「HCL 语法与基础」

# 声明式：描述期望状态，而非执行步骤
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"
}

provider "aws" {
  region = var.region
}

variable "region" {
  type    = string
  default = "ap-northeast-1"
}

resource "aws_security_group" "web" {
  name = "web-sg"
}

locals {
  common_tags = { env = "prod" }
}

output "instance_ip" {
  value = aws_instance.web.public_ip
}

# 单行注释（也支持 // 与 /* */ 块注释）
resource "aws_instance" "web" {
  ami = "ami-123456"   # 属性用 = 赋值，嵌套结构用 {} 表达
}

locals {
  str   = "hello"                      # string
  num   = 42                           # number
  bool  = true                         # bool
  list  = ["a", "b", "c"]              # list(string)
  map   = { name = "web", env = "prod" }  # map(string)
  set   = toset(["x", "y", "x"])       # set，自动去重
  obj   = { id = 1, tags = ["a"] }     # object，各属性类型不同
  tuple = [1, "two", true]             # tuple，各元素类型不同
}

variable "ingress_rules" {
  type = list(object({
    port        = number
    cidr_blocks = list(string)
  }))
  default = [
    { port = 80, cidr_blocks = ["0.0.0.0/0"] },
    { port = 443, cidr_blocks = ["0.0.0.0/0"] },
  ]
}

locals {
  # 显式转换
  port_str   = tostring(80)
  rule_set   = toset(var.ingress_rules[*].port)
  upper_map  = tomap({ a = "x" })
  keys_list  = keys({ a = 1, b = 2 })   # ["a", "b"]
}

locals {
  name     = "web"
  instance = "${name}-ap-northeast-1"     # 插值：${...} 求值嵌入
  user_data = <<-EOT
    #!/bin/bash
    apt-get update
  EOT                                     # <<-EOT 去除公共缩进
}

locals {
  joined    = join(",", ["a", "b", "c"])        # "a,b,c"
  splitted  = split(",", "a,b,c")                # ["a","b","c"]
  formatted = format("%s-%02d", "web", 3)        # "web-03"
  replaced  = replace("a-b-c", "-", "_")         # "a_b_c"
  upper     = upper("abc")                       # "ABC"
  encoded   = base64encode("hello")              # "aGVsbG8="
  sha       = sha256("secret")                   # 十六进制哈希
}

locals {
  merged   = merge({ a = 1 }, { b = 2 })         # {a=1,b=2}
  looked   = lookup({ a = 1 }, "x", 0)           # 键不存在时返回默认 0
  concated = concat([1, 2], [3, 4])              # [1,2,3,4]
  filtered = [for s in ["a", "bb", "c"] : s if length(s) > 1]  # ["bb"]
  lengths  = length(["a", "b"])                  # 2
  element  = element(["a", "b", "c"], 1)         # "b"
  distinct = distinct(["x", "y", "x"])           # ["x","y"]
  cidrs    = [for i in range(0, 4) : cidrhost("10.0.0.0/24", i)]  # 前 4 个 IP
}

locals {
  # try：表达式求值失败时回退，避免整个运行报错
  safe_value = try(data.aws_ami.latest.id, null)
  # coalesce：返回第一个非空值
  image_id = coalesce(var.custom_ami, data.aws_ami.latest.id, "ami-default")
}

# count：基于整数，资源地址为 aws_instance.web[0..2]
resource "aws_instance" "web" {
  count         = 3
  ami           = "ami-123456"
  instance_type = "t3.micro"
}

# for_each：基于集合/map，资源地址为 aws_iam_user.users["alice"]
resource "aws_iam_user" "users" {
  for_each = toset(["alice", "bob", "carol"])
  name     = each.value
}

resource "aws_subnet" "azs" {
  for_each = {
    "a" = "10.0.1.0/24"
    "b" = "10.0.2.0/24"
  }
  vpc_id            = aws_vpc.main.id
  cidr_block        = each.value
  availability_zone = "ap-northeast-1${each.key}"
}

locals {
  users = {
    alice = "admin"
    bob   = "dev"
    carol = "dev"
  }
  # 过滤 + 转换：仅保留 dev，输出 "bob","carol"
  devs = [for name, role in users : name if role == "dev"]

  # map 形态的 for
  upper = { for name, role in users : name => upper(role) }

  # splat：取列表资源的所有属性
  all_ids = aws_instance.web[*].id
}

resource "aws_security_group" "web" {
  name = "web-sg"

  dynamic "ingress" {                    # 块级循环
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.port
      to_port     = ingress.value.port
      protocol    = ingress.value.protocol
      cidr_blocks = [ingress.value.cidr]
    }
  }
}

locals {
  # 条件表达式（var.environment 为 dev/staging/prod）
  is_prod     = var.environment == "prod"
  instance    = var.environment == "prod" ? "t3.large" : "t3.micro"
  replica_cnt = var.environment == "prod" ? 2 : 0

  # 逻辑运算
  enable_monitoring = var.environment == "prod" || var.enable_monitoring == true

  # 空值处理：null 显式赋值会绕过 default，用 coalesce 兜底
  zone = coalesce(var.zone, "ap-northeast-1a")
}

locals {
  base_tags = { project = "shop", owner = "team-infra" }
  # 生产环境额外打标
  tags = merge(
    base_tags,
    var.environment == "prod" ? { tier = "prod" } : {},
    var.environment == "dev" ? { tier = "dev" } : {},
  )
}

# ❌ for_each 接 list 会报错 → ✅ 用 toset 转换
resource "aws_iam_user" "users" {
  for_each = toset(["alice", "bob"])
  name     = each.value
}

# 格式化：统一缩进与对齐，且会把 map 键对齐
terraform fmt

# 校验语法与类型
terraform validate

# 静态分析（第三方）
tflint