have the installation guide<\/a>. I’m using windows, so I’ll be using chocolatey.<\/p>\n\n\n\nC:\\WINDOWS\\system32>choco install terraform\r\nChocolatey v0.10.15\r\nInstalling the following packages:\r\nterraform\r\nBy installing you accept licenses for the packages.\r\nProgress: Downloading terraform 1.0.2... 100%\n...\n The install of terraform was successful.\r\n Software installed to 'C:\\ProgramData\\chocolatey\\lib\\terraform\\tools'\r\n\r\nChocolatey installed 1\/1 packages.\r\n See the log for details (C:\\ProgramData\\chocolatey\\logs\\chocolatey.log).<\/code><\/pre>\n\n\n\nIn order to be safe with regards to security, I will also be creating a credentials file to log into AWS. Create a file in your home .aws\/<\/code> directory (for windows that will be usually c:\/Users\/${your_name}\/.aws<\/code>) called credentials<\/code>. In that file, put your access and secret keys from AWS in this format:<\/p>\n\n\n\n$ cat credentials\r\n[default]\r\naws_access_key_id = AKIASXXXXXXXXXMSHFU\r\naws_secret_access_key = XXXXXXXXXXC8Yi\r\n\r<\/code><\/pre>\n\n\n\nCreate the Terraform Configuration<\/h2>\n\n\n\n Now navigate back to your project directory and let’s start a new branch<\/p>\n\n\n\n
$ git checkout -b terraform-local\r\nSwitched to a new branch 'terraform-local'\r<\/code><\/pre>\n\n\n\nCreate a directory called \/tf<\/code> off the root of the project and create a file called variables.tf<\/code> with this content<\/p>\n\n\n\nvariable \"aws_region\" {\r\n default = \"us-east-1\"\r\n}\r\nvariable \"app-name\" {\r\n default = \"helloWorld-lambda\"\r\n}\r\n<\/code><\/pre>\n\n\n\nNext, create another file called main.tf<\/code> with this content<\/p>\n\n\n\nprovider \"aws\" {\r\n region = \"${var.aws_region}\"\r\n shared_credentials_file = \"\/Users\/${your_name}<\/span>\/.aws\/credentials\"\r\n}\r\n\r\n\r\n#Assume the role needed to create the lambda\r\nresource \"aws_iam_role\" \"iam_for_helloWorld_lambda\" {\r\n name = \"iam_for_helloWorld_lambda\"\r\n\r\n assume_role_policy = <<EOF\r\n{\r\n \"Version\": \"2012-10-17\",\r\n \"Statement\": [\r\n {\r\n \"Action\": \"sts:AssumeRole\",\r\n \"Principal\": {\r\n \"Service\": \"lambda.amazonaws.com\"\r\n },\r\n \"Effect\": \"Allow\",\r\n \"Sid\": \"\"\r\n }\r\n ]\r\n}\r\nEOF\r\n}\r\n\r\n#create the lambda from the code in the s3 bucket. Make sure that all of the policies are in place before\r\n#we attempt to create this\r\nresource \"aws_lambda_function\" \"tf-helloWorld\" {\r\n function_name = \"helloWorld-lambda\"\r\n filename = \"..\/target\/helloworld-lambda-0.0.1-SNAPSHOT-aws.jar\"\r\n role = aws_iam_role.iam_for_helloWorld_lambda.arn\r\n handler = \"org.springframework.cloud.function.adapter.aws.SpringBootApiGatewayRequestHandler::handleRequest\"\r\n memory_size = 512\r\n timeout = 15\r\n\r\n runtime = \"java11\"\r\n\r\n depends_on = [\r\n aws_iam_role_policy_attachment.helloWorld-log-attach,\r\n aws_cloudwatch_log_group.helloWorld-logs,\r\n ]\r\n\r\n environment {\r\n variables = {\r\n FUNCTION_NAME = \"apiFunction\"\r\n }\r\n }\r\n}\r\n\r\n#create a log group for the lambda\r\nresource \"aws_cloudwatch_log_group\" \"helloWorld-logs\" {\r\n name = \"\/aws\/lambda\/${var.app-name}\"\r\n\r\n retention_in_days = 30\r\n}\r\n\r\n#create a policy to be able to write the logs\r\nresource \"aws_iam_policy\" \"helloWorld-logs\" {\r\n name = \"helloWorld_lambda_logging\"\r\n path = \"\/\"\r\n description = \"IAM policy for logging from a lambda\"\r\n\r\n policy = <<EOF\r\n{\r\n \"Version\": \"2012-10-17\",\r\n \"Statement\": [\r\n {\r\n \"Action\": [\r\n \"logs:CreateLogGroup\",\r\n \"logs:CreateLogStream\",\r\n \"logs:PutLogEvents\"\r\n ],\r\n \"Resource\": \"arn:aws:logs:*:*:*\",\r\n \"Effect\": \"Allow\"\r\n }\r\n ]\r\n}\r\nEOF\r\n}\r\n\r\n#associate the log policy privileges to the lambda iam\r\nresource \"aws_iam_role_policy_attachment\" \"helloWorld-log-attach\" {\r\n role = aws_iam_role.iam_for_helloWorld_lambda.name\r\n policy_arn = aws_iam_policy.helloWorld-logs.arn\r\n}\r\n\r\n# Now, we need an API to expose those functions publicly\r\nresource \"aws_apigatewayv2_api\" \"helloWorld-api\" {\r\n name = \"Hello API\"\r\n protocol_type = \"HTTP\"\r\n target = aws_lambda_function.tf-helloWorld.invoke_arn\r\n}\r\n\r\nresource \"aws_lambda_permission\" \"helloWorld-permission\" {\r\n action = \"lambda:InvokeFunction\"\r\n function_name = aws_lambda_function.tf-helloWorld.arn\r\n principal = \"apigateway.amazonaws.com\"\r\n\r\n source_arn = \"${aws_apigatewayv2_api.helloWorld-api.execution_arn}\/*\/*\"\r\n}<\/code><\/pre>\n\n\n\nThere’s a lot here, but I’ll walk you through what each clause is doing:<\/p>\n\n\n\n
provider<\/code><\/strong> : tells terraform that we’re going to be using AWS commands, so download and install the AWS provider libraries that are needed, also configures our credentials<\/p>\n\n\n\naws_iam_role<\/code><\/strong> : grant access to the lambda functions (create, in our case) to our script<\/p>\n\n\n\naws_lambda_function<\/code><\/strong> : this is the lambda create statement. Note that we’re pulling from the local file system. Also, the depends_on<\/code> which tells terraform to go ahead and execute those clauses first (its declarative, doesn’t execute from top down). This should look familiar because of the manual install we did before.<\/p>\n\n\n\naws_cloudwatch_log_group<\/code><\/strong> : we’re going to do some logging, so create a place to store them<\/p>\n\n\n\nresource \"aws_iam_policy\" \"helloWorld-logs\"<\/code><\/strong> : define access to write to the logs<\/p>\n\n\n\nresource \"aws_iam_role_policy_attachment\" \"helloWorld-log-attach\"<\/code><\/strong> : give permission for the lambda to use the policy we just created (so it can write)<\/p>\n\n\n\naws_apigatewayv2_api<\/code><\/strong> : define an API Gateway instance<\/p>\n\n\n\naws_lambda_permission<\/code><\/strong> : give permission to the API Gateway to trigger the lambda<\/p>\n\n\n\nThat’s a lot of stuff! AWS console is doing a bunch of this stuff behind the scenes for you, but pulling it out into terraform means that you can evolve it (and we will in this course) in a safe way with version control. <\/p>\n\n\n\n
Initialize and Execute Terraform<\/h2>\n\n\n\n Now we need to tell Terraform to get ready to execute our code. Terraform needs to pull in the libraries that we’re going to use (AWS provider) and prepare to execute. From the \/tf<\/code> directory execute this command:<\/p>\n\n\n\n$ terraform init\r\n\r\nInitializing the backend...\r\n\r\nInitializing provider plugins...\r\n- Finding latest version of hashicorp\/aws...\r\n- Installing hashicorp\/aws v3.51.0...\r\n- Installed hashicorp\/aws v3.51.0 (signed by HashiCorp)\r\n...\nTerraform has been successfully initialized!<\/code><\/pre>\n\n\n\nIf at this point you execute terraform plan, you’ll see what terraform plans to execute:<\/p>\n\n\n\n
$ terraform plan\r\n\r\nTerraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:\r\n + create\r\n\r\nTerraform will perform the following actions:\r\n\r\n # aws_apigatewayv2_api.helloWorld-api will be created\r\n + resource \"aws_apigatewayv2_api\" \"helloWorld-api\" {\r\n...\nPlan: 7 to add, 0 to change, 0 to destroy.<\/code><\/pre>\n\n\n\nLets go ahead and execute it<\/p>\n\n\n\n
$ terraform apply\n...\naws_cloudwatch_log_group.helloWorld-logs: Creating...\r\naws_iam_policy.helloWorld-logs: Creating...\r\naws_iam_role.iam_for_helloWorld_lambda: Creating...\r\naws_iam_policy.helloWorld-logs: Creation complete after 1s [id=arn:aws:iam::282457041796:policy\/helloWorld_lambda_logging]\r\naws_cloudwatch_log_group.helloWorld-logs: Creation complete after 1s [id=\/aws\/lambda\/helloWorld]\r\naws_iam_role.iam_for_helloWorld_lambda: Creation complete after 1s [id=iam_for_helloWorld_lambda]\r\naws_iam_role_policy_attachment.helloWorld-log-attach: Creating...\r\naws_iam_role_policy_attachment.helloWorld-log-attach: Creation complete after 1s [id=iam_for_helloWorld_lambda-20210724164455618400000001]\r\naws_lambda_function.tf-helloWorld: Creating...\r\naws_lambda_function.tf-helloWorld: Still creating... [10s elapsed]\r\naws_lambda_function.tf-helloWorld: Still creating... [20s elapsed]\r\naws_lambda_function.tf-helloWorld: Still creating... [30s elapsed]\r\naws_lambda_function.tf-helloWorld: Still creating... [40s elapsed]\r\naws_lambda_function.tf-helloWorld: Creation complete after 49s [id=helloWorld-lambda]\r\naws_apigatewayv2_api.helloWorld-api: Creating...\r\naws_apigatewayv2_api.helloWorld-api: Creation complete after 1s [id=m812gnu7x9]\r\naws_lambda_permission.helloWorld-permission: Creating...\r\naws_lambda_permission.helloWorld-permission: Creation complete after 0s [id=terraform-20210724164545966500000002]\r\n\r\nApply complete! Resources: 7 added, 0 changed, 0 destroyed.\r<\/code><\/pre>\n\n\n\nNow lets checkout the lambda page in the console and see if we’ve got a new lambda<\/p>\n\n\n\nNow lets grab the API from the lambda trigger<\/p>\n\n\n\nIf we paste that into our postman, we can see it respond with success:<\/p>\n\n\n\nTerraform State<\/h2>\n\n\n\n If you review the directory structure in \/tf<\/code> now you should see some interesting stuff:<\/p>\n\n\n\nthe provider registry is similar to maven repository, its a local copy of all of the providers that you needed to execute (terraform init<\/code> created this)<\/p>\n\n\n\nAlso, you’ll see two files terraform.tfstate<\/code> and .terraform.lock.hcl<\/code>. These files are created by terraform apply<\/code> to track the current state of the system you’ve created. Any modifications will be reviewed against the state before being applied and only the changes will be made. Additionally, this lock file prevents other users from wiping out your changes. <\/p>\n\n\n\nwe can see this in action by executing terraform plan<\/code> again:<\/p>\n\n\n\n$ terraform plan\n...\nNo changes. Your infrastructure matches the configuration.<\/code><\/pre>\n\n\n\nWhile this is nice, its not going to help us out when we want to deploy in an automated fashion because our pipeline will create its own terraform state which will conflict with our local version. In the next step in the course we’ll see how to make a ‘central’ state and lock file in the cloud so that everyone can be executing against the same plan.<\/p>\n\n\n\n
For now, lets blow away our application<\/p>\n\n\n\n
$ terraform destroy\n...\naws_lambda_permission.helloWorld-permission: Destroying... [id=terraform-20210724164545966500000002]\naws_lambda_permission.helloWorld-permission: Destruction complete after 1s\naws_apigatewayv2_api.helloWorld-api: Destroying... [id=m812gnu7x9]\naws_apigatewayv2_api.helloWorld-api: Destruction complete after 1s\naws_lambda_function.tf-helloWorld: Destroying... [id=helloWorld-lambda]\naws_lambda_function.tf-helloWorld: Destruction complete after 0s\naws_iam_role_policy_attachment.helloWorld-log-attach: Destroying... [id=iam_for_helloWorld_lambda-20210724164455618400000001]\naws_cloudwatch_log_group.helloWorld-logs: Destroying... [id=\/aws\/lambda\/helloWorld]\naws_iam_role_policy_attachment.helloWorld-log-attach: Destruction complete after 0s\naws_cloudwatch_log_group.helloWorld-logs: Destruction complete after 0s\naws_iam_policy.helloWorld-logs: Destroying... [id=arn:aws:iam::282457041796:policy\/helloWorld_lambda_logging]\naws_iam_role.iam_for_helloWorld_lambda: Destroying... [id=iam_for_helloWorld_lambda]\naws_iam_policy.helloWorld-logs: Destruction complete after 1s\naws_iam_role.iam_for_helloWorld_lambda: Destruction complete after 1s\n\nDestroy complete! Resources: 7 destroyed.<\/code><\/pre>\n\n\n\nwe also do not want to check in our state files, so update our .gitignore<\/code> to ignore them (from here<\/a>)<\/p>\n\n\n\n# Local .terraform directories\r\n**\/.terraform\/*\r\n\r\n# .tfstate files\r\n*.tfstate\r\n*.tfstate.*\r\n*.terraform.lock.*\r\n\r\n# Crash log files\r\ncrash.log\r\n\r\n# Exclude all .tfvars files, which are likely to contain sentitive data, such as\r\n# password, private keys, and other secrets. These should not be part of version\r\n# control as they are data points which are potentially sensitive and subject\r\n# to change depending on the environment.\r\n#\r\n*.tfvars\r\n\r\n# Ignore override files as they are usually used to override resources locally and so\r\n# are not checked in\r\noverride.tf\r\noverride.tf.json\r\n*_override.tf\r\n*_override.tf.json\r\n\r\n# Include override files you do wish to add to version control using negated pattern\r\n#\r\n# !example_override.tf\r\n\r\n# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan\r\n# example: *tfplan*\r\n\r\n# Ignore CLI configuration files\r\n.terraformrc\r\nterraform.rc<\/code><\/pre>\n\n\n\n
![\"\"](\"https:\/\/i0.wp.com\/bullyrooks.com\/wp-content\/uploads\/2021\/07\/image-18-1024x46.png?resize=960%2C43&ssl=1\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/bullyrooks.com\/wp-content\/uploads\/2021\/07\/image-19-1024x590.png?resize=960%2C553&ssl=1\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/bullyrooks.com\/wp-content\/uploads\/2021\/07\/image-21-1024x288.png?resize=960%2C270&ssl=1\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/bullyrooks.com\/wp-content\/uploads\/2021\/07\/image-22.png?resize=415%2C260&ssl=1\")
<\/figure>\n\n\n\n