
rule "terraform_required_version"     { enabled = true }
rule "aws_instance_invalid_type"     { enabled = true }

checkov -d . --framework terraform --check CKV_AWS_19,CKV_AWS_20

package test

import (
    "testing"
    "github.com/gruntwork-io/terratest/modules/terraform"
    "github.com/stretchr/testify/assert"
)

func TestTerraformVpc(t *testing.T) {
    terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
        TerraformDir: "../examples/vpc",
        Vars: map[string]interface{}{
            "vpc_cidr": "10.0.0.0/16",
            "azs":      []string{"us-east-1a", "us-east-1b"},
        },
    })
    defer terraform.Destroy(t, terraformOptions)
    terraform.InitAndApply(t, terraformOptions)
    vpcID := terraform.Output(t, terraformOptions, "vpc_id")
    assert.Regexp(t, "^vpc-[a-f0-9]+", vpcID)
}

terraform plan -refresh-only

# 先确认资源地址
terraform state list
# 安全移除状态记录（不删除实际资源）
terraform state rm 'aws_instance.bastion[0]'

policies:
  - name: unattached-ebs-mark
    resource: ebs
    filters:
      - Attachments: []
    actions:
      - type: mark-for-op
        tag: custodian_cleanup
        op: delete
        days: 7

name: nightly-drift-scan
on:
  schedule:
    - cron: '0 2 * * *'
jobs:
  drift:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: terraform init
      - run: terraform plan -refresh-only -detailed-exitcode
        id: plan
        continue-on-error: true
      - if: steps.plan.outcome == 'failure'
        run: |
          echo "Drift detected on $(date)" >> drift-report.md
          # 发送 Slack / PagerDuty 告警

# .tfsec/config.yml
minimum_severity: HIGH
exclude:
  - aws-s3-enable-versioning
include:
  - aws-ec2-require-vpc-flow-logs-for-aws-vpc

tfsec . --config-file .tfsec/config.yml --format sarif --out tfsec.sarif

- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/github-actions-terraform
    aws-region: us-east-1

terraform {
  backend "s3" {
    bucket         = "my-org-terraform-states"
    key            = "prod/app/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/abcd1234"
    dynamodb_table = "terraform-locks"
  }
}