# 環境ごとの設定を変数で管理
variable "environment" {
  type = string
}

locals {
  instance_type = {
    dev  = "t3.micro"
    stg  = "t3.small"
    prod = "t3.large"
  }
}

resource "aws_instance" "app" {
  instance_type = local.instance_type[var.environment]
  # 環境に応じて自動的に適切なサイズが選択される
}

# 宣言的：「何が」欲しいかを記述
resource "aws_instance" "web" {
  instance_type = "t3.micro"
  count         = 1
  
  # タグで識別
  tags = {
    Name = "WebServer"
  }
}

# 何度実行しても結果は同じ（冪等性）
# - 存在しなければ作成
# - 存在すれば何もしない
# - 設定が違えば修正

# terraform.tfstate - 現在の状態を記録
{
  "version": 4,
  "terraform_version": "1.0.0",
  "resources": [
    {
      "mode": "managed",
      "type": "aws_instance",
      "name": "web",
      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
      "instances": [
        {
          "attributes": {
            "id": "i-1234567890abcdef0",
            "instance_type": "t3.micro",
            "public_ip": "203.0.113.10",
            "tags": {
              "Name": "WebServer"
            }
          }
        }
      ]
    }
  ]
}

# ポリシーの強制
resource "aws_s3_bucket" "data" {
  bucket = "company-sensitive-data"
  
  # 暗号化を強制
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
  
  # バージョニングを有効化
  versioning {
    enabled = true
  }
  
  # ロギングを有効化
  logging {
    target_bucket = aws_s3_bucket.logs.id
    target_prefix = "s3-access-logs/"
  }
  
  # パブリックアクセスをブロック
  public_access_block {
    block_public_acls       = true
    block_public_policy     = true
    ignore_public_acls      = true
    restrict_public_buckets = true
  }
  
  # タグによる管理
  tags = {
    Environment = var.environment
    Compliance  = "GDPR"
    Owner       = "DataTeam"
    CreatedBy   = "Terraform"
  }
}

# modules/web-server/main.tf
variable "instance_count" {
  description = "Number of instances"
  type        = number
  default     = 1
}

variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"
}

variable "environment" {
  description = "Environment name"
  type        = string
}

# Launch Template
resource "aws_launch_template" "web" {
  name_prefix   = "${var.environment}-web-"
  image_id      = data.aws_ami.amazon_linux_2.id
  instance_type = var.instance_type
  
  vpc_security_group_ids = [aws_security_group.web.id]
  
  user_data = base64encode(<<-EOF
    #!/bin/bash
    yum update -y
    yum install -y nginx
    systemctl start nginx
    systemctl enable nginx
    
    # カスタムページ
    cat > /usr/share/nginx/html/index.html <<-HTML
    <h1>Welcome to ${var.environment} environment</h1>
    <p>Server: $(hostname)</p>
    <p>Instance Type: ${var.instance_type}</p>
    HTML
  EOF
  )
  
  tag_specifications {
    resource_type = "instance"
    tags = {
      Name        = "${var.environment}-web-server"
      Environment = var.environment
      ManagedBy   = "Terraform"
    }
  }
}

# Auto Scaling Group
resource "aws_autoscaling_group" "web" {
  name               = "${var.environment}-web-asg"
  vpc_zone_identifier = var.subnet_ids
  target_group_arns  = [aws_lb_target_group.web.arn]
  health_check_type  = "ELB"
  health_check_grace_period = 300
  
  min_size         = var.instance_count
  max_size         = var.instance_count * 3
  desired_capacity = var.instance_count
  
  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }
  
  tag {
    key                 = "Name"
    value               = "${var.environment}-web-asg"
    propagate_at_launch = false
  }
}

# Application Load Balancer
resource "aws_lb" "web" {
  name               = "${var.environment}-web-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets            = var.public_subnet_ids
  
  enable_deletion_protection = var.environment == "production"
  
  tags = {
    Name        = "${var.environment}-web-alb"
    Environment = var.environment
  }
}

# Output
output "load_balancer_dns" {
  description = "DNS name of the load balancer"
  value       = aws_lb.web.dns_name
}

output "autoscaling_group_name" {
  description = "Name of the Auto Scaling group"
  value       = aws_autoscaling_group.web.name
}

# policy.sentinel - Sentinelポリシー
import "tfplan/v2" as tfplan
import "tfconfig/v2" as tfconfig

# ポリシー1: インスタンスタイプの制限
instance_type_allowed = rule {
    all tfplan.resource_changes as _, rc {
        rc.type is not "aws_instance" or
        rc.change.after.instance_type in [
            "t3.micro",
            "t3.small",
            "t3.medium",
            "m5.large",
            "m5.xlarge"
        ]
    }
}

# ポリシー2: 必須タグの確認
mandatory_tags = rule {
    all tfplan.resource_changes as _, rc {
        rc.mode is not "managed" or
        rc.change.after.tags is null or
        all [
            "Environment",
            "Owner",
            "CostCenter",
            "Project"
        ] as required_tag {
            required_tag in keys(rc.change.after.tags)
        }
    }
}

# ポリシー3: 暗号化の強制
encryption_required = rule {
    all tfplan.resource_changes as _, rc {
        rc.type is not "aws_s3_bucket" or
        rc.change.after.server_side_encryption_configuration is not null
    }
}

# ポリシー4: パブリックアクセスの禁止
no_public_access = rule {
    all tfplan.resource_changes as _, rc {
        rc.type is not "aws_s3_bucket" or
        (rc.change.after.acl is "private" and
         rc.change.after.public_access_block is not null and
         rc.change.after.public_access_block[0].block_public_acls is true)
    }
}

# メインルール
main = rule {
    instance_type_allowed and
    mandatory_tags and
    encryption_required and
    no_public_access
}

# disaster_recovery.tf - 災害復旧の自動化
module "primary_region" {
  source = "./modules/regional-infrastructure"
  
  region      = "ap-northeast-1"
  environment = var.environment
  vpc_cidr    = "10.0.0.0/16"
  
  enable_backup = true
  backup_retention_days = 30
}

module "dr_region" {
  source = "./modules/regional-infrastructure"
  
  region      = "ap-southeast-1"
  environment = "${var.environment}-dr"
  vpc_cidr    = "10.1.0.0/16"
  
  # DRリージョンは最小構成
  instance_count = var.dr_mode ? var.instance_count : 0
  instance_type  = var.dr_mode ? var.instance_type : "t3.micro"
}

# クロスリージョンレプリケーション
resource "aws_s3_bucket_replication_configuration" "dr" {
  role   = aws_iam_role.replication.arn
  bucket = module.primary_region.s3_bucket_id
  
  rule {
    id     = "dr-replication"
    status = "Enabled"
    
    destination {
      bucket        = module.dr_region.s3_bucket_arn
      storage_class = "STANDARD_IA"
    }
  }
}

# RDSの自動バックアップ
resource "aws_db_instance" "primary" {
  identifier = "${var.environment}-database"
  
  # スナップショットからの復元をサポート
  snapshot_identifier = var.restore_from_snapshot
  
  # 自動バックアップ
  backup_retention_period = 7
  backup_window          = "03:00-04:00"
  
  # 最終スナップショットの作成
  skip_final_snapshot       = false
  final_snapshot_identifier = "${var.environment}-database-final-${formatdate("YYYY-MM-DD-hhmm", timestamp())}"
}

# DR切り替えスクリプト
resource "null_resource" "dr_failover_script" {
  provisioner "local-exec" {
    command = <<-EOT
      cat > failover_to_dr.sh << 'EOF'
      #!/bin/bash
      echo "Starting failover to DR region..."
      
      # 1. Route 53の切り替え
      aws route53 change-resource-record-sets \
        --hosted-zone-id ${aws_route53_zone.main.id} \
        --change-batch '{
          "Changes": [{
            "Action": "UPSERT",
            "ResourceRecordSet": {
              "Name": "${var.domain_name}",
              "Type": "A",
              "AliasTarget": {
                "HostedZoneId": "${module.dr_region.alb_zone_id}",
                "DNSName": "${module.dr_region.alb_dns_name}",
                "EvaluateTargetHealth": true
              }
            }
          }]
        }'
      
      # 2. DRインスタンスの起動
      terraform apply -var="dr_mode=true" -auto-approve
      
      echo "Failover completed!"
      EOF
      
      chmod +x failover_to_dr.sh
    EOT
  }
}

# 監視とアラート
resource "aws_cloudwatch_metric_alarm" "dr_health" {
  alarm_name          = "${var.environment}-dr-health"
  comparison_operator = "LessThanThreshold"
  evaluation_periods  = "2"
  metric_name         = "HealthyHostCount"
  namespace           = "AWS/ApplicationELB"
  period              = "60"
  statistic           = "Average"
  threshold           = "1"
  alarm_description   = "This metric monitors DR region health"
  
  dimensions = {
    TargetGroup  = module.dr_region.target_group_arn_suffix
    LoadBalancer = module.dr_region.alb_arn_suffix
  }
  
  alarm_actions = [aws_sns_topic.alerts.arn]
}

# secrets.tf - シークレット管理
# 1. 環境変数から取得
variable "db_password" {
  description = "Database password"
  type        = string
  sensitive   = true
}

# 2. AWS Secrets Managerの使用
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "rds/production/password"
}

# 3. 暗号化されたtfvarsファイル
# terraform.tfvars.encrypted（git-cryptで暗号化）
db_password = "encrypted_value_here"

# 4. リソースでの使用
resource "aws_db_instance" "main" {
  password = var.db_password  # または data.aws_secretsmanager_secret_version.db_password.secret_string
}

# 5. 出力時の保護
output "db_endpoint" {
  value       = aws_db_instance.main.endpoint
  description = "Database endpoint"
}

output "db_password" {
  value       = var.db_password
  description = "Database password"
  sensitive   = true  # terraformの出力で表示されない
}

# cost_optimization.tf
# 1. 適切なインスタンスタイプの選択
locals {
  # 環境に応じたインスタンスタイプ
  instance_types = {
    dev  = "t3.micro"     # $0.0104/hour
    stg  = "t3.small"     # $0.0208/hour
    prod = "m5.large"     # $0.096/hour
  }
}

# 2. オートスケーリングによる最適化
resource "aws_autoscaling_schedule" "scale_down_nights" {
  scheduled_action_name  = "scale-down-nights"
  autoscaling_group_name = aws_autoscaling_group.web.name
  
  # 夜間は最小構成に
  min_size         = 1
  max_size         = 3
  desired_capacity = 1
  
  # 毎日19:00に実行（JST）
  recurrence = "0 10 * * *"  # UTC
}

resource "aws_autoscaling_schedule" "scale_up_mornings" {
  scheduled_action_name  = "scale-up-mornings"
  autoscaling_group_name = aws_autoscaling_group.web.name
  
  # 朝は通常構成に
  min_size         = 2
  max_size         = 10
  desired_capacity = 3
  
  # 毎日8:00に実行（JST）
  recurrence = "0 23 * * *"  # UTC
}

# 3. スポットインスタンスの活用
resource "aws_autoscaling_group" "spot" {
  mixed_instances_policy {
    launch_template {
      launch_template_specification {
        launch_template_id = aws_launch_template.web.id
      }
      
      override {
        instance_type = "t3.medium"
      }
      
      override {
        instance_type = "t3a.medium"  # AMD版
      }
    }
    
    instances_distribution {
      on_demand_percentage_above_base_capacity = 0
      spot_allocation_strategy                 = "lowest-price"
      spot_instance_pools                      = 2
    }
  }
}

# 4. コストアラート
resource "aws_budgets_budget" "monthly" {
  name              = "${var.environment}-monthly-budget"
  budget_type       = "COST"
  limit_amount      = var.monthly_budget_limit
  limit_unit        = "USD"
  time_unit         = "MONTHLY"
  
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                 = 80
    threshold_type            = "PERCENTAGE"
    notification_type         = "FORECASTED"
    subscriber_email_addresses = [var.finance_email]
  }
}