「资源与状态管理」

期望状态（.tf 配置）  ──┐
                        ├──► 对比 ──► 生成 plan（增/删/改）
现实状态（terraform.tfstate）──┘

# 配置中引用另一资源的输出
resource "aws_instance" "web" {
  subnet_id = aws_subnet.main.id
}

{
  "version": 4,
  "terraform_version": "1.7.0",
  "serial": 7,
  "lineage": "8a1b...",
  "outputs": {},
  "resources": [
    {
      "module": "module.vpc",
      "mode": "managed",
      "type": "aws_subnet",
      "name": "main",
      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
      "instances": [
        {
          "schema_version": 1,
          "attributes": {
            "id": "subnet-0a1b2c3d",
            "cidr_block": "10.0.1.0/24"
          },
          "sensitive_attributes": [],
          "private": "bm9wZQ=="
        }
      ]
    }
  ]
}

terraform.tfstate        # 主状态文件
terraform.tfstate.backup # 上次成功写入前的备份
terraform.tfstate.d/     # 使用 -state 参数时的目录
.terraform/              # 缓存 Provider 与后端配置

terraform {
  backend "s3" {
    bucket         = "my-infra-tfstate"
    key            = "prod/network/terraform.tfstate"
    region         = "ap-northeast-1"
    encrypt        = true
    dynamodb_table = "tf-state-lock"
  }
}

# 推荐：partial configuration，凭据与敏感信息由环境注入
terraform {
  backend "s3" {}  # 参数从命令行 / CI 环境读取
}

terraform init -backend-config="bucket=my-infra-tfstate" \
  -backend-config="key=prod/network/terraform.tfstate" \
  -backend-config="region=ap-northeast-1"

# 正常流程：plan/apply 自动加锁
terraform apply

# 锁被占用时的报错
# Error: Error acquiring the state lock
# LockInfo: { "ID": "...", "Operation": "OperationTypeApply", "Info": "...", "Who": "...", "Created": "..." }

# 排查后强制解锁（谨慎！）
terraform force-unlock <LOCK_ID>

plan ──► 尝试加锁 ──► 读取 state ──► 计算 diff ──► 释放锁
apply ──► 加锁 ──► 写新 state ──► 释放锁

# 先写好对应的资源块（属性可先留空，import 后补全）
resource "aws_instance" "legacy" {
  # 只写必填字段，其余属性 import 后会自动填充
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"
}

# 导入：把真实实例 i-0a1b2c3d 映射到 aws_instance.legacy
terraform import aws_instance.legacy i-0a1b2c3d

# 验证
terraform state show aws_instance.legacy

# 用 import block 声明式导入（Terraform 1.5+ 推荐）

import {
  to = aws_instance.legacy
  id = "i-0a1b2c3d"
}

resource "aws_instance" "legacy" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"
}

# 资源改名
terraform state mv aws_instance.web aws_instance.web_server

# 挪进模块
terraform state mv aws_subnet.main module.vpc.aws_subnet.main

# count 索引迁移
terraform state mv 'aws_instance.web[0]' 'aws_instance.web["a"]'

# 把地址迁移写进配置，团队成员 plan 时自动重映射，无需逐个跑命令
moved {
  from = aws_instance.web
  to   = aws_instance.web_server
}

moved {
  from = aws_subnet.main
  to   = module.vpc.aws_subnet.main
}

# 从当前 state 中导出子集到独立文件
terraform state pull > full.tfstate
terraform state rm aws_instance.worker   # 从原 state 移除

# 在新目录中导入
terraform state push full.tfstate        # 覆盖写入（谨慎）

terraform {
  backend "s3" {
    bucket = "my-infra-tfstate"
    key    = "${var.env}/network/terraform.tfstate"  # 通过 -backend-config 注入
    region = "ap-northeast-1"
  }
}

prod/network/terraform.tfstate
prod/app/terraform.tfstate
staging/network/terraform.tfstate
staging/app/terraform.tfstate

# 安全查看 state（字段会被打码）
terraform state show aws_instance.web

# 导出与恢复备份
aws s3 cp s3://my-infra-tfstate/prod/network/terraform.tfstate ./backup.tfstate