43탄-3.테라폼-AWS VPC 만들어 사용하자.
목표
테라폼으로 빠르게 VPC를 만들어보자.
수작업으로 오류가 생기지 않도록 VPC와 서브넷을 만들어 관리하자.
테라폼 설치법 알아보자
테라폼으로 VPC,서브넷등 만드는 법을 알아보자.
<1> 명령 EC2 1개 생성
<2> 개발 VPC = pub2, pri2, pridb2, nat2
<3> 개발 VPC, 서브넷 생성확인, 라우팅 테이블 생성 확인
<4> 삭제
<100> 같이보면 좋을 자료
<1> 명령 EC2 1개 생성
myeks
ec2키페어 필요
access/secret-key 필요
terraform -version
참고
https://brunch.co.kr/@topasvga/3585
<2> 개발 VPC = pub2, pri2, pridb2, nat2
실무에서 어느정도의 IP를 할당해 사용하는지 알아보자.
/20 블럭정도 할당해 사용하도록 한다.
private ip를 가장 많이 사용하므로 /22로 할당 한다.
클라우드 CSP마다 서브넷 할당 규칙이 틀릴수 있어 여유IP를 둔다.
첨부 IP
IP블럭 설계시 참고 사항.
개발 VPC블럭이 있다.
전자금융 거래법 사용 VPC 블럭이 있다.
비 전자금용 거래법 사용 VPC블럭이 있다.
1
# pub2 , pri2 , nat 2 -> pub2, pri2, pridb2, nat2
cat <<EOF > provider.tf
provider "aws" {
region = "ap-northeast-2"
}
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/20"
tags = {
Name = "terraform-101"
}
}
resource "aws_subnet" "pri1" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.0.0/22"
availability_zone = "ap-northeast-2a"
tags = {
Name = "101subnet-private-1"
}
}
resource "aws_subnet" "pri2" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.4.0/22"
availability_zone = "ap-northeast-2c"
tags = {
Name = "101subnet-private-2"
}
}
resource "aws_subnet" "pub1" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.8.0/24"
availability_zone = "ap-northeast-2a"
tags = {
Name = "101subnet-1"
}
}
resource "aws_subnet" "pub2" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.9.0/24"
availability_zone = "ap-northeast-2c"
tags = {
Name = "101subnet-2"
}
}
resource "aws_internet_gateway" "igw" {
vpc_id = aws_vpc.main.id
tags = {
Name = "main"
}
}
# default route
resource "aws_route_table" "public" {
vpc_id = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw.id
}
tags = {
Name = "main-default"
}
}
resource "aws_route_table_association" "public_association_1" {
subnet_id = aws_subnet.pub1.id
route_table_id = aws_route_table.public.id
}
resource "aws_route_table_association" "public_association_2" {
subnet_id = aws_subnet.pub2.id
route_table_id = aws_route_table.public.id
}
resource "aws_subnet" "pri-db1" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.10.0/24"
availability_zone = "ap-northeast-2a"
tags = {
Name = "101subnet-pri-db1"
}
}
resource "aws_subnet" "pri-db2" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.11.0/24"
availability_zone = "ap-northeast-2c"
tags = {
Name = "101subnet-pri-db2"
}
}
# nat
resource "aws_eip" "nat_1" {
vpc = true
lifecycle {
create_before_destroy = true
}
}
resource "aws_eip" "nat_2" {
vpc = true
lifecycle {
create_before_destroy = true
}
}
resource "aws_nat_gateway" "nat_gateway_1" {
allocation_id = aws_eip.nat_1.id
# Private subnet이 아니라 public subnet을 연결하셔야 합니다.
subnet_id = aws_subnet.pub1.id
tags = {
Name = "NAT-GW-1"
}
}
resource "aws_nat_gateway" "nat_gateway_2" {
allocation_id = aws_eip.nat_2.id
subnet_id = aws_subnet.pub2.id
tags = {
Name = "NAT-GW-2"
}
}
# private route table add
resource "aws_route_table" "public_private_1" {
vpc_id = aws_vpc.main.id
tags = {
Name = "main-private-1"
}
}
resource "aws_route_table" "public_private_2" {
vpc_id = aws_vpc.main.id
tags = {
Name = "main-private-2"
}
}
resource "aws_route_table_association" "public_association_private_1" {
subnet_id = aws_subnet.pri1.id
route_table_id = aws_route_table.public_private_1.id
}
resource "aws_route_table_association" "public_association_private_2" {
subnet_id = aws_subnet.pri2.id
route_table_id = aws_route_table.public_private_2.id
}
resource "aws_route" "private_nat_1" {
route_table_id = aws_route_table.public_private_1.id
destination_cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.nat_gateway_1.id
}
resource "aws_route" "private_nat_2" {
route_table_id = aws_route_table.public_private_2.id
destination_cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.nat_gateway_2.id
}
# pri-db1,2
# private route table add
resource "aws_route_table" "public_private_db1" {
vpc_id = aws_vpc.main.id
tags = {
Name = "main-private-db1"
}
}
resource "aws_route_table" "public_private_db2" {
vpc_id = aws_vpc.main.id
tags = {
Name = "main-private-db2"
}
}
resource "aws_route_table_association" "public_association_private_db1" {
subnet_id = aws_subnet.pri-db1.id
route_table_id = aws_route_table.public_private_db1.id
}
resource "aws_route_table_association" "public_association_private_db2" {
subnet_id = aws_subnet.pri-db2.id
route_table_id = aws_route_table.public_private_db2.id
}
EOF
terraform init
terraform plan
terraform apply -auto-approve
1분 30초
aws_nat_gateway.nat_gateway_2: Still creating... [1m30s elapsed]
aws_nat_gateway.nat_gateway_1: Still creating... [1m30s elapsed]
aws_nat_gateway.nat_gateway_1: Creation complete after 1m34s [id=nat-0c5fb918a977ff1b9]
aws_route.private_nat_1: Creating...
aws_route.private_nat_1: Creation complete after 0s [id=r-rtb-00345d4bcafba1e341080289494]
aws_nat_gateway.nat_gateway_2: Still creating... [1m40s elapsed]
aws_nat_gateway.nat_gateway_2: Still creating... [1m50s elapsed]
aws_nat_gateway.nat_gateway_2: Creation complete after 1m54s [id=nat-07649ab3ce232abdc]
aws_route.private_nat_2: Creating...
aws_route.private_nat_2: Creation complete after 0s [id=r-rtb-0101a725fa0798d121080289494]
╷
<3> 개발 VPC, 서브넷 생성확인, 라우팅 테이블 생성 확인
1
VPC 생성 확인
2. 서브넷 생성 확인
3 . 라우팅 테이블 생성 확인
라우팅 테이블은 5개이다.
퍼블릭 라우팅 테이블 1개
프라이빗 라우팅 테이블 2개
DB라우팅 테이블 2개
퍼블릭 라우팅 테이블
프라이빗 라우팅 테이블1
프라이빗 라우팅 테이블2
디비 라우팅 테이블 1 , 디비 라우팅 테이블 2
4
VPC > natgw 생성확인
<4> 삭제
terraform destroy -auto-approve
<100> 같이보면 좋을 자료
1
https://brunch.co.kr/@topasvga/2797
2
https://brunch.co.kr/@topasvga/3360
3
https://brunch.co.kr/@topasvga/3347
4
https://brunch.co.kr/@topasvga/3588
감사합니다.
