인프라 구축기 (2) - Terraform을 활용한 VPC 구성

인프라 구축기

인프라 구축기 (1)에서 프로젝트에서 사용할 인프라 아키텍처와 어떤 용도로 사용하는지 정리하였다. 이제 구성한 인프라를 Terraform으로 관리하기 위해 간단한 공부를 진행하고, 프로젝트에 적용하기 위한 코드를 작성해 볼 것이다.

[AWS] 인프라 구축기 (1) - 개요, 아키텍처 소개

Terraform 설치 및 기본 사용법

Terraform 설치 방법과 사용되는 자주 쓰이는 명령어는 아래에 정리하였다.

• Terraform 설치 방법 (Windows)
• Terraform 개념과 자주 쓰이는 명령어

IAM Access key 발급

• Terraform을 활용하기 위해 IAM Access Key 생성 (IAM 사용자 -> 보안 자격 증명 -> 액세스 키)
• 이후 aws configure 명령어를 활용해 계정 등록 후 Terraform 사용

Terraform 코드 작성 - VPC

Terraform은 공식 문서에 사용법이 자세히 나와있기 때문에 해당 내용을 많이 참고하였고, 직접적인 사용법에 대해서는 아래 자료들을 참고하였다.

• 참고했던 페이지
  • Terraform으로 리소스 생성
  • [Terraform] 7 ~ 10강 VPC

vpc.tf

• VPC 생성
  • region : ap-northeast-2 (서울)
  • CIDR Block : 10.0.0.0/16

# VPC
resource "aws_vpc" "popboard" {
  cidr_block                       = "10.0.0.0/16"
  assign_generated_ipv6_cidr_block = "false"
  instance_tenancy                 = "default"

  tags = {
    Name = "popboard-vpc"
  }
}

subnet.tf

• VPC의 subnet 구성
  • ap-northeast-2a
    • public : 10.0.0.0/20
    • private : 10.0.16.0/20, 10.0.32.0/20
  • ap-northeast-2b
    
    • private : 10.0.48.0/20, 10.0.64.0/20
      
  • ap-northeast-2c
    • public : 10.0.80.0/20
      
    • private : 10.0.112.0/20, 10.0.128.0/20, 10.0.144.0/20

# ap-northeast-2a
resource "aws_subnet" "public_subnet_2a_1" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.0.0/20"

  availability_zone = "ap-northeast-2a"

  tags = {
    Name = "popboard-2a-public-subnet-1"
  }
}
resource "aws_subnet" "private_subnet_2a_1" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.16.0/20"

  availability_zone = "ap-northeast-2a"

  tags = {
    Name = "popboard-2a-private-subnet-1"
  }
}
resource "aws_subnet" "private_subnet_2a_2" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.32.0/20"

  availability_zone = "ap-northeast-2a"

  tags = {
    Name = "popboard-2a-private-subnet-2"
  }
}

# ap-northeast-2b
resource "aws_subnet" "private_subnet_2b_1" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.48.0/20"

  availability_zone = "ap-northeast-2b"

  tags = {
    Name = "popboard-2b-private-subnet-1"
  }
}
resource "aws_subnet" "private_subnet_2b_2" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.64.0/20"

  availability_zone = "ap-northeast-2b"

  tags = {
    Name = "popboard-2b-private-subnet-2"
  }
}

# ap-northeast-2c
resource "aws_subnet" "public_subnet_2c_1" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.80.0/20"

  availability_zone = "ap-northeast-2c"

  tags = {
    Name = "popboard-2c-public-subnet-1"
  }
}
resource "aws_subnet" "private_subnet_2c_1" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.112.0/20"

  availability_zone = "ap-northeast-2c"

  tags = {
    Name = "popboard-2c-private-subnet-1"
  }
}
resource "aws_subnet" "private_subnet_2c_2" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.128.0/20"

  availability_zone = "ap-northeast-2c"

  tags = {
    Name = "popboard-2c-private-subnet-2"
  }
}
resource "aws_subnet" "private_subnet_2c_3" {
  vpc_id     = aws_vpc.popboard.id
  cidr_block = "10.0.144.0/20"

  availability_zone = "ap-northeast-2c"

  tags = {
    Name = "popboard-2c-private-subnet-3"
  }
}

internet_gateway_tf

• internet gateway 생성

# internet gateway
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.popboard.id

  tags = {
    Name = "popboard-internet-gateway"
  }
}

route_table.tf

• route table 생성 및 subnet 연결
  • route_table_for_public
    • public subnet끼리 같은 라우팅 테이블 및 internet gateway와 연결
    • subnet : public_subnet_2a_1(10.0.0.0/20), public_subnet_2c_1(10.0.80.0/20)
      
  • route_table_for_private_not_use_nat_gateway
    • NAT gateway를 사용하지 않는 private subnet끼리 같은 라우팅 테이블과 연결
    • subnet :  private_subnet_2a_1(10.0.16.0/20), private_subnet_2a_2(10.0.32.0/20)
      
    • subnet :  private_subnet_2b_1(10.0.48.0/20), private_subnet_2b_2(10.0.64.0/20)
      
    • subnet : private_subnet_2c_1(10.0.112.0/20), private_subnet_2c_2(10.0.128.0/20)
      
  • route_table_for_private_use_nat_gateway
    • NAT gateway를 사용하는 private subnet을 하나의 라우팅 테이블과 연결
    • subnet : private_subnet_2c_3(10.0.144.0/20)

# route table for public subnet
resource "aws_route_table" "route_table_for_public" {
  depends_on = [aws_internet_gateway.igw]
  vpc_id = aws_vpc.popboard.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
  tags = {
    Name = "popboard-route-table-for-public"
  }
}
resource "aws_route_table_association" "route_table_association_1" {
  subnet_id      = aws_subnet.public_subnet_2a_1.id
  route_table_id = aws_route_table.route_table_for_public.id
}
resource "aws_route_table_association" "route_table_association_2" {
  subnet_id      = aws_subnet.public_subnet_2c_1.id
  route_table_id = aws_route_table.route_table_for_public.id
}

# route table for private subnet (not use nat gateway)
resource "aws_route_table" "route_table_for_private_not_use_nat_gateway" {
  vpc_id = aws_vpc.popboard.id

  tags = {
    Name = "popboard-route-table-for-private-not-use-nat-gateway"
  }
}
resource "aws_route_table_association" "route_table_association_3" {
  subnet_id      = aws_subnet.private_subnet_2a_1.id
  route_table_id = aws_route_table.route_table_for_private_not_use_nat_gateway.id
}
resource "aws_route_table_association" "route_table_association_4" {
  subnet_id      = aws_subnet.private_subnet_2a_2.id
  route_table_id = aws_route_table.route_table_for_private_not_use_nat_gateway.id
}
resource "aws_route_table_association" "route_table_association_5" {
  subnet_id      = aws_subnet.private_subnet_2b_1.id
  route_table_id = aws_route_table.route_table_for_private_not_use_nat_gateway.id
}
resource "aws_route_table_association" "route_table_association_6" {
  subnet_id      = aws_subnet.private_subnet_2b_2.id
  route_table_id = aws_route_table.route_table_for_private_not_use_nat_gateway.id
}
resource "aws_route_table_association" "route_table_association_7" {
  subnet_id      = aws_subnet.private_subnet_2c_1.id
  route_table_id = aws_route_table.route_table_for_private_not_use_nat_gateway.id
}
resource "aws_route_table_association" "route_table_association_8" {
  subnet_id      = aws_subnet.private_subnet_2c_2.id
  route_table_id = aws_route_table.route_table_for_private_not_use_nat_gateway.id
}

# route table for private subnet (use nat gateway)
resource "aws_route_table" "route_table_for_private_use_nat_gateway" {
  vpc_id = aws_vpc.popboard.id

  tags = {
    Name = "popboard-route-table-for-private-use-nat-gateway"
  }
}
resource "aws_route_table_association" "route_table_association_9" {
  subnet_id      = aws_subnet.private_subnet_2c_3.id
  route_table_id = aws_route_table.route_table_for_private_use_nat_gateway.id
}

nat_gateway.tf

• elastic IP 및 NAT gateway 생성
  • 외부 인터넷 접근이 필요한 private subnet의 AZ(ap-northeast-2c)의 public subnet에 NAT gateway 생성
  • NAT gateway가 존재하는 위치는 ap-northeast-2c의 public subnet
  • subnet : private_subnet_2c_3(10.0.144.0/20)

# elastic IP
resource "aws_eip" "nat_eip" {
  domain = "vpc"

  tags = {
    Name = "popboard-nat-eip"
  }
}

# NAT gateway
resource "aws_nat_gateway" "nat_gateway" {
  depends_on = [aws_eip.nat_eip]
  allocation_id = aws_eip.nat_eip.id
  subnet_id     = aws_subnet.public_subnet_2c_1.id

  tags = {
    Name = "popboard-nat-gateway"
  }
}

resource "aws_route" "private_nat" {
  route_table_id         = aws_route_table.route_table_for_private_use_nat_gateway.id
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.nat_gateway.id
}

s3_endpoint.ft

• s3 endpoint 생성 : 위에서 생성한 3개의 라우팅 테이블과 연결

# s3 endpoint
resource "aws_vpc_endpoint" "s3_endpoint" {
  vpc_id            = aws_vpc.popboard.id
  service_name      = "com.amazonaws.ap-northeast-2.s3"
  vpc_endpoint_type = "Gateway"

  route_table_ids = [
    aws_route_table.route_table_for_public.id,
    aws_route_table.route_table_for_private_not_use_nat_gateway.id,
    aws_route_table.route_table_for_private_use_nat_gateway.id
  ]

  tags = {
    Name = "popboard-s3-endpoint"
  }
}

실행 결과

• 작업 내용
  • VPC 생성 및 9개의 subnet 생성
  • 3개의 route table 생성
  • internet gateway, nat gateway, s3 endpoint 생성
  • 각 역할에 맞는 route table과 gateway 연결

public

private not using nat gateway

private using nat gateway

Reference

https://developer.hashicorp.com/terraform/intro