Workspace使用のローカル管理Terraform StateファイルをS3に移行してみる(backend-configオプションパターン)

├── data.tf
├── envs
│   ├── dev
│   │   └── terraform.tfvars
│   ├── prod
│   │   └── terraform.tfvars
│   └── test
│       └── terraform.tfvars
├── locals.tf
├── main.tf
├── outputs.tf
├── providers.tf
├── README.md
├── terraform.tfvars
├── variables.tf
└── versions.tf

$ terraform workspace select dev #dev環境に切り替え
$ terraform plan -var-file=envs/dev/terraform.tfvars 　#dev環境に対してplan
$ terraform apply -var-file=envs/dev/terraform.tfvars 　#dev環境に対してapply
$ tree terraform.tfstate.d # Stateファイルの保存場所                       
terraform.tfstate.d
├── dev
│   └── terraform.tfstate
└── prod
    └── terraform.tfstate

AWSTemplateFormatVersion: "2010-09-09"
Description: S3 & DynamoDB for Terraform Backend

Parameters:
  Name:
    Description: |
      Name of the S3 bucket, DynamoDB table;
      Defaults to "terraform-state-AWS_ACCOUNT_ID"
    Default: ""
    Type: String

Conditions:
  GenerateNames: !Equals [!Ref Name, ""]

Resources:
#------------------------------------------------------------------------------#
# S3
#------------------------------------------------------------------------------#
  StateBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !If
      - GenerateNames
      - !Sub "terraform-state-${AWS::AccountId}"
      - !Ref Name
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: "AES256"
#------------------------------------------------------------------------------#
# DynamoDB
#------------------------------------------------------------------------------#
  LockTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref StateBucket
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      AttributeDefinitions:
        - AttributeName: "LockID"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "LockID"
          KeyType: "HASH"

bucket         = <CloudFormaitonで作成したS3バケット名> # デフォルト: terraform-state-AWS_ACCOUNT_ID
region         = "ap-northeast-1"
key            = "<システム名>/terraform.tfstate"
dynamodb_table = <CloudFormaitonで作成したDynamoDBテーブル名> # デフォルト: terraform-state-AWS_ACCOUNT_ID

$ cp -r terraform.tfstate.d terraform.tfstate.d.bk

$ rm -rf terraform.tfstate.d/ # 削除
$ terraform workspace list # 削除の確認・defaultだけ表示されればOK                        
* default

terraform {
  required_version = "~> 1.9.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.67.0"
    }
  }
  backend "s3" {} # 追加
}

$ cp ./terraform.tfstate.d.bk/<環境名>/terraform.tfstate .

$ terraform init -backend-config="envs/<環境名>/terraform.tfbackend"

Initializing the backend...
╷
│ Error: Backend configuration changed
│ 
│ A change in the backend configuration has been detected, which may require migrating existing
│ state.
│ 
│ If you wish to attempt automatic migration of the state, use "terraform init -migrate-state".
│ If you wish to store the current configuration with no changes to the state, use "terraform init
│ -reconfigure".

$ terraform init -backend-config="envs/<環境名>/terraform.tfbackend" -reconfigure

$ rm -rf terraform.tfstate.d.bk

$ terraform workspace select prod # workspace prodを設定
$ terraform init -backend-config="envs/prod/terraform.tfbackend" # s3バックエンドへの移行

Initializing the backend...
Do you want to migrate all workspaces to "s3"?
  Both the existing "local" backend and the newly configured "s3" backend
  support workspaces. When migrating between backends, Terraform will copy
  all workspaces (with the same names). THIS WILL OVERWRITE any conflicting
  states in the destination.

  Terraform initialization doesn't currently migrate only select workspaces.
  If you want to migrate a select number of workspaces, you must manually
  pull and push those states.

  If you answer "yes", Terraform will migrate all states. If you answer
  "no", Terraform will abort.

  Enter a value: 

#　実行前
$ aws s3 ls --recursive <バックエンド用S3バケット> # S3バケットの中身は空
# 実行後
$ aws s3 ls --recursive <バックエンド用S3バケット>
2024-10-07 16:28:49    1.5 KiB env:/dev/prod/terraform.tfstate
2024-10-07 16:28:51    1.5 KiB env:/prod/prod/terraform.tfstate

env:
├── dev
│   └── prod
│       └── terraform.tfstate
└── prod
    └── prod
        └── terraform.tfstate