状态文件丢了怎么办：Terraform State 灾难恢复与生产级后端架构

{
  "version": 4,
  "terraform_version": "1.9.0",
  "serial": 42,
  "lineage": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "resources": [
    {
      "mode": "managed",
      "type": "aws_instance",
      "name": "web_server",
      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
      "instances": [
        {
          "schema_version": 1,
          "attributes": {
            "id": "i-0abcd1234efgh5678",
            "ami": "ami-0c55b159cbfafe1f0",
            "instance_type": "t3.medium",
            "tags": {
              "Name": "web-server-prod",
              "Environment": "production"
            }
          },
          "dependencies": [
            "aws_security_group.web_sg",
            "aws_subnet.private_a"
          ]
        }
      ]
    }
  ]
}

# backend.tf — 远程状态后端配置

terraform {
  required_version = ">= 1.5.0"

  backend "s3" {
    bucket         = "my-company-terraform-state-prod"
    key            = "prod/network/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-state-lock-prod"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
  }

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# dynamodb.tf — 状态锁表（只需创建一次）

resource "aws_dynamodb_table" "terraform_state_lock" {
  name         = "terraform-state-lock-prod"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }

  point_in_time_recovery {
    enabled = true
  }

  server_side_encryption {
    enabled = true
  }

  tags = {
    Name        = "terraform-state-lock"
    Environment = "production"
    ManagedBy   = "Terraform"
  }
}

resource "aws_s3_bucket" "terraform_state" {
  bucket = "my-company-terraform-state-prod"
  lifecycle { prevent_destroy = true }  # 防止误删
}

resource "aws_s3_bucket_versioning" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id
  versioning_configuration { status = "Enabled" }  # 必须开启
}

resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.terraform_state.arn
    }
  }
}

resource "aws_s3_bucket_public_access_block" "terraform_state" {
  bucket                  = aws_s3_bucket.terraform_state.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

$ terraform apply

Acquiring state lock. This may take a few moments...
Releasing state lock. This may take a few moments...

Error: Error acquiring the state lock

Lock Info:
  ID:        a1b2c3d4-2024-01-15-160523
  Path:      prod/network/terraform.tfstate
  Operation: OperationTypeApply
  Who:       ci-runner@build-server-01
  Created:   2026-07-25 12:30:00.123456789 +0000 UTC
  Info:      

# 强制解锁（确认进程已退出后使用）
terraform force-unlock a1b2c3d4-2024-01-15-160523

# 设置锁超时为 5 分钟（默认无超时）
export TF_LOCK_TIMEOUT=5m

# 在 CI 脚本中自动清理残留锁
terraform plan -lock-timeout=5m

# .gitlab-ci.yml 的 after_script 或 GitHub Actions 的 post 步骤
after_script:
  - |
    # 检查是否有残留锁
    LOCK_INFO=$(terraform show -json 2>/dev/null | grep -o 'LockID.*' || true)
    if [ -n "$LOCK_INFO" ]; then
      echo "Warning: 发现残留锁，正在清理..."
      LOCK_ID=$(echo "$LOCK_INFO" | grep -oE '[a-f0-9-]{36}')
      terraform force-unlock -force "$LOCK_ID"
    fi

# 在 CI/CD 中定期检测漂移（不执行变更）
terraform plan -detailed-exitcode

# exit code:
# 0 = 无变更（无漂移）
# 1 = 执行出错
# 2 = 有变更（检测到漂移）

# .github/workflows/drift-detection.yml
name: Terraform Drift Detection
on:
  schedule:
    - cron: '0 6 * * *'  # 每天早上 6 点检测

jobs:
  drift-detection:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - name: Terraform Init
        run: terraform init
      - name: Check Drift
        run: |
          terraform plan -detailed-exitcode -out=drift.tfplan || EXIT_CODE=$?
          if [ "${EXIT_CODE:-0}" = "2" ]; then
            echo "::warning::检测到配置漂移！"
            terraform show -no-color drift.tfplan
            # 发送告警到钉钉/飞书
            curl -X POST "$DINGTALK_WEBHOOK" \
              -H "Content-Type: application/json" \
              -d "{\"msgtype\":\"text\",\"text\":{\"content\":\"Terraform 配置漂移告警：检测到未通过 IaC 管理的资源变更，请检查\"}}"
            exit 1
          fi          

# 先在代码中定义资源（空配置）
# resource "aws_security_group_rule" "https_ingress" {
#   # 先留空，import 后补充
# }

# 执行导入
terraform import aws_security_group_rule.https_ingress sgr-0abcd1234efgh5678

# 导入后 terraform state show 查看实际配置
terraform state show aws_security_group_rule.https_ingress

# 根据实际配置补全 .tf 文件
# 然后运行 terraform plan 确认无差异
terraform plan

# state 文件的组织结构
prod/
  network/terraform.tfstate      # VPC、子网、路由表
  database/terraform.tfstate     # RDS、ElastiCache
  compute/terraform.tfstate      # EC2、EKS、ALB
  security/terraform.tfstate      # 安全组、IAM、WAF
staging/
  network/terraform.tfstate
  database/terraform.tfstate
  ...

# compute/main.tf — 从 network 模块的 state 文件中读取输出

data "terraform_remote_state" "network" {
  backend = "s3"

  config = {
    bucket = "my-company-terraform-state-prod"
    key    = "prod/network/terraform.tfstate"
    region = "us-east-1"
  }
}

# 使用 network 模块的输出
resource "aws_instance" "app_server" {
  subnet_id = data.terraform_remote_state.network.outputs.private_subnet_a_id
  vpc_id    = data.terraform_remote_state.network.outputs.vpc_id

  tags = {
    Name = "app-server-prod"
  }
}

# 语法
terraform state mv [options] SOURCE DESTINATION

# 示例：把 EC2 实例从旧 state 迁移到新 state
terraform state mv -state-out=terraform.tfstate.backup \
  aws_instance.web_server \
  aws_instance.app_server

# 跨 state 文件迁移（从 network state 迁移到 compute state）
terraform state mv -state=prod/network/terraform.tfstate \
  -state-out=prod/compute/terraform.tfstate \
  aws_instance.web_server \
  aws_instance.web_server

# 步骤1：备份当前 state（必须！）
cp terraform.tfstate terraform.tfstate.backup.$(date +%Y%m%d%H%M%S)

# 步骤2：拉取最新的远程 state
terraform state pull > current_state.json

# 步骤3：查看要迁移的资源
terraform state list | grep web_server

# 步骤4：在目标模块中创建对应的资源定义（空壳）
# target_module/main.tf
# resource "aws_instance" "web_server" {
#   # 先留空，迁移后再补充配置
# }

# 步骤5：执行迁移
terraform state mv \
  -state=source_state/terraform.tfstate \
  -state-out=target_state/terraform.tfstate \
  aws_instance.web_server \
  aws_instance.web_server

# 步骤6：验证迁移结果
terraform state list  # 源 state 中应该没有这个资源了
cd target_module && terraform state list  # 目标 state 中应该有这个资源

# 步骤7：在目标模块中补充资源配置
# 编辑 target_module/main.tf，补全 resource 块

# 步骤8：运行 plan 确认无差异
terraform plan  # 应该显示 "No changes. Your infrastructure matches the configuration."

# 步骤9：推送两个 state 文件到远程后端
terraform state push source_state/terraform.tfstate
cd target_module && terraform state push target_state/terraform.tfstate

# terraform state rm：从 state 中移除资源（不删除云上资源）
# 适用场景：把资源从 Terraform 管理范围中移除，保留云上实际资源
terraform state rm aws_instance.old_server

# terraform import：把已存在的云资源导入到 state 中
# 适用场景：手动创建的资源需要纳入 Terraform 管理
terraform import aws_security_group.web_sg sg-0abcd1234

# 安装 Terraformer
wget https://github.com/GoogleCloudPlatform/terraformer/releases/download/v0.8.24/terraformer-all-linux-amd64
chmod +x terraformer-all-linux-amd64
mv terraformer-all-linux-amd64 /usr/local/bin/terraformer

# 批量导入 AWS 资源
terraformer import aws --regions=us-east-1 --resources=ec2,vpc,security-group

# 导入后会生成 generated/aws/ec2/ 目录，里面有 .tf 和 tfstate 文件

# 查看历史版本
aws s3api list-object-versions \
  --bucket my-company-terraform-state-prod \
  --prefix prod/network/terraform.tfstate \
  --query 'Versions[*].[VersionId,LastModified,IsLatest]' \
  --output table

# 找到被覆盖前的版本，恢复它
aws s3api get-object \
  --bucket my-company-terraform-state-prod \
  --key prod/network/terraform.tfstate \
  --version-id YOUR_VERSION_ID \
  recovered_state.tfstate

# 验证恢复的 state 文件
terraform state pull > current_remote_state.json
diff recovered_state.tfstate current_remote_state.json

# 确认无误后推送回远程
terraform state push recovered_state.tfstate

# 运行 plan，确认 state 和真实资源一致
terraform plan

# 如果 plan 显示大量资源需要"创建"，说明 state 恢复成功但部分资源可能被手动修改
# 如果 plan 显示 "No changes"，说明完全恢复

# 扫描所有 AWS 资源并生成代码和 state
terraformer import aws --regions=us-east-1 --resources=ec2,vpc,rds,elb,security-group,s3,iam

# 检查生成的 state 文件
cat generated/aws/ec2/terraform.tfstate | python3 -m json.tool | head -50

# 手动合并到现有 state（逐个资源 mv）
for resource in $(terraformer plan | grep "will be created" | awk '{print $2}'); do
  terraform state mv -stateout=main.tfstate generated_state $resource
done

# 1. 敏感变量标记为 sensitive
variable "db_password" {
  type      = string
  sensitive = true
}

# 2. 输出标记为 sensitive
output "db_endpoint" {
  value     = aws_db_instance.main.endpoint
  sensitive = true
}

# 3. 从 Secrets Manager 读取密码，不硬编码在 state 中
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/db/master-password"
}

resource "aws_db_instance" "main" {
  password = data.aws_secretsmanager_secret_version.db_password.secret_string
  # 这样 password 不会出现在 state 文件的 attributes 中
}

resource "aws_iam_policy" "terraform_state_access" {
  name = "terraform-state-access"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["s3:GetObject", "s3:PutObject"]
        Resource = "${aws_s3_bucket.terraform_state.arn}/prod/*"
      },
      {
        Effect   = "Allow"
        Action   = ["s3:ListBucket", "s3:GetBucketVersioning"]
        Resource = aws_s3_bucket.terraform_state.arn
      },
      {
        Effect   = "Allow"
        Action   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:DeleteItem"]
        Resource = aws_dynamodb_table.terraform_state_lock.arn
      }
    ]
  })
}

# 创建 workspace
terraform workspace new prod
terraform workspace new staging

# 切换 workspace
terraform workspace select prod

# 在不同 workspace 中 apply，state 文件自动隔离
terraform apply

# 危险写法：dev 和 prod 用同一套代码，靠 workspace 区分
resource "aws_instance" "web" {
  count         = terraform.workspace == "prod" ? 3 : 1
  instance_type = terraform.workspace == "prod" ? "t3.large" : "t3.micro"
}

infrastructure/
  modules/              # 共享模块
    vpc/
    rds/
    eks/
  environments/
    prod/               # 生产环境
      backend.tf        # S3 key = prod/network/terraform.tfstate
      main.tf
      variables.tf
      terraform.tfvars
    staging/            # 预发环境
      backend.tf        # S3 key = staging/network/terraform.tfstate
      main.tf
      variables.tf
      terraform.tfvars
    dev/                # 开发环境
      backend.tf        # S3 key = dev/network/terraform.tfstate
      main.tf
      variables.tf
      terraform.tfvars

# terragrunt.hcl — 环境级别的公共配置
remote_state {
  backend = "s3"
  config = {
    bucket         = "my-company-terraform-state-${get_env("ENV")}"
    key            = "${path_relative_to_include()}/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-state-lock-${get_env("ENV")}"
    encrypt        = true
  }
}

# 公共 provider 配置
generate "provider" {
  path      = "provider.tf"
  if_exists = "overwrite"
  contents  = <<EOF
provider "aws" {
  region = "us-east-1"
  default_tags {
    tags = {
      Environment = "${get_env("ENV")}"
      ManagedBy   = "Terraform"
      Owner        = "SRE"
    }
  }
}
EOF
}

# prod/network/terragrunt.hcl
include {
  path = find_in_parent_folders("env.hcl")
}

terraform {
  source = "../../../modules/vpc"
}

inputs = {
  cidr_block         = "10.0.0.0/16"
  availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
  enable_nat_gateway = true
}