Skip to content

Terraform-05: Security group rules, commit hashes, secrets management - #2

Open
slateeho wants to merge 2 commits into
terraform-05from
terraform-hotfix
Open

Terraform-05: Security group rules, commit hashes, secrets management#2
slateeho wants to merge 2 commits into
terraform-05from
terraform-hotfix

Conversation

@slateeho

@slateeho slateeho commented Mar 10, 2026

Copy link
Copy Markdown
Owner

… (Задание 3))

-=-=-=-=-=-=-=--=-=-=-=-=-=-=-
TFLINT
-=-=-=-=-=-=-=--=-=-=-=-=-=-=-

Warning: Missing version constraint for provider "local" in required_providers (terraform_required_providers)

on ansible.tf line 1:
1: resource "local_file" "hosts_ini" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint0for provider "null" in required_providers (terraform_required_providers)

on ansible.tf line 29:
29: resource "null_resource" "nginx_test" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_required_providers.md

Warning: Module source "git::https://github.com/udjin10/yandex_compute_instance.git?ref=main" uses a default branch as ref (main) (terraform_module_pinned_source)

on main.tf line 22:
22: source = "git::https://github.com/udjin10/yandex_compute_instance.git?ref=main"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_module_pinned_source.md

Warning: Module source "git::https://github.com/udjin10/yandex_compute_instance.git?ref=main" uses a default branch as ref (main) (terraform_module_pinned_source)

on main.tf line 46:
46: source = "git::https://github.com/udjin10/yandex_compute_instance.git?ref=main"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_module_pinned_source.md

Warning: Missing version constraint for provider "template" in required_providers (terraform_required_providers)

on main.tf line 70:
70: data "template_file" "cloudinit" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "yandex" in required_providers (terraform_required_providers)

on providers.tf line 3:
3: yandex = {
4: source = "yandex-cloud/yandex"
5: }

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "aws" in required_providers (terraform_required_providers)

on providers.tf line 6:
6: aws = {
7: source = "hashicorp/aws"
8: }

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] variable "s3_backend" is declared but not used (terraform_unused_declarations)

on variables.tf line 50:
50: variable "s3_backend" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_unused_declarations.md

Warning: [Fixable] variable "yc_sync_sa" is declared but not used (terraform_unused_declarations)

on variables.tf line 64:
64: variable "yc_sync_sa" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_unused_declarations.md

-=-=-=-=-=-=-=--=-=-=-=-=-=-=-
CHECKOV
-=-=-=-=-=-=-=--=-=-=-=-=-=-=-

Passed checks: 5, Failed checks: 4, Skipped checks: 0

Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
PASSED for resource: module.db.aws.default
File: /db/provider.tf:17-19
Calling File: /child.tf:24-62
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
PASSED for resource: marketing_vm
File: /main.tf:21-43
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
PASSED for resource: analytics_vm
File: /main.tf:45-67
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag
Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
PASSED for resource: aws.default
File: /providers.tf:44-46
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5
Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
PASSED for resource: module.vpc_dev.aws.default
File: /vpc_dev/provider.tf:17-19
Calling File: /child.tf:14-22
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5
Check: CKV_YC_1: "Ensure security group is assigned to database cluster."
FAILED for resource: module.db.yandex_mdb_mysql_cluster.my_cluster
File: /db/main.tf:1-27
Calling File: /child.tf:24-62

	1  | resource "yandex_mdb_mysql_cluster" "my_cluster" {
	2  |   name        = var.cluster_name
	3  |   environment = var.environment
	4  |   network_id  = var.network_id
	5  |   version     = var.mysql_version
	6  | 
	7  |   resources {
	8  |     resource_preset_id = var.resource_preset_id
	9  |     disk_type_id       = var.disk_type_id
	10 |     disk_size          = var.disk_size
	11 |   }
	12 | 
	13 |   maintenance_window {
	14 |     type = var.maintenance_type
	15 |     day  = var.maintenance_day
	16 |     hour = var.maintenance_hour
	17 |   }
	18 | 
	19 |   dynamic "host" {
	20 |     for_each = var.ha ? toset([0, 1]) : toset([0])
	21 |     content {
	22 |       zone             = host.key == 0 ? "ru-central1-a" : "ru-central1-b"
	23 |       subnet_id        = var.subnet_ids[host.key]
	24 |       assign_public_ip = var.assign_public_ip
	25 |     }
	26 |   }
	27 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
FAILED for resource: marketing_vm
File: /main.tf:21-43
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

	21 | module "marketing_vm" {
	22 |   source         = "git::https://github.com/udjin10/yandex_compute_instance.git?ref=v1.0.0"
	23 |   env_name       = "develop" 
	24 |   network_id     = module.vpc_dev.network_id
	25 |   subnet_zones   = values(module.vpc_dev.subnet_zone)
	26 |   subnet_ids     = values(module.vpc_dev.subnet_ids)
	27 |   instance_name  = "webs"
	28 |   instance_count = 2
	29 |   image_family   = "ubuntu-2204-lts"
	30 |   public_ip      = true
	31 |   preemptible    = true
	32 | 
	33 |   labels = { 
	34 |     owner   = "lao"
	35 |     project = "marketing"
	36 |   }
	37 | 
	38 |   metadata = {
	39 |     user-data          = data.template_file.cloudinit.rendered
	40 |     serial-port-enable = 1
	41 |     ssh-keys           = "ubuntu:${trimspace(file("/home/a/.ato4ka/security/.ssh/id_ed25519.pub"))}"
	42 |   }
	43 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
FAILED for resource: analytics_vm
File: /main.tf:45-67
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

	45 | module "analytics_vm" {
	46 |   source         = "git::https://github.com/udjin10/yandex_compute_instance.git?ref=v1.0.0"
	47 |   env_name       = "stage"
	48 |   network_id     = module.vpc_dev.network_id
	49 |   subnet_zones   = [module.vpc_dev.subnet_zone["vpc_dev_a"]]
	50 |   subnet_ids     = [module.vpc_dev.subnet_ids["vpc_dev_a"]]
	51 |   instance_name  = "web-stage"
	52 |   instance_count = 1
	53 |   image_family   = "ubuntu-2204-lts"
	54 |   public_ip      = true
	55 |   preemptible    = true
	56 | 
	57 |   labels = { 
	58 |     owner   = "lao"
	59 |     project = "analytics"
	60 |   }
	61 | 
	62 |   metadata = {
	63 |     user-data          = data.template_file.cloudinit.rendered
	64 |     serial-port-enable = 1
	65 |     ssh-keys           = "ubuntu:${trimspace(file("/home/a/.ato4ka/security/.ssh/id_ed25519.pub"))}"
	66 |   }
	67 | }

Check: CKV_YC_19: "Ensure security group does not contain allow-all rules."
FAILED for resource: module.vpc_dev.yandex_vpc_security_group.vpc_dev
File: /vpc_dev/main.tf:15-29
Calling File: /child.tf:14-22

	15 | resource "yandex_vpc_security_group" "vpc_dev" {
	16 |   name       = "vpc_${var.env_name}-sg"
	17 |   network_id = yandex_vpc_network.vpc_dev.id
	18 |   folder_id  = var.folder_id
	19 | 
	20 |   ingress {
	21 |     protocol       = "ANY"
	22 |     v4_cidr_blocks = ["0.0.0.0/0"]
	23 |   }
	24 | 
	25 |   egress {
	26 |     protocol       = "ANY"
	27 |     v4_cidr_blocks = ["0.0.0.0/0"]
	28 |   }
	29 | }

secrets scan results:

Passed checks: 0, Failed checks: 3, Skipped checks: 0

Check: CKV_SECRET_6: "Base64 High Entropy String"
FAILED for resource: cbfdac6008f9cab4083784cbd1874f76618d2a97
File: /child.tf:49-50
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

	49 |   user_password          = "pa**********"

Check: CKV_SECRET_13: "Private Key"
FAILED for resource: 519757850eb3bd07e8ac8a77f8fe1f028cbff6a5
File: /key.json:7-8
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-13

	7 |    "private_key": "PLEASE DO NOT REMOVE THIS LINE! Yandex.Cloud SA Key ID \u003cajemub8krrffv75uptd4\u003e\n-----BEGIN PRIVATE KEY-----\nMIIE**********-----END PRIVATE KEY-----\n"

Check: CKV_SECRET_6: "Base64 High Entropy String"
FAILED for resource: da82df2776678da3382161895c981ae6b7d29b87
File: /s3_keys.json:8-9
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

	8 |   "secret": "YCOAtU**********"

-=-=-=-=-=-=-=--=-=-=-=-=-=-=-
CHEKOV PASSED RESULTS
-=-=-=-=-=-=-=--=-=-=-=-=-=-=-

terraform scan results:

Passed checks: 9, Failed checks: 0, Skipped checks: 0

Check: CKV_YC_1: "Ensure security group is assigned to database cluster."
PASSED for resource: module.db.yandex_mdb_mysql_cluster.my_cluster
File: /db/main.tf:1-28
Calling File: /child.tf:24-63
Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
PASSED for resource: module.db.aws.default
File: /db/provider.tf:18-20
Calling File: /child.tf:24-63
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
PASSED for resource: marketing_vm
File: /main.tf:21-43
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
PASSED for resource: marketing_vm
File: /main.tf:21-43
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
PASSED for resource: analytics_vm
File: /main.tf:45-67
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
PASSED for resource: analytics_vm
File: /main.tf:45-67
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag
Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
PASSED for resource: aws.default
File: /providers.tf:27-29
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5
Check: CKV_YC_19: "Ensure security group does not contain allow-all rules."
PASSED for resource: module.vpc_dev.yandex_vpc_security_group.vpc_dev
File: /vpc_dev/main.tf:15-42
Calling File: /child.tf:14-22
Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
PASSED for resource: module.vpc_dev.aws.default
File: /vpc_dev/provider.tf:18-20
Calling File: /child.tf:14-22
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5

-=-=-=-=-=-=-=--=-=-=-=-=-=-=-
Вывод terraform plan
-=-=-=-=-=-=-=--=-=-=-=-=-=-=-

Acquiring state lock. This may take a few moments...
data.template_file.cloudinit: Reading...
data.template_file.cloudinit: Read complete after 0s [id=1caeb352cfe6b97fa946cd0ab8535916a09569ccb695c9bab8cb1aac6e9a0708]
module.vpc_dev.data.aws_ssm_parameter.token: Reading...
module.db.data.aws_ssm_parameter.token: Reading...
data.aws_ssm_parameter.db_password: Reading...
data.aws_ssm_parameter.iam_token: Reading...
module.db.data.aws_ssm_parameter.token: Read complete after 0s [id=/yandex/yc-oauth-token]
data.aws_ssm_parameter.db_password: Read complete after 0s [id=/terraform/db-password]
module.vpc_dev.data.aws_ssm_parameter.token: Read complete after 0s [id=/yandex/yc-oauth-token]
data.aws_ssm_parameter.iam_token: Read complete after 0s [id=/yandex/yc-iam-token]
module.analytics_vm.data.yandex_compute_image.my_image: Reading...
module.marketing_vm.data.yandex_compute_image.my_image: Reading...
module.marketing_vm.data.yandex_compute_image.my_image: Read complete after 1s [id=fd875m9ethhftod6n2vd]
module.analytics_vm.data.yandex_compute_image.my_image: Read complete after 1s [id=fd875m9ethhftod6n2vd]

Terraform used the selected providers to generate the following
execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # local_file.hosts_ini will be created
  + resource "local_file" "hosts_ini" {
      + content              = (known after apply)
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "./ansible/hosts.ini"
      + id                   = (known after apply)
    }

  # null_resource.cloud_init_wait will be created
  + resource "null_resource" "cloud_init_wait" {
      + id = (known after apply)
    }

  # null_resource.nginx_test will be created
  + resource "null_resource" "nginx_test" {
      + id = (known after apply)
    }

  # yandex_vpc_network.develop will be created
  + resource "yandex_vpc_network" "develop" {
      + created_at                = (known after apply)
      + default_security_group_id = (known after apply)
      + folder_id                 = (known after apply)
      + id                        = (known after apply)
      + labels                    = (known after apply)
      + name                      = "develop"
      + subnet_ids                = (known after apply)
    }

  # yandex_vpc_subnet.develop_a will be created
  + resource "yandex_vpc_subnet" "develop_a" {
      + created_at     = (known after apply)
      + folder_id      = (known after apply)
      + id             = (known after apply)
      + labels         = (known after apply)
      + name           = "develop-ru-central1-a"
      + network_id     = (known after apply)
      + v4_cidr_blocks = [
          + "10.0.1.0/24",
        ]
      + v6_cidr_blocks = (known after apply)
      + zone           = "ru-central1-a"
    }

  # yandex_vpc_subnet.develop_b will be created
  + resource "yandex_vpc_subnet" "develop_b" {
      + created_at     = (known after apply)
      + folder_id      = (known after apply)
      + id             = (known after apply)
      + labels         = (known after apply)
      + name           = "develop-ru-central1-b"
      + network_id     = (known after apply)
      + v4_cidr_blocks = [
          + "10.0.3.0/24",
        ]
      + v6_cidr_blocks = (known after apply)
      + zone           = "ru-central1-b"
    }

  # module.analytics_vm.yandex_compute_instance.vm[0] will be created
  + resource "yandex_compute_instance" "vm" {
      + allow_stopping_for_update = true
      + created_at                = (known after apply)
      + description               = "TODO: description; {{terraform yyy managed}}"
      + folder_id                 = (known after apply)
      + fqdn                      = (known after apply)
      + gpu_cluster_id            = (known after apply)
      + hardware_generation       = (known after apply)
      + hostname                  = "stage-web-stage-0"
      + id                        = (known after apply)
      + labels                    = {
          + "owner"   = "lao"
          + "project" = "analytics"
        }
      + maintenance_grace_period  = (known after apply)
      + maintenance_policy        = (known after apply)
      + metadata                  = {
          + "serial-port-enable" = "1"
          + "ssh-keys"           = "ubuntu:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAFH0UNq2IJ/M6veTOwSPxMMou1UmwG+ziruJDlfyStV slateeho@gmail.com"
          + "user-data"          = <<-EOT
                #cloud-config
                ssh_pwauth: no
                users:
                  - name: ubuntu
                    homedir: /home/ubuntu
                    groups: sudo
                    shell: /bin/bash
                    sudo: 'ALL=(ALL) NOPASSWD:ALL'
                    ssh_authorized_keys:
                      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAFH0UNq2IJ/M6veTOwSPxMMou1UmwG+ziruJDlfyStV slateeho@gmail.com
                
                package_update: true
                package_upgrade: true
                
                packages:
                  - nginx
                  - python3
                
                runcmd:
                  - systemctl enable nginx
                  - systemctl start nginx
            EOT
        }
      + name                      = "stage-web-stage-0"
      + network_acceleration_type = "standard"
      + platform_id               = "standard-v1"
      + status                    = (known after apply)
      + zone                      = "ru-central1-a"

      + boot_disk {
          + auto_delete = true
          + device_name = (known after apply)
          + disk_id     = (known after apply)
          + mode        = (known after apply)

          + initialize_params {
              + block_size  = (known after apply)
              + description = (known after apply)
              + image_id    = "fd875m9ethhftod6n2vd"
              + name        = (known after apply)
              + size        = 10
              + snapshot_id = (known after apply)
              + type        = "network-hdd"
            }
        }

      + metadata_options (known after apply)

      + network_interface {
          + index          = (known after apply)
          + ip_address     = (known after apply)
          + ipv4           = true
          + ipv6           = (known after apply)
          + ipv6_address   = (known after apply)
          + mac_address    = (known after apply)
          + nat            = true
          + nat_ip_address = (known after apply)
          + nat_ip_version = (known after apply)
          + subnet_id      = (known after apply)
        }

      + placement_policy (known after apply)

      + resources {
          + core_fraction = 5
          + cores         = 2
          + memory        = 1
        }

      + scheduling_policy {
          + preemptible = true
        }
    }

  # module.db.yandex_mdb_mysql_cluster.my_cluster will be created
  + resource "yandex_mdb_mysql_cluster" "my_cluster" {
      + allow_regeneration_host   = false
      + backup_retain_period_days = (known after apply)
      + created_at                = (known after apply)
      + deletion_protection       = (known after apply)
      + disk_encryption_key_id    = (known after apply)
      + environment               = "PRESTABLE"
      + folder_id                 = (known after apply)
      + health                    = (known after apply)
      + host_group_ids            = (known after apply)
      + id                        = (known after apply)
      + mysql_config              = (known after apply)
      + name                      = "test"
      + network_id                = (known after apply)
      + security_group_ids        = (known after apply)
      + status                    = (known after apply)
      + version                   = "8.0"

      + access (known after apply)

      + backup_window_start (known after apply)

      + disk_size_autoscaling (known after apply)

      + host {
          + assign_public_ip   = false
          + fqdn               = (known after apply)
          + replication_source = (known after apply)
          + subnet_id          = (known after apply)
          + zone               = "ru-central1-a"
        }

      + maintenance_window {
          + day  = "SAT"
          + hour = 12
          + type = "WEEKLY"
        }

      + performance_diagnostics (known after apply)

      + resources {
          + disk_size          = 16
          + disk_type_id       = "network-ssd"
          + resource_preset_id = "s2.micro"
        }
    }

  # module.db.yandex_mdb_mysql_database.my_db will be created
  + resource "yandex_mdb_mysql_database" "my_db" {
      + cluster_id = (known after apply)
      + id         = (known after apply)
      + name       = "test"
    }

  # module.db.yandex_mdb_mysql_user.my_user will be created
  + resource "yandex_mdb_mysql_user" "my_user" {
      + authentication_plugin = "SHA256_PASSWORD"
      + cluster_id            = (known after apply)
      + connection_manager    = (known after apply)
      + generate_password     = false
      + global_permissions    = [
          + "PROCESS",
        ]
      + id                    = (known after apply)
      + name                  = "app"
      + password              = (sensitive value)

      + connection_limits {
          + max_connections_per_hour = 30
          + max_questions_per_hour   = 10
          + max_updates_per_hour     = 20
          + max_user_connections     = 40
        }

      + permission {
          + database_name = "test"
          + roles         = [
              + "ALL",
            ]
        }
    }

  # module.marketing_vm.yandex_compute_instance.vm[0] will be created
  + resource "yandex_compute_instance" "vm" {
      + allow_stopping_for_update = true
      + created_at                = (known after apply)
      + description               = "TODO: description; {{terraform yyy managed}}"
      + folder_id                 = (known after apply)
      + fqdn                      = (known after apply)
      + gpu_cluster_id            = (known after apply)
      + hardware_generation       = (known after apply)
      + hostname                  = "develop-webs-0"
      + id                        = (known after apply)
      + labels                    = {
          + "owner"   = "lao"
          + "project" = "marketing"
        }
      + maintenance_grace_period  = (known after apply)
      + maintenance_policy        = (known after apply)
      + metadata                  = {
          + "serial-port-enable" = "1"
          + "ssh-keys"           = "ubuntu:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAFH0UNq2IJ/M6veTOwSPxMMou1UmwG+ziruJDlfyStV slateeho@gmail.com"
          + "user-data"          = <<-EOT
                #cloud-config
                ssh_pwauth: no
                users:
                  - name: ubuntu
                    homedir: /home/ubuntu
                    groups: sudo
                    shell: /bin/bash
                    sudo: 'ALL=(ALL) NOPASSWD:ALL'
                    ssh_authorized_keys:
                      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAFH0UNq2IJ/M6veTOwSPxMMou1UmwG+ziruJDlfyStV slateeho@gmail.com
                
                package_update: true
                package_upgrade: true
                
                packages:
                  - nginx
                  - python3
                
                runcmd:
                  - systemctl enable nginx
                  - systemctl start nginx
            EOT
        }
      + name                      = "develop-webs-0"
      + network_acceleration_type = "standard"
      + platform_id               = "standard-v1"
      + status                    = (known after apply)
      + zone                      = "ru-central1-a"

      + boot_disk {
          + auto_delete = true
          + device_name = (known after apply)
          + disk_id     = (known after apply)
          + mode        = (known after apply)

          + initialize_params {
              + block_size  = (known after apply)
              + description = (known after apply)
              + image_id    = "fd875m9ethhftod6n2vd"
              + name        = (known after apply)
              + size        = 10
              + snapshot_id = (known after apply)
              + type        = "network-hdd"
            }
        }

      + metadata_options (known after apply)

      + network_interface {
          + index          = (known after apply)
          + ip_address     = (known after apply)
          + ipv4           = true
          + ipv6           = (known after apply)
          + ipv6_address   = (known after apply)
          + mac_address    = (known after apply)
          + nat            = true
          + nat_ip_address = (known after apply)
          + nat_ip_version = (known after apply)
          + subnet_id      = (known after apply)
        }

      + placement_policy (known after apply)

      + resources {
          + core_fraction = 5
          + cores         = 2
          + memory        = 1
        }

      + scheduling_policy {
          + preemptible = true
        }
    }

  # module.marketing_vm.yandex_compute_instance.vm[1] will be created
  + resource "yandex_compute_instance" "vm" {
      + allow_stopping_for_update = true
      + created_at                = (known after apply)
      + description               = "TODO: description; {{terraform yyy managed}}"
      + folder_id                 = (known after apply)
      + fqdn                      = (known after apply)
      + gpu_cluster_id            = (known after apply)
      + hardware_generation       = (known after apply)
      + hostname                  = "develop-webs-1"
      + id                        = (known after apply)
      + labels                    = {
          + "owner"   = "lao"
          + "project" = "marketing"
        }
      + maintenance_grace_period  = (known after apply)
      + maintenance_policy        = (known after apply)
      + metadata                  = {
          + "serial-port-enable" = "1"
          + "ssh-keys"           = "ubuntu:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAFH0UNq2IJ/M6veTOwSPxMMou1UmwG+ziruJDlfyStV slateeho@gmail.com"
          + "user-data"          = <<-EOT
                #cloud-config
                ssh_pwauth: no
                users:
                  - name: ubuntu
                    homedir: /home/ubuntu
                    groups: sudo
                    shell: /bin/bash
                    sudo: 'ALL=(ALL) NOPASSWD:ALL'
                    ssh_authorized_keys:
                      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAFH0UNq2IJ/M6veTOwSPxMMou1UmwG+ziruJDlfyStV slateeho@gmail.com
                
                package_update: true
                package_upgrade: true
                
                packages:
                  - nginx
                  - python3
                
                runcmd:
                  - systemctl enable nginx
                  - systemctl start nginx
            EOT
        }
      + name                      = "develop-webs-1"
      + network_acceleration_type = "standard"
      + platform_id               = "standard-v1"
      + status                    = (known after apply)
      + zone                      = "ru-central1-b"

      + boot_disk {
          + auto_delete = true
          + device_name = (known after apply)
          + disk_id     = (known after apply)
          + mode        = (known after apply)

          + initialize_params {
              + block_size  = (known after apply)
              + description = (known after apply)
              + image_id    = "fd875m9ethhftod6n2vd"
              + name        = (known after apply)
              + size        = 10
              + snapshot_id = (known after apply)
              + type        = "network-hdd"
            }
        }

      + metadata_options (known after apply)

      + network_interface {
          + index          = (known after apply)
          + ip_address     = (known after apply)
          + ipv4           = true
          + ipv6           = (known after apply)
          + ipv6_address   = (known after apply)
          + mac_address    = (known after apply)
          + nat            = true
          + nat_ip_address = (known after apply)
          + nat_ip_version = (known after apply)
          + subnet_id      = (known after apply)
        }

      + placement_policy (known after apply)

      + resources {
          + core_fraction = 5
          + cores         = 2
          + memory        = 1
        }

      + scheduling_policy {
          + preemptible = true
        }
    }

  # module.vpc_dev.yandex_vpc_network.vpc_dev will be created
  + resource "yandex_vpc_network" "vpc_dev" {
      + created_at                = (known after apply)
      + default_security_group_id = (known after apply)
      + folder_id                 = "b1ghqjh9j50gl3bqspbv"
      + id                        = (known after apply)
      + labels                    = (known after apply)
      + name                      = "vpc-develop"
      + subnet_ids                = (known after apply)
    }

  # module.vpc_dev.yandex_vpc_security_group.vpc_dev will be created
  + resource "yandex_vpc_security_group" "vpc_dev" {
      + created_at = (known after apply)
      + folder_id  = "b1ghqjh9j50gl3bqspbv"
      + id         = (known after apply)
      + labels     = (known after apply)
      + name       = "vpc_develop-sg"
      + network_id = (known after apply)
      + status     = (known after apply)

      + egress {
          + from_port         = -1
          + id                = (known after apply)
          + labels            = (known after apply)
          + port              = -1
          + protocol          = "ANY"
          + to_port           = -1
          + v4_cidr_blocks    = [
              + "0.0.0.0/0",
            ]
          + v6_cidr_blocks    = []
            # (3 unchanged attributes hidden)
        }

      + ingress {
          + from_port         = -1
          + id                = (known after apply)
          + labels            = (known after apply)
          + port              = 3306
          + protocol          = "TCP"
          + to_port           = -1
          + v4_cidr_blocks    = [
              + "0.0.0.0/0",
            ]
          + v6_cidr_blocks    = []
            # (3 unchanged attributes hidden)
        }
      + ingress {
          + from_port         = -1
          + id                = (known after apply)
          + labels            = (known after apply)
          + port              = 443
          + protocol          = "TCP"
          + to_port           = -1
          + v4_cidr_blocks    = [
              + "0.0.0.0/0",
            ]
          + v6_cidr_blocks    = []
            # (3 unchanged attributes hidden)
        }
      + ingress {
          + from_port         = -1
          + id                = (known after apply)
          + labels            = (known after apply)
          + port              = 80
          + protocol          = "TCP"
          + to_port           = -1
          + v4_cidr_blocks    = [
              + "0.0.0.0/0",
            ]
          + v6_cidr_blocks    = []
            # (3 unchanged attributes hidden)
        }
    }

  # module.vpc_dev.yandex_vpc_subnet.vpc_dev["vpc_dev_a"] will be created
  + resource "yandex_vpc_subnet" "vpc_dev" {
      + created_at     = (known after apply)
      + folder_id      = "b1ghqjh9j50gl3bqspbv"
      + id             = (known after apply)
      + labels         = (known after apply)
      + name           = "vpc_develop-vpc_dev_a"
      + network_id     = (known after apply)
      + v4_cidr_blocks = [
          + "10.0.1.0/24",
        ]
      + v6_cidr_blocks = (known after apply)
      + zone           = "ru-central1-a"
    }

  # module.vpc_dev.yandex_vpc_subnet.vpc_dev["vpc_dev_b"] will be created
  + resource "yandex_vpc_subnet" "vpc_dev" {
      + created_at     = (known after apply)
      + folder_id      = "b1ghqjh9j50gl3bqspbv"
      + id             = (known after apply)
      + labels         = (known after apply)
      + name           = "vpc_develop-vpc_dev_b"
      + network_id     = (known after apply)
      + v4_cidr_blocks = [
          + "10.0.3.0/24",
        ]
      + v6_cidr_blocks = (known after apply)
      + zone           = "ru-central1-b"
    }

Plan: 16 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + network_id            = (known after apply)
  + network_name          = "vpc-develop"
  + subnet_ids            = {
      + vpc_dev_a = (known after apply)
      + vpc_dev_b = (known after apply)
    }
  + subnet_v4_cidr_blocks = {
      + vpc_dev_a = [
          + "10.0.1.0/24",
        ]
      + vpc_dev_b = [
          + "10.0.3.0/24",
        ]
    }
  + subnet_zone           = {
      + vpc_dev_a = "ru-central1-a"
      + vpc_dev_b = "ru-central1-b"
    }

-=-=-=-=-=-=-=--=-=-=-=-=-=-=-
Изменения terraform plan
-=-=-=-=-=-=-=--=-=-=-=-=-=-=-

 + ingress {
          + from_port         = -1
          + from_port         = -1
          + id                = (known after apply)
          + id                = (known after apply)
          + labels            = (known after apply)
          + labels            = (known after apply)
          + port              = -1
          + port              = 3306
          + protocol          = "ANY"
          + protocol          = "TCP"
          + to_port           = -1
          + v4_cidr_blocks    = [
              + "0.0.0.0/0",
            ]
          + v6_cidr_blocks    = []
            # (3 unchanged attributes hidden)
        }
      + ingress {
          + from_port         = -1
          + id                = (known after apply)
          + labels            = (known after apply)
          + port              = 443
          + protocol          = "TCP"
          + to_port           = -1
          + v4_cidr_blocks    = [
              + "0.0.0.0/0",
           ]
          + v6_cidr_blocks    = []
            # (3 unchanged attributes hidden)
        }
      + ingress {
          + from_port         = -1
          + id                = (known after apply)
          + labels            = (known after apply)
          + port              = 80
          + protocol          = "TCP"

@Jiraiya106

Jiraiya106 commented Mar 17, 2026

Copy link
Copy Markdown

Отлично

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@slateeho @Jiraiya106