# Terraform EC2 配置示例
resource "aws_instance" "web_server" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"
  
  subnet_id = aws_subnet.public.id
  
  vpc_security_group_ids = [aws_security_group.web.id]
  
  user_data = file("init.sh")
  
  root_block_device {
    volume_type = "gp3"
    volume_size = 50
    encrypted   = true
  }
  
  tags = {
    Name        = "web-server"
    Environment = "prod"
    ManagedBy   = "terraform"
  }
}

# 自动扩缩容配置
resource "aws_autoscaling_group" "web_asg" {
  vpc_zone_identifier = [aws_subnet.public.id]
  
  min_size         = 3
  max_size         = 10
  desired_capacity = 3
  
  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }
  
  tag {
    key                 = "Name"
    value               = "web-asg"
    propagate_at_launch = true
  }
}

# Terraform VPC配置
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = "prod-vpc"
  }
}

# 公有子网（多AZ）
resource "aws_subnet" "public" {
  count = 3
  
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.${count.index + 1}.0.0/24"
  availability_zone       = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true
  
  tags = {
    Name = "public-subnet-${count.index + 1}"
  }
}

# NAT网关（私有子网出向流量）
resource "aws_eip" "nat" {
  domain = "vpc"
}

resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  
  tags = {
    Name = "prod-nat"
  }
}

# 私有子网路由表
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id
  
  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main.id
  }
  
  tags = {
    Name = "private-route-table"
  }
}

# S3桶配置
resource "aws_s3_bucket" "data_bucket" {
  bucket = "prod-data-bucket"
  
  tags = {
    Environment = "prod"
    ManagedBy   = "terraform"
  }
}

# 启用版本控制
resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data_bucket.id
  
  versioning_configuration {
    status = "Enabled"
  }
}

# 生命周期规则
resource "aws_s3_bucket_lifecycle_configuration" "data" {
  bucket = aws_s3_bucket.data_bucket.id
  
  rule {
    id     = "archive-old-data"
    status = "Enabled"
    
    filter {
      prefix = "logs/"
    }
    
    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }
    
    transition {
      days          = 90
      storage_class = "GLACIER"
    }
    
    noncurrent_version_transition {
      noncurrent_days = 30
      storage_class  = "STANDARD_IA"
    }
    
    noncurrent_version_expiration {
      noncurrent_days = 365
    }
  }
}

# 跨区域复制
resource "aws_s3_bucket_replication_configuration" "data" {
  bucket = aws_s3_bucket.data_bucket.id
  
  role = aws_iam_role.replication.arn
  
  rule {
    id     = "replicate-to-dr"
    status = "Enabled"
    
    filter {
      prefix = ""
    }
    
    destination {
      bucket        = "arn:aws:s3:::dr-data-bucket"
      storage_class = "STANDARD"
    }
  }
}

# EBS卷配置
resource "aws_ebs_volume" "data" {
  availability_zone = "ap-northeast-1a"
  size              = 100
  type              = "gp3"
  encrypted         = true
  
  tags = {
    Name = "data-volume"
  }
}

# 挂载到EC2
resource "aws_volume_attachment" "data_att" {
  device_name = "/dev/sdf"
  volume_id   = aws_ebs_volume.data.id
  instance_id = aws_instance.web_server.id
}

# RDS Multi-AZ配置
resource "aws_db_instance" "prod_db" {
  identifier           = "prod-mysql"
  engine               = "mysql"
  engine_version        = "8.0"
  instance_class        = "db.t3.medium"
  
  allocated_storage     = 100
  max_allocated_storage = 500
  storage_type          = "gp3"
  storage_encrypted     = true
  
  db_name  = "proddb"
  username = "admin"
  password = data.aws_secretsmanager_secret_version.db_password.secret_string
  
  multi_az               = true
  db_subnet_group_name   = aws_db_subnet_group.prod.name
  vpc_security_group_ids = [aws_security_group.rds.id]
  
  backup_retention_period = 7
  backup_window          = "03:00-04:00"
  maintenance_window      = "mon:04:00-mon:05:00"
  
  enabled_cloudwatch_logs_exports = ["error", "general", "slowquery"]
  
  parameters = {
    max_connections = "500"
    wait_timeout    = "300"
  }
  
  tags = {
    Environment = "prod"
  }
}

# 只读副本
resource "aws_db_instance" "read_replica" {
  identifier           = "prod-db-replica"
  source_db_instance   = aws_db_instance.prod_db.id
  instance_class       = "db.t3.medium"
  publicly_accessible  = false
  
  replica_mode = "opened-replicas"
}

# ElastiCache Redis集群
resource "aws_elasticache_replication_group" "prod_redis" {
  replication_group_id       = "prod-redis"
  replication_group_description = "Production Redis Cluster"
  
  engine               = "redis"
  engine_version       = "7.0"
  node_type            = "cache.r6g.large"
  number_cache_clusters = 3
  
  automatic_failover_enabled = true
  multi_az_enabled          = true
  
  at_rest_encryption_enabled = true
  transit_encryption_enabled = true
  auth_token_enabled         = true
  
  snapshot_retention_limit   = 7
  snapshot_window           = "03:00-05:00"
  
  maintenance_window = "mon:05:00-mon:07:00"
  
  log_delivery_configuration {
    destination      = aws_cloudwatch_log_group.redis_slow.name
    destination_type = "cloudwatch-logs"
    log_format      = "json"
    log_type        = "slow-log"
  }
}

# Terraform模块化结构
# main.tf
terraform {
  required_version = ">= 1.5.0"
  
  backend "s3" {
    bucket = "tf-state-prod"
    key    = "prod/main.tfstate"
    region = "ap-northeast-1"
    encrypt = true
  }
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# 变量定义
variable "environment" {
  type    = string
  default = "prod"
}

# 输出定义
output "cluster_endpoint" {
  value       = aws_eks_cluster.main.endpoint
  description = "EKS集群端点"
}

# IAM角色和策略
resource "aws_iam_role" "eks_node_role" {
  name = "eks-node-role"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "ec2.amazonaws.com"
      }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "eks_node_cni" {
  role       = aws_iam_role.eks_node_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
}

resource "aws_iam_role_policy_attachment" "eks_node_worker" {
  role       = aws_iam_role.eks_node_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
}