はじめに
今までAzureリソースをデプロイする際には、Azure Portalからリソースをデプロイしていました。
しかし、Terraformを利用する事で構築作業時のミスや構成管理においての効率が高くなるので
私もTerraformを勉強していこうと、本記事を備忘録として残しました。
Terraform on Azureは情報も少ないと感じたので、誰かの参考になれば幸いです。
今回のゴール
・リソースグループ作成
・Network Interface作成
・Virtual Machines作成
・Virtual Network（subnet含む）作成
・Network Security Group作成
・Managed Disk作成
provider.tf作成
どのクラウドプラットフォームにデプロイするのかを指定するためのファイル
provider.tf
# 利用するプロバイダー&バージョン指定
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "=3.0.0"
}
}
}
# Azure プロバイダーの設定
provider "azurerm" {
skip_provider_registration = true
features {}
}
Variable（関数）も利用したいのでファイル作成
関数を利用したい場合に使いますが、使わなくてもデプロイできます。
コードの再利用をしていくのであれば、設定した方が使い勝手が良いです。
variable.tf
variable "env" {
type = string
}
local（変数）も使う
単純な変数を指定するファイルです。
毎度リソースネームを入力するのが大変&ミスを防ぐ為に設定していきます。
local.tf
locals {
location = "Japaneast"
#ネットワークリソース変数
vnet_name = "demo_vnet_01"
public_subnet_name = "public"
private_subnet_name = "private"
nsg_name = "demo_nsg_01"
nsg_name_rdp = "RDP"
#VMリソース変数
nic_name = "demo_nic_01"
vm_name = "demo_vm_01"
admin_name = "azureuser01"
admin_password = "Password01?!"
}
実際のリソースをコード化していく
ここからリソースに対する細かい設定項目の指定などをしていきます。
基本的には、Hashi Corp社の公式情報を参考に記載していきます。
設定必須な項目と必須でない項目が分かれているので、詳細は下記URLを確認してください。
リソースグループ作成
rg.tf
#リソースグループ作成
resource "azurerm_resource_group" "rg" {
name = "rg-${var.env}"
location = local.location
}
ネットワークリソース作成
network.tf
#Vnet作成
resource "azurerm_virtual_network" "vnet" {
name = local.vnet_name
location = local.location
resource_group_name = azurerm_resource_group.rg.name
address_space = ["10.0.0.0/16"]
}
#subnet作成
resource "azurerm_subnet" "public" {
name = local.public_subnet_name
resource_group_name = azurerm_resource_group.rg.name
virtual_network_name = azurerm_virtual_network.vnet.name
address_prefixes = ["10.0.1.0/24"]
}
resource "azurerm_subnet" "private" {
name = local.private_subnet_name
resource_group_name = azurerm_resource_group.rg.name
virtual_network_name = azurerm_virtual_network.vnet.name
address_prefixes = ["10.0.2.0/24"]
}
#NSG作成
resource "azurerm_network_security_group" "nsg" {
name = local.nsg_name
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
}
#NSG Rule作成
resource "azurerm_network_security_rule" "rdp" {
name = local.nsg_name_rdp
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "3389"
destination_port_range = "*"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group.rg.name
network_security_group_name = azurerm_network_security_group.nsg.name
}
#NSGの関連付け
resource "azurerm_network_interface_security_group_association" "nsg_associate" {
network_interface_id = azurerm_network_interface.nic01.id
network_security_group_id = azurerm_network_security_group.nsg.id
}
VM作成
vm.tf
#NIC作成
resource "azurerm_network_interface" "nic01" {
name = local.nic_name
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
ip_configuration {
name = "internal"
subnet_id = azurerm_subnet.private.id
private_ip_address_allocation = "Dynamic"
}
}
#VM作成
resource "azurerm_windows_virtual_machine" "vm" {
name = local.vm_name
resource_group_name = azurerm_resource_group.rg.name
location = azurerm_resource_group.rg.location
size = "Standard_B1s"
admin_username = local.admin_name
admin_password = local.admin_password
network_interface_ids = [
azurerm_network_interface.nic01.id
]
os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}
source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2016-Datacenter"
version = "latest"
}
}
Azure環境へデプロイ
実際にAzure環境へTerraformで記載したコードを基にリソースのデプロイを行います。
今回使っていくコマンドは下記です。
・terraform init
・terraform plan
・terradform apply
terraform init 実行
Terraformの実行に必要なバイナリファイルをダウンロードしてくれるコマンドですが
私は既に最新のファイルをダウンロード済みの環境なので、下記の出力になります。
terraform init 出力
Initializing the backend...
Initializing provider plugins...
- Reusing previous version of hashicorp/azurerm from the dependency lock file
- Using previously-installed hashicorp/azurerm v3.0.0
Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
terraform plan 実行
このコマンドでは、コード化されたインフラを仮構築できます。
設定項目等の確認に利用できます。
var.envは今回文字を任意入力するように設定しています。
今回は適当に「demo1」と入力します。
（リソースグループの名前が「rg-任意」になります。）
terraform plan 出力
var.env
Enter a value: demo1
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azurerm_network_interface.nic01 will be created
+ resource "azurerm_network_interface" "nic01" {
+ applied_dns_servers = (known after apply)
+ dns_servers = (known after apply)
+ enable_accelerated_networking = false
+ enable_ip_forwarding = false
+ id = (known after apply)
+ internal_dns_name_label = (known after apply)
+ internal_domain_name_suffix = (known after apply)
+ location = "japaneast"
+ mac_address = (known after apply)
+ name = "demo_nic_01"
+ private_ip_address = (known after apply)
+ private_ip_addresses = (known after apply)
+ resource_group_name = "rg-demo1"
+ virtual_machine_id = (known after apply)
+ ip_configuration {
+ gateway_load_balancer_frontend_ip_configuration_id = (known after apply)
+ name = "internal"
+ primary = (known after apply)
+ private_ip_address = (known after apply)
+ private_ip_address_allocation = "Dynamic"
+ private_ip_address_version = "IPv4"
+ subnet_id = (known after apply)
}
}
# azurerm_network_interface_security_group_association.nsg_associate will be created
+ resource "azurerm_network_interface_security_group_association" "nsg_associate" {
+ id = (known after apply)
+ network_interface_id = (known after apply)
+ network_security_group_id = (known after apply)
}
# azurerm_network_security_group.nsg will be created
+ resource "azurerm_network_security_group" "nsg" {
+ id = (known after apply)
+ location = "japaneast"
+ name = "demo_nsg_01"
+ resource_group_name = "rg-demo1"
+ security_rule = (known after apply)
}
# azurerm_network_security_rule.rdp will be created
+ resource "azurerm_network_security_rule" "rdp" {
+ access = "Allow"
+ destination_address_prefix = "*"
+ destination_port_range = "*"
+ direction = "Inbound"
+ id = (known after apply)
+ name = "RDP"
+ network_security_group_name = "demo_nsg_01"
+ priority = 100
+ protocol = "Tcp"
+ resource_group_name = "rg-demo1"
+ source_address_prefix = "*"
+ source_port_range = "3389"
}
# azurerm_resource_group.rg will be created
+ resource "azurerm_resource_group" "rg" {
+ id = (known after apply)
+ location = "japaneast"
+ name = "rg-demo1"
}
# azurerm_subnet.private will be created
+ resource "azurerm_subnet" "private" {
+ address_prefixes = [
+ "10.0.2.0/24",
]
+ enforce_private_link_endpoint_network_policies = false
+ enforce_private_link_service_network_policies = false
+ id = (known after apply)
+ name = "private"
+ resource_group_name = "rg-demo1"
+ virtual_network_name = "demo_vnet_01"
}
# azurerm_subnet.public will be created
+ resource "azurerm_subnet" "public" {
+ address_prefixes = [
+ "10.0.1.0/24",
]
+ enforce_private_link_endpoint_network_policies = false
+ enforce_private_link_service_network_policies = false
+ id = (known after apply)
+ name = "public"
+ resource_group_name = "rg-demo1"
+ virtual_network_name = "demo_vnet_01"
}
# azurerm_virtual_network.vnet will be created
+ resource "azurerm_virtual_network" "vnet" {
+ address_space = [
+ "10.0.0.0/16",
]
+ dns_servers = (known after apply)
+ guid = (known after apply)
+ id = (known after apply)
+ location = "japaneast"
+ name = "demo_vnet_01"
+ resource_group_name = "rg-demo1"
+ subnet = (known after apply)
}
# azurerm_windows_virtual_machine.vm will be created
+ resource "azurerm_windows_virtual_machine" "vm" {
+ admin_password = (sensitive value)
+ admin_username = "azureuser01"
+ allow_extension_operations = true
+ computer_name = (known after apply)
+ enable_automatic_updates = true
+ extensions_time_budget = "PT1H30M"
+ hotpatching_enabled = false
+ id = (known after apply)
+ location = "japaneast"
+ max_bid_price = -1
+ name = "demo-vm-01"
+ network_interface_ids = (known after apply)
+ patch_mode = "AutomaticByOS"
+ platform_fault_domain = -1
+ priority = "Regular"
+ private_ip_address = (known after apply)
+ private_ip_addresses = (known after apply)
+ provision_vm_agent = true
+ public_ip_address = (known after apply)
+ public_ip_addresses = (known after apply)
+ resource_group_name = "rg-demo1"
+ size = "Standard_B1s"
+ virtual_machine_id = (known after apply)
+ os_disk {
+ caching = "ReadWrite"
+ disk_size_gb = (known after apply)
+ name = (known after apply)
+ storage_account_type = "Standard_LRS"
+ write_accelerator_enabled = false
}
+ source_image_reference {
+ offer = "WindowsServer"
+ publisher = "MicrosoftWindowsServer"
+ sku = "2016-Datacenter"
+ version = "latest"
}
}
Plan: 9 to add, 0 to change, 0 to destroy.
terraform apply 実行
実際にデプロイを実行するためのコマンドです。
このコマンドを利用した際は、実際にリソースが作成されます。
terraform aplly 出力
var.env
Enter a value: demo1
azurerm_resource_group.rg: Refreshing state... [id=/subscription id/resourceGroups/rg-demo1]
azurerm_network_security_group.nsg: Refreshing state... [id=/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/networkSecurityGroups/demo_nsg_01]
azurerm_virtual_network.vnet: Refreshing state... [id=/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/virtualNetworks/demo_vnet_01]
azurerm_network_security_rule.rdp: Refreshing state... [id=/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/networkSecurityGroups/demo_nsg_01/securityRules/RDP]
azurerm_subnet.public: Refreshing state... [id=/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/virtualNetworks/demo_vnet_01/subnets/public]
azurerm_subnet.private: Refreshing state... [id=/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/virtualNetworks/demo_vnet_01/subnets/private]
azurerm_network_interface.nic01: Refreshing state... [id=/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/networkInterfaces/demo_nic_01]
azurerm_network_interface_security_group_association.nsg_associate: Refreshing state... [id=/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/networkInterfaces/demo_nic_01|/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/networkSecurityGroups/demo_nsg_01]
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azurerm_windows_virtual_machine.vm will be created
+ resource "azurerm_windows_virtual_machine" "vm" {
+ admin_password = (sensitive value)
+ admin_username = "azureuser01"
+ allow_extension_operations = true
+ computer_name = (known after apply)
+ enable_automatic_updates = true
+ extensions_time_budget = "PT1H30M"
+ hotpatching_enabled = false
+ id = (known after apply)
+ location = "japaneast"
+ max_bid_price = -1
+ name = "demo-vm-01"
+ network_interface_ids = [
+ "/subscription id/resourceGroups/rg-demo1/providers/Microsoft.Network/networkInterfaces/demo_nic_01",
]
+ patch_mode = "AutomaticByOS"
+ platform_fault_domain = -1
+ priority = "Regular"
+ private_ip_address = (known after apply)
+ private_ip_addresses = (known after apply)
+ provision_vm_agent = true
+ public_ip_address = (known after apply)
+ public_ip_addresses = (known after apply)
+ resource_group_name = "rg-demo1"
+ size = "Standard_B1s"
+ virtual_machine_id = (known after apply)
+ os_disk {
+ caching = "ReadWrite"
+ disk_size_gb = (known after apply)
+ name = (known after apply)
+ storage_account_type = "Standard_LRS"
+ write_accelerator_enabled = false
}
+ source_image_reference {
+ offer = "WindowsServer"
+ publisher = "MicrosoftWindowsServer"
+ sku = "2016-Datacenter"
+ version = "latest"
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
Azureリソースがデプロイできているか見てみる
今回デプロイしたのは、下記です。
・リソースグループ
・Virtual Network（subnet含む）
・Virtual Machines
・Network Interface
・Network Security Group
・Managed Disk
さいごに
今回はTerraformでAzure上に簡単なリソースをデプロイするまでを試してみました。
今後は実際にVMに目的を持たせて拡張機能のインストール等、より複雑化した構成をコード化してみたいと思います。