Terraform integration example-Cloud Config(CloudConfig)-阿里云帮助中心

Terraform is an open-source tool for provisioning and managing cloud infrastructure safely and efficiently. You can use Terraform to manage Cloud Config resources. This topic explains how to use Terraform to create a Cloud Config delivery channel.

Note

You can run the sample code in this topic with a single click: Run with a single click

Prerequisites

An Alibaba Cloud account has full permissions on all resources. Leaked credentials for an Alibaba Cloud account pose a significant security risk. We recommend that you use a RAM user and create an AccessKey pair for the RAM user. For more information, see Create a RAM user and Create an AccessKey.

Grant the AliyunConfigFullAccess permission to the RAM user to manage Cloud Config resources. For more information, see Grant permissions to a RAM user.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "config:*"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "config.aliyuncs.com"
                }
            }
        }
    ]
}

Set up a Terraform runtime environment. You can use Terraform in one of the following ways:

Use Terraform in Terraform Explorer: Alibaba Cloud provides an online environment for running Terraform. This method is ideal for quickly trying out and debugging Terraform at no cost.

Use Terraform to quickly create resources: Terraform components are pre-installed and identity credentials are pre-configured in Alibaba Cloud Shell. You can directly run Terraform commands in Cloud Shell. This is ideal for scenarios that require low-cost, fast, and convenient access to and use of Terraform.

Install and configure Terraform in your on-premises environment: This method is ideal if you have a poor network connection or require a custom development environment.

Important

Ensure your Terraform version is v0.12.28 or later. To check the version, run the terraform --version command.

Resources used

alicloud_config_delivery: Creates a delivery channel.

Create a delivery channel with Terraform

This example shows you how to create a delivery channel.

Create a working directory and create a configuration file named main.tf in the directory. This file is the main Terraform file that defines the resources to deploy.

variable "region" {
  default = "cn-heyuan"
}
provider "alicloud" {
  region = var.region
}
variable "name" {
  default = "tf-example-sls"
}
variable "description" {
  default = "terraform-example"
}
# Obtain the ID of the current account.
data "alicloud_account" "this" {}
# Obtain region information.
data "alicloud_regions" "this" {
  current = true
}
# Generate a random integer.
resource "random_integer" "default" {
  max = 99999
  min = 10000
}
#  Create an SLS project.
resource "alicloud_log_project" "default" {
  # Description
  description  = var.description
  # Name
  project_name = "${var.name}-${random_integer.default.result}"
}
# Create an SLS Logstore.
resource "alicloud_log_store" "default" {
  # Name
  logstore_name    = var.name
  # (Optional, ForceNew, Available since v1.215.0) The name of the project to which the Logstore belongs.
  project_name = alicloud_log_project.default.project_name
  # (Optional, ForceNew, Computed, Integer) The number of shards in the Logstore. Default value: 2.
  shard_count           = 2
  # (Optional) Specifies whether to automatically split shards. Default value: false.
  auto_split            = true
  # (Optional, Integer) The maximum number of shards for automatic splitting. The value ranges from 1 to 256.
  max_split_shard_count = 60
  # (Optional, Computed) Specifies whether to automatically append log metadata, such as the log receiving time and client IP address. Default value: true.
  append_meta           = true
  # (Optional, Computed, Integer) The data retention period in days. Valid values: 1 to 3650.
  retention_period      = 30
}
# Create a delivery channel.
resource "alicloud_config_delivery" "default" {
  # (Optional) Specifies whether the destination receives resource change logs.
  configuration_item_change_notification = true
  # (Optional) Specifies whether the destination receives non-compliance events.
  non_compliant_notification             = true
  # (Optional) The name of the delivery channel.
  delivery_channel_name                  = var.name
  # (Required) The ARN of the delivery destination.
  delivery_channel_target_arn            = "acs:log:${data.alicloud_regions.this.ids.0}:${data.alicloud_account.this.id}:project/${alicloud_log_project.default.project_name}/logstore/${alicloud_log_store.default.logstore_name}"
  # (Required, ForceNew) The type of the delivery channel.
  delivery_channel_type                  = "SLS"
  # Description
  description                            = var.description
  # The status of the delivery channel. Valid values: 0 (Disabled) and 1 (Enabled).
  status                                 = 1
}

Run the following command to initialize Terraform:

terraform init

A successful initialization produces the following output:

Initializing the backend...

Initializing provider plugins...
- Finding latest version of hashicorp/alicloud...
- Installing hashicorp/alicloud v1.234.0...
- Installed hashicorp/alicloud v1.234.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Create an execution plan and preview the changes.
```
terraform plan
```

Run the following command to create the delivery channel:

terraform apply

When prompted, enter yes and press Enter. The following output confirms that the delivery channel has been created.

Plan: 4 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

random_integer.default: Creating...
random_integer.default: Creation complete after 0s [id=5****]
alicloud_log_project.default: Creating...
alicloud_log_project.default: Creation complete after 0s [id=tf-example-sls-5****]
alicloud_log_store.default: Creating...
alicloud_log_store.default: Creation complete after 0s [id=tf-example-sls-54000:tf-examp****]
alicloud_config_delivery.default: Creating...
alicloud_config_delivery.default: Creation complete after 1s [id=cdc-fd984fbef2bc0099****]

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Verify the result.
Terraform show command

Run the following command to view the details of the resources created by Terraform:
```
terraform show
```
Log on to the Cloud Config console

After Terraform creates the resources, you can use OpenAPI, an SDK, or the Cloud Config console to verify that the operation was successful.

Clean up resources

When you no longer need the resources managed by Terraform, run the following command to destroy them. For more information about the terraform destroy command, see Common commands.

terraform destroy

Complete example

Note

You can run the sample code in this topic with a single click: Run with a single click

Sample code

variable "region" {
  default = "cn-heyuan"
}
provider "alicloud" {
  region = var.region
}
variable "name" {
  default = "tf-example-sls"
}
variable "description" {
  default = "terraform-example"
}
# Obtain the ID of the current account.
data "alicloud_account" "this" {}
# Obtain region information.
data "alicloud_regions" "this" {
  current = true
}
# Generate a random integer.
resource "random_integer" "default" {
  max = 99999
  min = 10000
}
#  Create an SLS project.
resource "alicloud_log_project" "default" {
  # Description
  description  = var.description
  # Name
  project_name = "${var.name}-${random_integer.default.result}"
}
# Create an SLS Logstore.
resource "alicloud_log_store" "default" {
  # Name
  logstore_name    = var.name
  # (Optional, ForceNew, Available since v1.215.0) The name of the project to which the Logstore belongs.
  project_name = alicloud_log_project.default.project_name
  # (Optional, ForceNew, Computed, Integer) The number of shards in the Logstore. Default value: 2.
  shard_count           = 2
  # (Optional) Specifies whether to automatically split shards. Default value: false.
  auto_split            = true
  # (Optional, Integer) The maximum number of shards for automatic splitting. The value ranges from 1 to 256.
  max_split_shard_count = 60
  # (Optional, Computed) Specifies whether to automatically append log metadata, such as the log receiving time and client IP address. Default value: true.
  append_meta           = true
  # (Optional, Computed, Integer) The data retention period in days. Valid values: 1 to 3650.
  retention_period      = 30
}
# Create a delivery channel.
resource "alicloud_config_delivery" "default" {
  # (Optional) Specifies whether the destination receives resource change logs.
  configuration_item_change_notification = true
  # (Optional) Specifies whether the destination receives non-compliance events.
  non_compliant_notification             = true
  # (Optional) The name of the delivery channel.
  delivery_channel_name                  = var.name
  # (Required) The ARN of the delivery destination.
  delivery_channel_target_arn            = "acs:log:${data.alicloud_regions.this.ids.0}:${data.alicloud_account.this.id}:project/${alicloud_log_project.default.project_name}/logstore/${alicloud_log_store.default.logstore_name}"
  # (Required, ForceNew) The type of the delivery channel.
  delivery_channel_type                  = "SLS"
  # Description
  description                            = var.description
  # The status of the delivery channel. Valid values: 0 (Disabled) and 1 (Enabled).
  status                                 = 1
}

For more complete examples, see the folder for this product in More complete samples.