從映像管理到 FaaS 的雲端運算實踐

resource "aws_security_group" "lambda_sg" {
  name        = "lambda-security-group"
  description = "Security group for Lambda functions"
  vpc_id      = aws_vpc.main.id

  # 允許出站流量
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_lambda_function" "example_function" {
  function_name = "example-function"
  role          = aws_iam_role.lambda_role.arn
  handler       = "index.handler"
  runtime       = "nodejs14.x"
  filename      = "function.zip"
  
  vpc_config {
    subnet_ids         = aws_subnet.private.*.id
    security_group_ids = [aws_security_group.lambda_sg.id]
  }
}

resource "aws_iam_role_policy" "lambda_dynamodb_policy" {
  name = "lambda-dynamodb-policy"
  role = aws_iam_role.lambda_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "dynamodb:GetItem",
          "dynamodb:PutItem",
          "dynamodb:UpdateItem",
          "dynamodb:DeleteItem",
          "dynamodb:Query",
          "dynamodb:Scan"
        ]
        Effect   = "Allow"
        Resource = aws_dynamodb_table.example_table.arn
      }
    ]
  })
}

resource "aws_dynamodb_table" "example_table" {
  name           = "example-table"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "id"
  
  attribute {
    name = "id"
    type = "S"
  }
}

# GitLab CI/CD 管道範例
stages:
  - build
  - test
  - deploy

build:
  stage: build
  script:
    - npm install
    - npm run build
    - zip -r function.zip .

test:
  stage: test
  script:
    - npm test
    - terraform init
    - terraform plan -var-file=test.tfvars

deploy:
  stage: deploy
  script:
    - terraform init
    - terraform apply -var-file=prod.tfvars -auto-approve
  only:
    - main

# modules/lambda/main.tf
variable "function_name" {}
variable "handler" {}
variable "runtime" {}
variable "source_dir" {}
variable "environment_variables" {
  default = {}
}

resource "aws_lambda_function" "function" {
  function_name = var.function_name
  handler       = var.handler
  runtime       = var.runtime
  
  filename         = data.archive_file.lambda_zip.output_path
  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
  
  role = aws_iam_role.lambda_role.arn
  
  environment {
    variables = var.environment_variables
  }
}

data "archive_file" "lambda_zip" {
  type        = "zip"
  source_dir  = var.source_dir
  output_path = "${path.module}/files/${var.function_name}.zip"
}

# 主專案中使用模組
module "order_processor" {
  source        = "./modules/lambda"
  function_name = "order-processor"
  handler       = "index.handler"
  runtime       = "nodejs14.x"
  source_dir    = "${path.module}/functions/order-processor"
  environment_variables = {
    TABLE_NAME = aws_dynamodb_table.orders.name
  }
}

# 為每個函式建立單獨的執行角色
resource "aws_iam_role" "function_specific_role" {
  name = "${var.function_name}-role"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "lambda.amazonaws.com"
      }
    }]
  })
}

# 僅授予必要的最小許可權
resource "aws_iam_role_policy" "function_specific_policy" {
  name = "${var.function_name}-policy"
  role = aws_iam_role.function_specific_role.id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Effect   = "Allow"
        Resource = "arn:aws:logs:*:*:*"
      },
      {
        Action = var.required_actions
        Effect = "Allow"
        Resource = var.resource_arns
      }
    ]
  })
}

resource "aws_lambda_function" "optimized_function" {
  function_name = "optimized-function"
  handler       = "index.handler"
  runtime       = "nodejs14.x"
  filename      = "function.zip"
  
  # 根據函式需求調整記憶體
  memory_size = 256
  
  # 設定合理的超時
  timeout = 10
  
  # 使用佈建平行性減少冷啟動
  provisioned_concurrency = 5
  
  # 設定環境變數
  environment {
    variables = {
      NODE_OPTIONS = "--enable-source-maps"
      STAGE = "production"
    }
  }
}

# 設定CloudWatch日誌組和指標過濾器
resource "aws_cloudwatch_log_group" "function_logs" {
  name              = "/aws/lambda/${aws_lambda_function.function.function_name}"
  retention_in_days = 14
}

resource "aws_cloudwatch_log_metric_filter" "error_metric" {
  name           = "${aws_lambda_function.function.function_name}-errors"
  pattern        = "ERROR"
  log_group_name = aws_cloudwatch_log_group.function_logs.name
  
  metric_transformation {
    name      = "${aws_lambda_function.function.function_name}-error-count"
    namespace = "CustomLambdaMetrics"
    value     = "1"
  }
}

# 設定警示
resource "aws_cloudwatch_metric_alarm" "function_error_alarm" {
  alarm_name          = "${aws_lambda_function.function.function_name}-error-alarm"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "${aws_lambda_function.function.function_name}-error-count"
  namespace           = "CustomLambdaMetrics"
  period              = 60
  statistic           = "Sum"
  threshold           = 5
  alarm_description   = "This alarm monitors for errors in the Lambda function"
  alarm_actions       = [aws_sns_topic.alarm_topic.arn]
}

# 分享網路模組定義
# modules/networking/main.tf
variable "vpc_cidr" {
  description = "CIDR block for the VPC"
  type        = string
}

resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr
  tags = {
    Name = "main-vpc"
  }
}

resource "aws_subnet" "public" {
  vpc_id     = aws_vpc.main.id
  cidr_block = cidrsubnet(var.vpc_cidr, 8, 1)
  tags = {
    Name = "public-subnet"
  }
}

resource "aws_subnet" "private" {
  vpc_id     = aws_vpc.main.id
  cidr_block = cidrsubnet(var.vpc_cidr, 8, 2)
  tags = {
    Name = "private-subnet"
  }
}

output "vpc_id" {
  value = aws_vpc.main.id
}

output "public_subnet_id" {
  value = aws_subnet.public.id
}

output "private_subnet_id" {
  value = aws_subnet.private.id
}

# 在堆積積疊A中使用網路模組
# stacks/stack_a/main.tf
module "network" {
  source   = "../../modules/networking"
  vpc_cidr = "10.0.0.0/16"
}

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  subnet_id     = module.network.public_subnet_id
  
  tags = {
    Name = "stack-a-web-server"
  }
}

# 在堆積積疊B中使用相同的網路模組
# stacks/stack_b/main.tf
module "network" {
  source   = "../../modules/networking"
  vpc_cidr = "10.1.0.0/16"
}

resource "aws_instance" "app" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.medium"
  subnet_id     = module.network.private_subnet_id
  
  tags = {
    Name = "stack-b-app-server"
  }
}

# 模組測試範例 - 使用Terratest
package test

import (
  "testing"
  "github.com/gruntwork-io/terratest/modules/terraform"
  "github.com/stretchr/testify/assert"
)

func TestNetworkingModule(t *testing.T) {
  terraformOptions := &terraform.Options{
    TerraformDir: "../modules/networking",
    Vars: map[string]interface{}{
      "vpc_cidr": "10.10.0.0/16",
    },
  }
  
  defer terraform.Destroy(t, terraformOptions)
  terraform.InitAndApply(t, terraformOptions)
  
  vpcId := terraform.Output(t, terraformOptions, "vpc_id")
  publicSubnetId := terraform.Output(t, terraformOptions, "public_subnet_id")
  privateSubnetId := terraform.Output(t, terraformOptions, "private_subnet_id")
  
  assert.NotEmpty(t, vpcId)
  assert.NotEmpty(t, publicSubnetId)
  assert.NotEmpty(t, privateSubnetId)
}

# 團隊A負責的網路基礎設施
# team_a/networking/main.tf
module "vpc" {
  source = "terraform-aws-modules/vpc/aws"
  
  name = "team-a-vpc"
  cidr = "10.0.0.0/16"
  
  azs             = ["us-west-2a", "us-west-2b"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
  
  enable_nat_gateway = true
  single_nat_gateway = true
  
  tags = {
    Owner = "team-a"
    Environment = "production"
  }
}

# 團隊B負責的應用基礎設施
# team_b/application/main.tf
data "terraform_remote_state" "network" {
  backend = "s3"
  config = {
    bucket = "terraform-state"
    key    = "team-a/networking/terraform.tfstate"
    region = "us-west-2"
  }
}

resource "aws_security_group" "app" {
  name        = "application"
  description = "Allow application traffic"
  vpc_id      = data.terraform_remote_state.network.outputs.vpc_id
  
  # 安全規則...
  
  tags = {
    Owner = "team-b"
    Environment = "production"
  }
}

resource "aws_instance" "app" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.medium"
  subnet_id     = data.terraform_remote_state.network.outputs.private_subnets[0]
  security_groups = [aws_security_group.app.id]
  
  tags = {
    Name = "application-server"
    Owner = "team-b"
    Environment = "production"
  }
}

# 定義清晰介面的資料函式庫模組
# modules/database/main.tf
variable "identifier" {
  description = "Database identifier"
  type        = string
}

variable "allocated_storage" {
  description = "Allocated storage in GB"
  type        = number
  default     = 20
}

variable "engine" {
  description = "Database engine"
  type        = string
  default     = "postgres"
}

variable "engine_version" {
  description = "Database engine version"
  type        = string
  default     = "12.4"
}

variable "instance_class" {
  description = "Database instance class"
  type        = string
  default     = "db.t3.micro"
}

variable "username" {
  description = "Master username"
  type        = string
  sensitive   = true
}

variable "password" {
  description = "Master password"
  type        = string
  sensitive   = true
}

resource "aws_db_instance" "this" {
  identifier           = var.identifier
  allocated_storage    = var.allocated_storage
  engine               = var.engine
  engine_version       = var.engine_version
  instance_class       = var.instance_class
  username             = var.username
  password             = var.password
  skip_final_snapshot  = true
  
  # 許多其他設定選項在內部處理，不暴露給模組使用者
  backup_retention_period = 7
  backup_window           = "03:00-04:00"
  maintenance_window      = "mon:04:00-mon:05:00"
  multi_az                = true
  storage_encrypted       = true
  
  tags = {
    Name = var.identifier
  }
}

output "endpoint" {
  description = "Database connection endpoint"
  value       = aws_db_instance.this.endpoint
}

output "port" {
  description = "Database port"
  value       = aws_db_instance.this.port
}

output "name" {
  description = "Database name"
  value       = aws_db_instance.this.name
}

# 在專案中使用版本化模組
module "database" {
  source  = "terraform-aws-modules/rds/aws"
  version = "3.4.0"  # 明確指定版本
  
  identifier = "my-database"
  
  engine            = "mysql"
  engine_version    = "8.0.23"
  instance_class    = "db.t3.large"
  allocated_storage = 50
  
  name     = "mydb"
  username = var.db_username
  password = var.db_password
  port     = "3306"
  
  maintenance_window = "Mon:00:00-Mon:03:00"
  backup_window      = "03:00-06:00"
  
  tags = {
    Environment = "production"
    Project     = "my-project"
  }
}