Code

# 完全な名前を使用。ただしidのように半ば固有名詞として使われているものは可
variable "security_group_id" {
  type        = string
  description = "Security Group ID"
}

# このような略し方はNG
variable "sg_id" {
  type        = string
  description = "Security Group ID"
}

resource "aws_security_group" "web" {
  name        = "${var.environment}-${var.project}-web-sg"
  description = "Webサーバー用セキュリティグループ"
  vpc_id      = var.vpc_id
}

resource "aws_security_group_rule" "web_https_ingress" {
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.web.id
}

resource "aws_security_group_rule" "web_egress" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.web.id
}

# 開発環境と本番環境でCPUサイズが異なる場合のみ変数化
variable "cpu_size" {
  type        = number
  description = "ECS task CPU size"
}

resource "aws_ecs_task_definition" "main" {
  family = "api"
  cpu    = var.cpu_size  # 環境により 512 または 2048
  memory = 1024

  # その他の固定値は直接記述
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
}

# main.tf
module "networking" {
  source = "./modules/networking"
  vpc_cidr = var.vpc_cidr
}

module "database" {
  source = "./modules/database"
  vpc_id = module.networking.vpc_id
  db_subnet_ids = module.networking.private_subnet_ids
}

module "application" {
  source = "./modules/application"
  vpc_id = module.networking.vpc_id
  db_endpoint = module.database.endpoint
}

variable "bandwidth_limit_mb" {
  type        = number
  description = "Bandwidth limit in MB per second"
}

variable "enable_external_access" {
  type        = bool
  description = "Enable external access to the resource"
}

variable "name" {
  description = "Resource name"
  type = string
}

output "name" {
  description = "Name of Resource"
  value       = var.name
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t4g.micro"  # 固定値を直接記述

  tags = {
    Name = "web-server"
  }
}

# providers.tf
provider "aws" {
  region = "ap-northeast-1"

  default_tags {
    tags = {
      Environment = var.environment
      Service     = var.service
    }
  }
}

# main.tf - 個別リソースでは共通タグを定義しない
resource "aws_s3_bucket" "main" {
  bucket = "${var.environment}-${var.service}-data"
  # Environment、Serviceタグは自動的に付与される
}

# 全環境で同じ値は直接記述
resource "aws_ecs_task_definition" "main" {
  family                   = "api"
  network_mode             = "awsvpc"  # 全環境で同じ
  requires_compatibilities = ["FARGATE"]  # 全環境で同じ

  # 環境ごとに異なる値のみ変数化
  cpu    = var.cpu_size
  memory = var.memory_size
}

# variables.tf
variable "cpu_units" {
  type        = number
  description = "CPU units for ECS task"
}

# 良い例: 単数形を使用
resource "aws_instance" "web_server" {
  count         = 3
  instance_type = "t3.micro"
  ami           = var.ami_id
}

# 良い例: リソースタイプを重複させない
resource "aws_instance" "web_server" {
  instance_type = "t3.micro"
  ami           = var.ami_id
}

resource "aws_security_group" "api" {
  name   = "${var.environment}-${var.project}-api"
  vpc_id = aws_vpc.main.id
}

resource "aws_instance" "web" {
  # 1. メタ引数
  count = var.instance_count

  # 2. 非ブロックパラメータ
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t4g.micro"
  subnet_id     = aws_subnet.main.id

  # 3. ブロックパラメータ
  tags = {
    Name = "web-server-${count.index}"
  }

  # 4. lifecycle
  lifecycle {
    create_before_destroy = true
  }

  # 5. depends_on
  depends_on = [aws_security_group.web]
}

# modules/database/main.tf
# データベースの役割に応じて命名
resource "aws_db_instance" "primary" {
  identifier     = "${var.environment}-${var.project}-primary"
  engine         = "postgres"
  instance_class = "db.t3.medium"
}

resource "aws_db_instance" "read_replica" {
  identifier          = "${var.environment}-${var.project}-replica"
  replicate_source_db = aws_db_instance.primary.id
  instance_class      = "db.t3.small"
}

# modules/vpc/main.tf
# VPCリソースが一つだけの場合は main と命名
resource "aws_vpc" "main" {
  cidr_block           = var.cidr_block
  enable_dns_hostnames = true
  enable_dns_support   = true
}

# ストレージには2進数（GiB/MiB）を使用
variable "ebs_volume_size_gib" {
  type        = number
  description = "EBS volume size in GiB"
}

# それ以外は10進単位を使用
variable "cw_alarm_network_out_threshold_mb" {
  type        = number
  description = "CloudWatch Alarm threshold for NetworkOut in MB"
}

# production/providers.tf（ルートモジュールで定義）
terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

# 良い例
resource "aws_s3_bucket_lifecycle_configuration" "logs" {
  bucket = aws_s3_bucket.logs.id

  rule {
    id     = "delete_old_logs"
    status = "Enabled"

    # 監査要件により90日間保持
    expiration {
      days = 90
    }
  }
}

# 悪い例（参考）
# resource "aws_s3_bucket" "logs" {  # <- S3バケットを作成
#   bucket = "${var.environment}-${var.project}-logs"  # <- バケット名を設定
# }

# variables.tf
variable "environment" {
  type        = string
  description = "Environment name (e.g., production, staging)"
}

variable "vpc_cidr" {
  type        = string
  description = "CIDR block for VPC"
}

variable "enable_nat_gateway" {
  type        = bool
  description = "Whether to create NAT Gateway for private subnets"
}

variable "instance_type" {
  type        = string
  description = "EC2インスタンスタイプ"
  default     = "t3.micro"

  validation {
    condition     = can(regex("^t3\\.", var.instance_type))
    error_message = "インスタンスタイプはt3系を指定してください"
  }
}

variable "db_password" {
  type        = string
  description = "データベースパスワード"
  sensitive   = true
}

# variables.tf
variable "environment" {
  type        = string
  description = "Environment name"
}

variable "instance_count" {
  type        = number
  description = "Number of instances to create"
}

# variables.tf (良い例)
variable "instance_type" {
  type        = string
  description = "EC2 instance type"
  # defaultは設定しない
}

# variables.tf
variable "instance_type" {
  type        = string
  description = "EC2 instance type for application servers"
}

# リソース名にスネークケースを使用
resource "aws_instance" "web_server" {
  instance_type = "t3.micro"
  ami           = var.ami_id
}

# ディレクトリ構造
#
# terraform/
#   production/
#     main.tf
#     variables.tf
#     terraform.tfvars.json    # ← ここに配置
#   modules/
#     networking/
#       main.tf
#       variables.tf
#       # terraform.tfvars.json は配置しない

# terraform.tfvars.json（良い例）
{
  "environment": "production",
  "project": "myapp",
  "region": "ap-northeast-1",
  "db_password": "encrypted_password_here",
  "ssl_certificate_private_key": "encrypted_key_here"
}

# variables.tf
variable "environment" {
  type        = string
  description = "Environment name"
}

variable "project" {
  type        = string
  description = "Project name"
}

variable "db_password" {
  type        = string
  sensitive   = true
  description = "Database password"
}

# main.tf
module "database" {
  source = "../modules/database"

  environment = var.environment
  project     = var.project
  password    = var.db_password
}

module "networking" {
  source = "../modules/networking"

  environment = var.environment
  project     = var.project
}

resource "aws_instance" "api" {
  tags = {
    Name = "${var.environment}-${var.project}-api"
  }
}

# locals.tf
locals {
  # 複数の変数を組み合わせた共通タグ
  common_tags = {
    Environment = var.environment
    Project     = var.project
  }

  # 計算が必要な値
  common_prefix = "${var.environment}-${var.project}-"
}

# 使用するリソースの直前にdataブロックを配置
data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]  # Canonical

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
  }
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"
}

resource "aws_instance" "api" {
  ami           = "ami-12345678"
  instance_type = "t3.micro"

  tags = {
    Name = "${var.environment}-${var.project}-api"
  }
}

# 良い例: 最小限のコメント、自己文書化されたコード
variable "instance_type" {
  type        = string
  description = "EC2インスタンスタイプ。本番環境ではt3.mediumを推奨"
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type

  # セキュリティ要件により、IMDSv2を強制
  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "required"
  }
}