# 远程后端存储 (Remote State Storage)
terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "prod.terraform.tfstate"
    region = "us-west-2"
  }
}

terraform init

terraform plan -out=tfplan

terraform apply tfplan

terraform validate

terraform destroy -auto-approve

module "vpc" {
  source = "./modules/vpc"
  
  # 输入变量 (Input Variables)
  vpc_cidr = "10.0.0.0/16"
  public_subnet_cidrs = [
    "10.0.1.0/24",
    "10.0.3.0/24"
  ]
  
  # 输出变量 (Output Variables)
  vpc_id = module.vpc.vpc_id
  public_subnet_ids = module.vpc.public_subnet_ids
}

# Terraform 配置文件 (resource.tf)
resource "aws_instance" "example" {
  # 资源类型
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  
  # 输入参数 (Input Parameters)
  key_name = "my-key-pair"
  
  # 标签 (Tags)
  tags = {
    Name        = "example-instance"
    Environment = "production"
    Project     = "webapp"
  }
  
  # 依赖 (Dependencies)
  depends_on = [
    aws_security_group.allow_ssh,
    aws_iam_role.ec2_role
  ]
}

# 提供商配置 (provider.tf)
provider "aws" {
  region = "us-west-2"
  
  # 访问凭证 (Access Credentials)
  access_key = var.aws_access_key
  secret_key = var.aws_secret_key
  
  # 默认值 (Default Values)
  default_tags {
    tags = {
      Environment = "production"
      ManagedBy    = "Terraform"
    }
  }
}

# 多云提供商 (Multiple Cloud Providers)
provider "google" {
  project = var.gcp_project_id
  region  = var.gcp_region
}

provider "azurerm" {
  features {}
}

# 变量文件 (variables.tf)
variable "aws_access_key" {
  description = "AWS 访问密钥"
  type        = string
  sensitive   = true
}

variable "aws_secret_key" {
  description = "AWS 秘密密钥"
  type        = string
  sensitive   = true
}

variable "vpc_cidr" {
  description = "VPC CIDR 范围"
  type        = string
  default     = "10.0.0.0/16"
}

variable "environment" {
  description = "环境类型"
  type        = string
  default     = "development"
  
  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "环境必须是 dev、staging 或 production。"
  }
}

# 输出文件 (outputs.tf)
output "vpc_id" {
  description = "创建的 VPC ID"
  value       = aws_vpc.main.id
  sensitive   = false
}

output "public_subnet_ids" {
  description = "公有子网 ID 列表"
  value       = aws_subnet.public[*].id
}

output "instance_public_ips" {
  description = "实例公有 IP 地址"
  value       = {
    for instance in aws_instance.example : instance.id => instance.public_ip
  }
}

# 资源示例 (Resources Examples)

# 虚拟网络 (Virtual Network)
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  
  tags = {
    Name = "${var.environment}-vpc"
  }
}

# 子网 (Subnets)
resource "aws_subnet" "public" {
  count                   = length(var.public_subnet_cidrs)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = var.public_subnet_cidrs[count.index]
  availability_zone       = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true
  
  tags = {
    Name = "${var.environment}-public-${count.index + 1}"
  }
}

# 安全组 (Security Groups)
resource "aws_security_group" "allow_ssh" {
  name        = "${var.environment}-allow-ssh"
  description = "允许 SSH 访问"
  vpc_id      = aws_vpc.main.id
  
  ingress {
    description = "SSH from anywhere"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = {
    Name = "${var.environment}-ssh-sg"
  }
}

# EC2 实例 (EC2 Instances)
resource "aws_instance" "web_server" {
  ami                    = var.ami_id
  instance_type          = var.instance_type
  vpc_security_group_ids = [aws_security_group.allow_ssh.id]
  subnet_id              = aws_subnet.public[0].id
  
  # 存储配置 (Storage Configuration)
  root_block_device {
    volume_size           = var.root_volume_size
    volume_type           = var.root_volume_type
    encrypted            = true
    delete_on_termination = true
  }
  
  tags = {
    Name        = "${var.environment}-web-server"
    Environment = var.environment
    ManagedBy   = "Terraform"
  }
}

# 数据源 (Data Sources)
data "aws_ami" "amazon_linux_2" {
  most_recent = true
  owners      = ["amazon"]
  
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
  
  filter {
    name   = "virtualization_type"
    values = ["hvm"]
  }
}

# 获取可用区 (Get Availability Zones)
data "aws_availability_zones" "available" {
  state = "available"
}

# 远程后端配置 (Remote Backend Configuration)
terraform {
  backend "s3" {
    bucket         = "my-terraform-state-bucket"
    key            = "prod/terraform.tfstate"
    region         = "us-west-2"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"
    
    # 状态锁 (State Locking)
    lock_table = "terraform-state-lock"
    
    # 版本控制 (Versioning)
    versioning = true
    
    # 生命周期管理 (Lifecycle Management)
    lifecycle_rule {
      id      = "clean_old_versions"
      enabled = true
      
      noncurrent_version_expiration {
        days = 90
      }
    }
  }
}

# 资源命名 (Resource Naming)
resource "aws_instance" "web_server_01" {
  # 良好的命名实践
}

# 标签 (Tags)
tags = {
  Name        = "web-server-01"
  Environment = "production"
  Project     = "webapp"
  Owner       = "platform-team"
  CostCenter  = "engineering"
  Backup      = "true"
  Monitor     = "true"
}

# 条件表达式 (Conditional Expressions)
resource "aws_instance" "example" {
  ami           = var.use_latest_ami ? data.aws_ami.amazon_linux_2.id : var.ami_id
  instance_type = var.instance_type != null ? var.instance_type : "t2.micro"
  
  # 动态列表 (Dynamic Blocks)
  dynamic "ebs_block_device" {
    for_each = var.enable_ebs ? {
      "data-volume-01" = {
        device_name = "/dev/sdh"
        volume_size = 20
        volume_type = "gp2"
      }
    } : {}
    
    content {
      device_name = dynamic_block.value.device_name
      volume_size = dynamic_block.value.volume_size
      volume_type = dynamic_block.value.volume_type
    }
  }
}

# 循环 (Loops)
resource "aws_security_group_rule" "allow_ports" {
  for_each = var.allowed_ports
  
  type                     = "ingress"
  from_port                = each.value
  to_port                  = each.value
  protocol                 = "tcp"
  cidr_blocks              = ["10.0.0.0/16"]
  security_group_id        = aws_security_group.example.id
  description             = "Allow port ${each.value}"
}

# 版本控制配置 (Version Control Configuration)
terraform {
  required_version = ">= 1.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
    google = {
      source  = "hashicorp/google"
      version = ">= 4.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.0"
    }
  }
}

# 提供商配置 (Provider Configuration)
provider "aws" {
  alias  = "west"
  region = "us-west-1"
}

provider "aws" {
  alias  = "east"
  region = "us-east-1"
}

# 基础设施验证 (Infrastructure Validation)
resource "null_resource" "validate" {
  provisioner "local-exec" {
    command = "terraform validate"
  }
  
  triggers = {
    timestamp = timestamp()
  }
}

# 安全检查 (Security Checks)
resource "null_resource" "security_check" {
  provisioner "local-exec" {
    command = "aws securityhub get-findings --filters '{"criteria":{"SecurityFindingProviderProperties.Title":{"Value": "Unencrypted S3 Bucket","Comparison": "EQUALS"}}}'"
  }
}

# 成本估算 (Cost Estimation)
resource "null_resource" "cost_estimate" {
  provisioner "local-exec" {
    command = "aws pricing get-products --service-code AmazonEC2 --filters Type=attribute,Key=instanceType,Value=t2.micro"
  }
}

# 多环境架构 (Multi-Environment Architecture)
variable "environment" {
  description = "环境类型"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "环境必须是 dev、staging 或 prod。"
  }
}

# 环境特定配置 (Environment-specific Configuration)
module "network" {
  source = "./modules/network"
  
  # 环境特定输入 (Environment-specific Input)
  vpc_cidr = "10.${var.environment == "dev" ? "0" : var.environment == "staging" ? "1" : "2"}.0.0/16"
  
  # 环境特定标签 (Environment-specific Tags)
  tags = {
    Environment = var.environment
    Tier       = var.environment == "prod" ? "production" : "test"
    Backup     = var.environment == "prod" ? "true" : "false"
  }
}

module "application" {
  source = "./modules/application"
  depends_on = [module.network]
  
  environment = var.environment
  instance_type = var.environment == "prod" ? "t3.medium" : "t2.micro"
}

# GitHub Actions (GitHub Actions Workflow)
name: Terraform CI/CD

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  TF_WORKING_DIRECTORY: ./infrastructure
  TF_REMOTE_BUCKET: "my-terraform-state"
  AWS_REGION: "us-west-2"

jobs:
  terraform-validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: "1.5.0"
      
      - name: Terraform Init
        run: |
          cd $TF_WORKING_DIRECTORY
          terraform init -backend-config="bucket=${{ env.TF_REMOTE_BUCKET }}"
      
      - name: Terraform Validate
        run: |
          cd $TF_WORKING_DIRECTORY
          terraform validate
      
      - name: Terraform Plan
        run: |
          cd $TF_WORKING_DIRECTORY
          terraform plan -out=tfplan
        continue-on-error: false
  
  terraform-apply:
    needs: terraform-validate
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: "1.5.0"
      
      - name: Terraform Init
        run: |
          cd $TF_WORKING_DIRECTORY
          terraform init -backend-config="bucket=${{ env.TF_REMOTE_BUCKET }}"
      
      - name: Terraform Apply
        run: |
          cd $TF_WORKING_DIRECTORY
          terraform apply -auto-approve tfplan
        continue-on-error: false

# Terraform 监控 (Terraform Monitoring)
# CloudWatch 指标 (CloudWatch Metrics)
resource "aws_cloudwatch_metric_alarm" "terraform_state_drift" {
  alarm_name          = "terraform-state-drift"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "2"
  metric_name         = "DriftDetection"
  namespace           = "AWS/Terraform"
  period              = "300"
  statistic           = "Maximum"
  threshold           = "0"
  alarm_description   = "检测到 Terraform 状态漂移"
  
  alarm_actions = [aws_sns_topic.terraform_notifications.arn]
}

# 成本监控 (Cost Monitoring)
resource "aws_cloudwatch_dashboard" "terraform_cost_dashboard" {
  dashboard_name = "terraform-cost-dashboard"
  
  dashboard_body = jsonencode({
    widgets = [
      {
        type   = "metric"
        title  = "Terraform 基础设施成本"
        properties = {
          metrics = [
            ["AWS/Billing", "UnblendedCost", "LinkedAccount", "${var.aws_account_id}", "Service", "AmazonEC2"]
          ]
          period   = 86400
          region   = var.aws_region
          title    = "每日 EC2 成本"
        }
      }
    ]
  })
}

# Terraform 计划比对 (Terraform Plan Comparison)
resource "null_resource" "plan_comparison" {
  provisioner "local-exec" {
    command = <<EOF
      cd ${var.working_directory}
      terraform plan -detailed-exitcode > plan_output.txt
      if [ $? -eq 2 ]; then
        echo "有变更，创建新计划"
        terraform apply -auto-approve
      elif [ $? -eq 1 ]; then
        echo "有错误，需要检查"
        exit 1
      else
        echo "无变更"
      fi
    EOF
  }
}

# Terraform 安全合规 (Terraform Security & Compliance)
# IAM 策略 (IAM Policies)
resource "aws_iam_policy" "terraform_policy" {
  name        = "terraform-execution-policy"
  description = "用于 Terraform 资源的 IAM 策略"
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "ec2:*",
          "s3:*",
          "cloudwatch:*",
          "rds:*",
          "iam:*"
        ]
        Resource = "*"
      }
    ]
  })
}

# 日志记录 (Logging)
resource "aws_cloudwatch_log_group" "terraform_logs" {
  name              = "/aws/terraform/${var.environment}"
  retention_in_days = var.log_retention_days
  
  tags = {
    Environment = var.environment
    ManagedBy   = "Terraform"
  }
}

# 审计日志 (Audit Logs)
resource "aws_cloudtrail" "terraform_audit" {
  name                          = "${var.environment}-terraform-audit"
  s3_bucket_name               = aws_s3_bucket.audit_logs.bucket
  cloud_watch_logs_role_arn    = aws_iam_role.cloudwatch_logs.arn
  cloud_watch_logs_group_arn   = aws_cloudwatch_log_group.terraform_logs.arn
  include_global_service_events = true
  is_multi_region_trail       = true
  enable_log_file_validation   = true
  
  event_selector {
    read_write_type           = "All"
    include_management_events = true
    
    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"]
    }
  }
}

# 多云支持 (Multi-Cloud Support)
provider "aws" {
  alias  = "aws_provider"
  region = var.aws_region
}

provider "google" {
  alias = "gcp_provider"
  project = var.gcp_project_id
  region  = var.gcp_region
}

provider "azurerm" {
  alias = "azure_provider"
  features {}
}

# AWS 资源 (AWS Resources)
resource "aws_instance" "web_server" {
  provider = aws.aws_provider
  
  ami           = var.aws_ami_id
  instance_type = var.instance_type
  
  tags = {
    Provider = "aws"
    Environment = var.environment
  }
}

# Google Cloud 资源 (Google Cloud Resources)
resource "google_compute_instance" "web_server" {
  provider = google.gcp_provider
  
  name         = "web-server"
  machine_type = var.instance_type
  zone         = var.gcp_zone
  
  boot_disk {
    initialize_params {
      image = var.gcp_image
    }
  }
  
  network_interface {
    network = google_compute_network.default.name
  }
  
  tags = ["web-server"]
  
  tags = {
    Provider = "gcp"
    Environment = var.environment
  }
}

# Azure 资源 (Azure Resources)
resource "azurerm_linux_virtual_machine" "web_server" {
  provider = azurerm.azure_provider
  
  name                = "web-server"
  location            = var.azure_location
  resource_group_name = azurerm_resource_group.rg.name
  vm_size             = var.instance_type
  
  admin_username = var.admin_username
  
  admin_ssh_key {
    username   = var.admin_username
    public_key = var.ssh_public_key
  }
  
  source_image_reference {
    publisher = var.azure_publisher
    offer     = var.azure_offer
    sku       = var.azure_sku
    version   = "latest"
  }
  
  tags = {
    Provider = "azure"
    Environment = var.environment
  }
}

resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  
  tags = {
    Name        = "example-instance"
    Environment = "production"
  }
}

variable "instance_type" {
  description = "EC2 实例类型"
  type        = string
  default     = "t2.micro"
}

variable "environment" {
  description = "环境类型"
  type        = string
  default     = "production"
  
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "环境必须是 dev、staging 或 prod。"
  }
}

output "instance_id" {
  description = "EC2 实例 ID"
  value       = aws_instance.example.id
}

output "public_ip" {
  description = "EC2 实例公有 IP"
  value       = aws_instance.example.public_ip
}

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"
  version = "3.0.0"
  
  name = "example-vpc"
  cidr = "10.0.0.0/16"
  
  tags = {
    Environment = "production"
  }
}