[Terraform] 운영서버 구축을 위한 가이드

terraform/
├── module/            # 여러 계층/서비스가 공통으로 참조하는 재사용 모듈 (route53, acm 등)
└── project/
    ├── global/        # 모든 서비스가 공유하는 공용 자원 (VPC, Route53, ACM, Shared ALB, IAM)
    ├── ssuport/
    │   └── prod/      # 이 글에서 다루는 부분
    ├── homepage/
    ├── club-homepage/
    └── authenticator/

User → Route53 → CloudFront → S3

User → Route53 → CloudFront (API용) → Shared ALB → Target Group → Private EC2

module "route53_ssuport_prod" {
  source      = "../../modules/route53"
  domain_name = local.ssuport_prod_domain_name
  common_tags = {
    Environment = "global",
    Project     = "itsupport-ssuport",
    Owner       = "itsupport-devops",
    Name        = "SSUPORT_PROD_DOMAIN"
  }
}

# CloudFront용 버지니아 북부 인증서
resource "aws_acm_certificate" "ssuport_prod_certificate" {
  provider          = aws.us_east_1
  domain_name       = local.ssuport_prod_domain_name
  validation_method = "DNS"
  lifecycle {
    create_before_destroy = true
  }
  subject_alternative_names = ["*.${local.ssuport_prod_domain_name}"]
  tags = local.common_tags
}
 
# ALB용 서울 리전 인증서
resource "aws_acm_certificate" "ssuport_prod_certificate_seoul" {
  provider          = aws.ap_northeast_2
  domain_name       = local.ssuport_prod_domain_name
  validation_method = "DNS"
  lifecycle {
    create_before_destroy = true
  }
  subject_alternative_names = ["*.${local.ssuport_prod_domain_name}"]
  tags = merge(local.common_tags, { Name = "ssuport-prod-cert-seoul" })
}

data "terraform_remote_state" "itsupport_global" {
  backend = "s3"
  config = {
    bucket = "terraform-state-xxxxxxxx"
    key    = "global/terraform.tfstate"
    region = "ap-northeast-2"
  }
}
 
# 글로벌 공용 ALB도 참조
data "aws_lb" "itsupport_prod_alb" {
  name = "shared-prod-alb"
}

# S3 버킷 및 OAC 정책 설정 예시
resource "aws_s3_bucket" "ssuport_prod_static" {
  bucket = local.prod_static_bucket_name
  # ... (태그 및 기타 설정 생략) ...
}
 
# CloudFront OAC만 S3 읽기 권한 허용
resource "aws_s3_bucket_policy" "ssuport_prod_policy" {
  bucket = aws_s3_bucket.ssuport_prod_static.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid       = "AllowCloudFrontServicePrincipalReadOnly"
      Effect    = "Allow"
      Principal = { Service = "cloudfront.amazonaws.com" }
      Action    = "s3:GetObject"
      Resource  = "${aws_s3_bucket.ssuport_prod_static.arn}/*"
      Condition = {
        StringEquals = {
          "AWS:SourceArn" = aws_cloudfront_distribution.ssuport_apply_prod_distribution.arn
        }
      }
    }]
  })
}

resource "aws_instance" "ssuport_prod_application_instance" {
  ami           = "ami-xxxxxxxxxxxxxxxxx" # 실제 AMI ID 마스킹
  instance_type = "t4g.small"
 
  # 프라이빗 서브넷 배치 (원격 상태 참조)
  subnet_id = data.terraform_remote_state.itsupport_global.outputs.itsupport_production_subnet_6_id
 
  associate_public_ip_address = false
  iam_instance_profile        = data.terraform_remote_state.itsupport_global.outputs.prod_ec2_role_profile_name
  # ...
}

# 1. 타깃 그룹 생성 및 헬스체크 설정
resource "aws_lb_target_group" "ssuport_prod_tg" {
  name     = "ssuport-prod-tg"
  port     = 8080
  protocol = "HTTP"
  vpc_id   = data.terraform_remote_state.itsupport_global.outputs.itsupport_prod_vpc_id
 
  health_check {
    path                = "/actuator/health"
    healthy_threshold   = 3
    unhealthy_threshold = 2
    timeout             = 5
    interval            = 15
    matcher             = "200"
  }
 
  tags = merge(local.common_tags, {
    Name = "ssuport-prod-tg"
  })
}
 
# 2. 생성한 타깃 그룹에 EC2 인스턴스 연결
resource "aws_lb_target_group_attachment" "ssuport_prod_attachment" {
  target_group_arn = aws_lb_target_group.ssuport_prod_tg.arn
  target_id        = aws_instance.ssuport_prod_application_instance.id
  port             = 8080
}

resource "aws_route53_record" "ssuport_apply" {
  zone_id = data.terraform_remote_state.itsupport_global.outputs.ssuport_prod_zone_id
  name    = local.domain_names["apply"]
  type    = "A"
 
  alias {
    name                   = aws_cloudfront_distribution.ssuport_apply_prod_distribution.domain_name
    zone_id                = aws_cloudfront_distribution.ssuport_apply_prod_distribution.hosted_zone_id
    evaluate_target_health = false
  }
}