状态手术进阶：state mv、手工修复与备份纪律

# 1. 确认工作目录与工作区，避免在错误的环境动手
terraform workspace show
terraform state list | wc -l

# 2. 拉一份完整状态快照做冷备份（最关键的一步）
mkdir -p backup
terraform state pull > "backup/state-$(date +%Y%m%d-%H%M%S).json"

# 3. 记录 serial 与 lineage，作为事后比对基线
terraform state pull | jq '{serial, lineage, version}'

[现象] 推送一份来自其他环境的状态
Error: Terraform state push failed
  The remote state lineage "a1b2..." does not match the local state lineage "8f3c..."
  This means the state file belongs to a different Terraform configuration.

# 同模块内重命名
terraform state mv aws_instance.web aws_instance.app

# 从根模块移入子模块
terraform state mv aws_instance.app module.compute.aws_instance.app

# 跨模块搬迁，以及递归搬迁整个模块
terraform state mv module.old.aws_s3_bucket.data module.new.aws_s3_bucket.data
terraform state mv -recursive module.legacy module.modern

# 较新版本可先预演，不真正写状态
terraform state mv -dry-run module.old.aws_instance.worker module.new.aws_instance.worker

terraform state mv 'aws_instance.app["web-1"]' 'module.compute.aws_instance.app["web-1"]'

moved {
  from = aws_instance.web
  to   = aws_instance.app
}

moved {
  from = module.legacy
  to   = module.modern
}

# state rm：只从状态摘除，真实资源原封不动
terraform state rm aws_s3_bucket.data

# destroy：真正调用云 API 删除资源
terraform destroy -target=aws_s3_bucket.data

# 递归移除整个模块下的资源
terraform state rm -recursive module.legacy

terraform state pull > backup/pre-rm.json                          # 备份
terraform state rm module.legacy.aws_instance.worker               # 移除旧地址
terraform import module.compute.aws_instance.worker i-0abc1234567890def
terraform plan                                                     # 必须收敛到 No changes

resource "aws_db_instance" "prod" {
  # 省略业务参数
  lifecycle {
    prevent_destroy = true
  }
}

# CI 里对包含删除动作的计划直接失败
terraform plan -out=tfplan
terraform show -json tfplan \
  | jq -e '[.resource_changes[]?.change.actions[]? | select(. == "delete")] | length == 0' \
  || { echo "计划中包含删除动作，需人工审批"; exit 1; }

{
  "type": "aws_instance",
  "name": "app",
  "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]"
}

terraform state replace-provider \
  registry.terraform.io/hashicorp/aws \
  registry.example.com/acme/aws

terraform {
  required_providers {
    aws = {
      source  = "registry.example.com/acme/aws"
      version = "~> 5.40"
    }
  }
}

provider "aws" {
  alias  = "replica"
  region = "us-west-2"
}

terraform init -upgrade           # 1. 让 Terraform 认识新源
terraform state replace-provider \
  registry.terraform.io/hashicorp/aws \
  registry.example.com/acme/aws   # 2. 改写状态里的 provider 地址
terraform init && terraform plan  # 3. 验证无差异

terraform state pull > tfstate.working.json       # 拉到本地可编辑文件
cp tfstate.working.json tfstate.working.json.bak  # 永远先备份
jq empty tfstate.working.json && echo "JSON 合法"  # 校验结构是否完整
terraform state push tfstate.working.json         # 推回，push 会自动递增 serial

{
  "version": 4,
  "terraform_version": "1.9.5",
  "serial": 42,
  "lineage": "8f3c1a2e-6b4d-4c9a-9f21-0d5e7a8b1c33",
  "outputs": {},
  "resources": []
}

[现象] terraform state push 报 serial 冲突
Error: Failed to write state: state serial 42 is not greater than 42

[处理] 说明有人在你拉取之后又写过状态
 1. 重新 pull 拿到最新 serial
 2. 把手工改动重放到新副本上，不要盲目 -force
 3. 确认无人并发时才考虑 terraform state push -force

# 找出重复的资源地址（同一地址出现两次）
terraform state pull \
  | jq -r '.resources[] | "\(.module // "root").\(.type).\(.name)"' | sort | uniq -d

# 找出配置里已不存在、状态里还留着的孤儿（显示将被销毁）
terraform plan -refresh=false | grep -i "will be destroyed"

import {
  to = aws_security_group.web
  id = "sg-0a1b2c3d4e5f67890"
}

terraform plan -generate-config-out=generated.tf

terraform {
  backend "s3" {
    bucket         = "acme-tfstate-prod"
    key            = "network/terraform.tfstate"
    region         = "ap-southeast-1"
    dynamodb_table = "acme-tfstate-lock"
    encrypt        = true
  }
}

aws s3api list-object-versions \
  --bucket acme-tfstate-prod \
  --prefix network/terraform.tfstate \
  --query 'Versions[].{VersionId:VersionId,LastModified:LastModified}' \
  --output table

terraform state pull > sandbox.json   # 1. 把生产状态副本拉到沙箱
terraform init -migrate-state         # 2. 沙箱改用本地后端并指向副本
terraform state mv module.legacy.aws_instance.worker module.compute.aws_instance.worker
terraform plan                        # 3. 确认收敛到 No changes 再搬到生产