「最佳实践与安全加固」

variable "db_password" {
  type      = string
  sensitive = true   # 禁止在 plan 中显示默认值
}

resource "aws_db_instance" "db" {
  password = var.db_password
}

output "db_password" {
  value     = aws_db_instance.db.password
  sensitive = true
}

# 查看 state 中的敏感字段（会明文）
terraform state show aws_db_instance.db
# 或直接查 backend 桶中的文件
aws s3 cp s3://my-infra-tfstate/prod/db/terraform.tfstate - | jq .outputs

# 从环境变量读取（CI Secret / 本地 shell 注入）
variable "db_password" {
  type = string
}

provider "aws" {
  region = var.region
}

# 从 Vault 获取后注入环境变量
export DB_PASSWORD=$(vault kv get -field=password secret/team/db)
terraform apply -var="db_password=$DB_PASSWORD"

terraform {
  backend "s3" {
    bucket  = "my-infra-tfstate"
    key     = "prod/db/terraform.tfstate"
    region  = "ap-northeast-1"
    encrypt = true
    # kms_key_id = "arn:aws:kms:...:key/xxx"   # 指定 KMS 客户密钥
  }
}

# 提交前扫描密钥
gitleaks detect --source ./

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:RunInstances",
        "ec2:TerminateInstances"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": { "aws:RequestedRegion": "ap-northeast-1" }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-infra-tfstate/*"
    }
  ]
}

# 资源级的删除保护
resource "aws_s3_bucket" "critical" {
  bucket = "critical-data"
  force_destroy = false
}

resource "aws_instance" "web" {
  disable_api_termination = true   # 防止误删
}

# policy/bucket.rego
package main

deny[msg] {
  input.resource_changes[_].change.actions[_] == "create"
  resource := input.resource_changes[_]
  resource.type == "aws_s3_bucket"
  resource.change.after.force_destroy == true
  msg := "禁止对 S3 桶启用 force_destroy"
}

deny[msg] {
  resource := input.resource_changes[_]
  resource.type == "aws_security_group"
  rule := resource.change.after.ingress[_]
  rule.cidr_blocks[_] == "0.0.0.0/0"
  rule.from_port == 22
  msg := "禁止对 22 端口开放 0.0.0.0/0"
}

# 把 plan 转成 JSON 后交给 Conftest
terraform show -json tfplan.binary | conftest test -

- name: Policy check
  run: |
    terraform show -json tfplan.binary | conftest test - --policy policy/

# 生成并提交 lockfile
terraform init
git add .terraform.lock.hcl

# 校验 Provider 完整性
terraform providers lock -platform=linux_amd64

# .terraform.lock.hcl 示例
provider "registry.terraform.io/hashicorp/aws" {
  version = "5.40.0"
  hashes  = [
    "h1:xxx...",
  ]
}

# 1. 记录每次 apply 的操作者与产物
echo "$GITHUB_ACTOR $GITHUB_SHA $(date)" > apply-log.txt

# 2. 把 plan 产物归档到审计桶
aws s3 cp tfplan.binary s3://audit-bucket/$(date +%Y%m%d)/tfplan.binary

# 3. 记录变更摘要
terraform show -json tfplan.binary | jq '.resource_changes[] | {address, actions: .change.actions}' > audit.json

# 定期巡检：每周跑一次 plan 并对比
terraform plan -detailed-exitcode
# exit code 2 → 存在漂移，触发告警

# 一键自查：扫描仓库中的疑似密钥
gitleaks detect --source ./

# 检查 state 桶是否开启加密
aws s3api get-bucket-encryption --bucket my-infra-tfstate