r.GET(“/db/:id”, func(c *gin.Context) {
paramId := c.Param(“id”)
var result Customer
// 执行一个延迟10秒的查询
err := db.QueryRow(“SELECT id, value, SLEEP(10) FROM customers WHERE id = ?”, paramId).Scan(&result.ID, &result.Value, &result.SleepResult)
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{“error”: err.Error()})
return
}

c.JSON(http.StatusOK, result)
})

r.GET(“/cache/:id”, func(c *gin.Context) {
paramId := c.Param(“id”)
// 从缓存中获取
item, err := mc.Get(paramId)
// 如果缓存不存在
if err == memcache.ErrCacheMiss {
var result Customer
// 执行延迟10秒的查询
err := db.QueryRow(“SELECT id, value, SLEEP(10) FROM customers WHERE id = ?”, paramId).Scan(&result.ID, &result.Value, &result.SleepResult)
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{“error”: err.Error()})
return
}
// 注册缓存
resultBytes, err := json.Marshal(result)
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{“error”: err.Error()})
return
}
item = &memcache.Item{
Key: paramId,
Value: resultBytes,
}
if err := mc.Set(item); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{“error”: err.Error()})
return
}
c.JSON(http.StatusOK, result)
return
}

if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{“error”: err.Error()})
return
}

// 将缓存结果处理为响应格式
result := Customer{}
if err = json.Unmarshal(item.Value, &result); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{“error”: err.Error()})
return
}
c.JSON(http.StatusOK, result)
})

variable “environment” {
type = string
default = “dev”
}

variable “cidr_blocks” {
description = “CIDR块列表”
type = list(string)
default = [“<请设置您的全局IP地址>/32”]
}

# ————————————————————#
# 现有的SSM参数存储
# ————————————————————#
data “aws_ssm_parameter” “existing” {
name = “/env”
}

# ————————————————————#
# 现有的ECR
# ————————————————————#
data “aws_ecr_repository” “existing” {
name = “go-dev-repo”
}

# ————————————————————#
# 现有的SSM参数存储
# ————————————————————#
data “aws_ssm_parameter” “existing” {
name = “/env”
}

# ————————————————————#
# 最新的EC2 AMI
# ————————————————————#
data “aws_ssm_parameter” “ami” {
name = “/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64”
}

# ————————————————————#
# VPC
# ————————————————————#
resource “aws_vpc” “main” {
cidr_block = “10.0.0.0/16”

tags = {
Name = format(“%s-%s-aws_vpc”, var.environment, var.project)
}
}

# ————————————————————#
# 公共子网
# ————————————————————#
resource “aws_subnet” “public” {
for_each = toset(local.zones)

vpc_id = aws_vpc.main.id
availability_zone = “ap-northeast-${each.value}”
cidr_block = local.public_cidrs[index(local.zones, each.value)]

tags = {
Name = format(“%s-%s-public-%s”, var.environment, var.project, each.value)
}
}

# ————————————————————#
# 私有子网
# ————————————————————#
resource “aws_subnet” “private” {
for_each = toset(local.zones)

vpc_id = aws_vpc.main.id
availability_zone = “ap-northeast-${each.value}”
cidr_block = local.private_cidrs[index(local.zones, each.value)]

tags = {
Name = format(“%s-%s-private-%s”, var.environment, var.project, each.value)
}
}

# ————————————————————#
# 互联网网关
# ————————————————————#
resource “aws_internet_gateway” “main” {
vpc_id = aws_vpc.main.id

tags = {
Name = format(“%s-%s-aws_internet_gateway”, var.environment, var.project)
}
}

# ————————————————————#
# 弹性IP
# ————————————————————#
resource “aws_eip” “nat” {
for_each = toset(local.zones)

domain = “vpc”

tags = {
Name = format(“%s-%s-aws_eip-nat_%s”, var.environment, var.project, each.value)
}
}

# ————————————————————#
# NAT网关
# ————————————————————#
resource “aws_nat_gateway” “nat” {
for_each = toset(local.zones)

subnet_id = aws_subnet.public[each.value].id
allocation_id = aws_eip.nat[each.value].id

tags = {
Name = format(“%s-%s-nat_%s”, var.environment, var.project, each.value)
}
}

# ————————————————————#
# 公共路由表
# ————————————————————#
resource “aws_route_table” “public” {
vpc_id = aws_vpc.main.id

tags = {
Name = format(“%s-%s-aws_route_table-public”, var.environment, var.project)
}
}

# ————————————————————#
# 公共路由
# ————————————————————#
resource “aws_route” “public” {
destination_cidr_block = “0.0.0.0/0”
route_table_id = aws_route_table.public.id
gateway_id = aws_internet_gateway.main.id
}

# ————————————————————#
# 关联公共路由表
# ————————————————————#
resource “aws_route_table_association” “public” {
for_each = toset(local.zones)

subnet_id = aws_subnet.public[each.value].id
route_table_id = aws_route_table.public.id
}

# ————————————————————#
# 私有路由表
# ————————————————————#
resource “aws_route_table” “private” {
for_each = toset(local.zones)

vpc_id = aws_vpc.main.id

tags = {
Name = format(“%s-%s-private_%s”, var.environment, var.project, each.value)
}
}

# ————————————————————#
# 私有路由
# ————————————————————#
resource “aws_route” “private” {
for_each = toset(local.zones)

destination_cidr_block = “0.0.0.0/0”
route_table_id = aws_route_table.private[each.value].id
nat_gateway_id = aws_nat_gateway.nat[each.value].id
}

# ————————————————————#
# 关联私有路由表
# ————————————————————#
resource “aws_route_table_association” “private” {
for_each = toset(local.zones)

subnet_id = aws_subnet.private[each.value].id
route_table_id = aws_route_table.private[each.value].id
}

# ————————————————————#
# 安全组ALB
# ————————————————————#
resource “aws_security_group” “alb” {
name = var.project
description = var.project
vpc_id = aws_vpc.main.id

tags = {
Name = format(“%s-%s-aws_security_group-alb”, var.environment, var.project)
}
}

# ————————————————————#
# 安全组规则
# ————————————————————#
resource “aws_security_group_rule” “alb_egress” {
security_group_id = aws_security_group.alb.id

type = “egress”
from_port = 0
to_port = 0
protocol = “-1”
cidr_blocks = [“0.0.0.0/0”]
}

resource “aws_security_group_rule” “alb_ingress” {
security_group_id = aws_security_group.alb.id

type = “ingress”
from_port = 80
to_port = 80
protocol = “tcp”
cidr_blocks = [“0.0.0.0/0”]
}

# ————————————————————#
# 負載均衡器監聽器
# ————————————————————#
resource “aws_lb_listener” “main” {
port = 80
protocol = “HTTP”
load_balancer_arn = aws_lb.main.arn

default_action {
type = “fixed-response”

fixed_response {
content_type = “text/plain”
status_code = “200”
message_body = “ok”
}
}
}

# ————————————————————#
# 任務定義
# ————————————————————#
resource “aws_ecs_task_definition” “main” {
family = var.project
requires_compatibilities = [“FARGATE”]
cpu = “256”
memory = “512”
network_mode = “awsvpc”
container_definitions = < .env && ./main”],
“logConfiguration”: {
“logDriver”: “awslogs”,
“options”: {
“awslogs-group” : “${aws_cloudwatch_log_group.ecs_logs.name}”,
“awslogs-region”: “ap-northeast-1”,
“awslogs-stream-prefix”: “ecs”
}
},
“healthCheck”: {
“command”: [“CMD-SHELL”, “curl -f http://localhost:8080/ || exit 1”],
“interval”: 30,
“timeout”: 5,
“retries”: 3,
“startPeriod”: 10
}
}
]
EOL

execution_role_arn = aws_iam_role.ecs_task_execution_role.arn
task_role_arn = aws_iam_role.task_role.arn
}

# ————————————————————#
# ECS 集群
# ————————————————————#
resource “aws_ecs_cluster” “main” {
name = var.project
}

# ————————————————————#
# ELB 目標組
# ————————————————————#
resource “aws_lb_target_group” “main” {
name = var.project
vpc_id = aws_vpc.main.id
port = 8080
protocol = “HTTP”
target_type = “ip”

health_check {
port = 8080
path = “/”
protocol = “HTTP”
}
}

# ————————————————————#
# ALB 監聽器規則
# ————————————————————#
resource “aws_lb_listener_rule” “main” {
listener_arn = aws_lb_listener.main.arn

action {
type = “forward”
target_group_arn = aws_lb_target_group.main.arn
}

condition {
path_pattern {
values = [“*”]
}
}
}

# ————————————————————#
# ECS 安全群組
# ————————————————————#
resource “aws_security_group” “ecs” {
name = format(“%s-ecs”, var.project)
description = format(“%s-ecs”, var.project)
vpc_id = aws_vpc.main.id

tags = {
Name = format(“%s-ecs”, var.project)
}
}

# ————————————————————#
# ECS 安全群組出站規則
# ————————————————————#
resource “aws_security_group_rule” “ecs_egress” {
security_group_id = aws_security_group.ecs.id
type = “egress”

from_port = 0
to_port = 0
protocol = “-1”
cidr_blocks = [“0.0.0.0/0”]
}

# ————————————————————#
# ECS 安全群組入站規則
# ————————————————————#
resource “aws_security_group_rule” “ecs_ingress” {
security_group_id = aws_security_group.ecs.id
type = “ingress”
from_port = 8080
to_port = 8080
protocol = “tcp”
cidr_blocks = [“10.0.0.0/16”]
}

# ————————————————————#
# ECS 服務
# ————————————————————#
resource “aws_ecs_service” “main” {
name = var.project
depends_on = [aws_lb_listener_rule.main]
cluster = aws_ecs_cluster.main.name
launch_type = “FARGATE”
desired_count = 1
task_definition = aws_ecs_task_definition.main.arn

network_configuration {
subnets = values(aws_subnet.private)[*].id
security_groups = [aws_security_group.ecs.id]
}

load_balancer {
target_group_arn = aws_lb_target_group.main.arn
container_name = “go”
container_port = 8080
}
}

# ————————————————————#
# 任務執行角色
# ————————————————————#
resource “aws_iam_role” “ecs_task_execution_role” {
name = format(“%s-%s-ecs_task_execution_role”, var.environment, var.project)

assume_role_policy = <<EOF
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Action”: “sts:AssumeRole”,
“Principal”: {
“Service”: “ecs-tasks.amazonaws.com”
},
“Effect”: “Allow”,
“Sid”: “”
}
]
}
EOF
}

# ————————————————————#
# 聯繫Private
# ————————————————————#
resource “aws_iam_policy” “ecs_task_execution_policy” {
name = format(“%s-%s-ecs_task_execution_policy”, var.environment, var.project)
path = “/”
description = format(“%s-ecs-task-execution-policy”, var.project)

policy = <<EOF
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: [
“ecs:StartTask”,
“ecs:StopTask”,
“ecs:DescribeTasks”,
“ecs:ListTasks”,
“ecr:GetAuthorizationToken”,
“ecr:BatchCheckLayerAvailability”,
“ecr:GetDownloadUrlForLayer”,
“ecr:BatchGetImage”,
“logs:CreateLogStream”,
“logs:PutLogEvents”,
“ssm:GetParameters”
],
“Resource”: “*”
}
]
}
EOF
}

# ————————————————————#
# 任務角色策略關聯
# ————————————————————#
resource “aws_iam_role_policy_attachment” “ecs_task_execution_role_policy_attach” {
role = aws_iam_role.ecs_task_execution_role.name
policy_arn = aws_iam_policy.ecs_task_execution_policy.arn
}

# ————————————————————#
# 任務角色
# ————————————————————#
resource “aws_iam_role” “task_role” {
name = var.project

assume_role_policy = <<EOF
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Action”: “sts:AssumeRole”,
“Principal”: {
“Service”: “ecs-tasks.amazonaws.com”
},
“Effect”: “Allow”,
“Sid”: “”
}
]
}
EOF
}

# ————————————————————#
# SSM參數存儲策略
# ————————————————————#
resource “aws_iam_policy” “ssm_parameter_store_policy” {
name = var.project
description = “允許訪問SSM參數存儲”

policy = <<EOF
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: “ssm:GetParameters”,
“Resource”: “*”
}
]
}
EOF
}

# ————————————————————#
# SSM參數存儲策略關聯
# ————————————————————#
resource “aws_iam_role_policy_attachment” “ssm_policy_attach” {
role = aws_iam_role.task_role.name
policy_arn = aws_iam_policy.ssm_parameter_store_policy.arn
}

# ————————————————————#
# CloudWatch日誌組
# ————————————————————#
resource “aws_cloudwatch_log_group” “ecs_logs” {
name = “/ecs/handson”
retention_in_days = 14
}

# ————————————————————#
# 輸出
# ————————————————————#
output “alb_dns” {
value = aws_lb.main.dns_name
description = “DNS名稱”
}

parameter {
name = “character_set_server”
value = “utf8mb4”
}

tags = {
Name = format(“%s-%s-aws-db-parameter-group”, var.environment, var.project)
}
}

# ————————————————————#
# RDS选项组
# ————————————————————#
resource “aws_db_option_group” “main” {
name = var.project
option_group_description = var.project
engine_name = “mysql”
major_engine_version = “8.0”

tags = {
Name = format(“%s-%s-aws-db-option-group”, var.environment, var.project)
}
}

# ————————————————————#
# RDS子网组
# ————————————————————#
resource “aws_db_subnet_group” “main” {
name = var.project
subnet_ids = [
aws_subnet.private[“1c”].id,
aws_subnet.private[“1d”].id,
]

tags = {
Name = format(“%s-%s-aws-db-subnet-group”, var.environment, var.project)
}
}

# ————————————————————#
# RDS安全组
# ————————————————————#
resource “aws_security_group” “rds” {
name = format(“%s-%s-aws-security-group-rds”, var.environment, var.project)
description = “允许3306端口的入站流量”
vpc_id = aws_vpc.main.id

tags = {
Name = format(“%s-%s-aws-security-group”, var.environment, var.project)
}
}

resource “aws_security_group_rule” “allow_ecs_mysql” {
security_group_id = aws_security_group.rds.id
type = “ingress”
from_port = 3306
to_port = 3306
protocol = “tcp”
source_security_group_id = aws_security_group.ecs.id
}

resource “aws_security_group_rule” “allow_ec2_mysql” {
security_group_id = aws_security_group.rds.id
type = “ingress”
from_port = 3306
to_port = 3306
protocol = “tcp”
source_security_group_id = aws_security_group.ssm.id
}

# ————————————————————#
# RDS实例
# ————————————————————#
resource “random_string” “db_password” {
length = 16
special = false
}

resource “aws_db_instance” “main” {
engine = “mysql”
engine_version = “8.0”

identifier = var.project

username = “admin”
password = random_string.db_password.result

skip_final_snapshot = true

instance_class = “db.t3.medium”

storage_type = “gp2”
allocated_storage = 20
storage_encrypted = false

multi_az = false
availability_zone = “ap-northeast-1d”
db_subnet_group_name = aws_db_subnet_group.main.name
vpc_security_group_ids = [aws_security_group.rds.id]
publicly_accessible = false
port = 3306

parameter_group_name = aws_db_parameter_group.main.name
option_group_name = aws_db_option_group.main.name

apply_immediately = true

performance_insights_enabled = true

tags = {
Name = format(“%s-%s-aws-db-instance”, var.environment, var.project)
}
}

# ————————————————————#
# 堡垒机EC2
# ————————————————————#
resource “aws_security_group” “ssm” {
name = format(“%s-%s-aws-security-group-ssm”, var.environment, var.project)
description = “用于SSM EC2实例的安全组”
vpc_id = aws_vpc.main.id

tags = {
Name = format(“%s-%s-aws-security-group-ssm”, var.environment, var.project)
}
}

resource “aws_security_group_rule” “ssm_egress” {
type = “egress”
from_port = 0
to_port = 0
protocol = “-1”
cidr_blocks = [“0.0.0.0/0”]
security_group_id = aws_security_group.ssm.id
}

resource “aws_security_group_rule” “ssm_ingress_ssh” {
type = “ingress”
from_port = 22
to_port = 22
protocol = “tcp”
cidr_blocks = var.cidr_blocks
security_group_id = aws_security_group.ssm.id
}

resource “aws_security_group_rule” “ssm_ingress_mysql” {
type = “ingress”
from_port = 3306
to_port = 3306
protocol = “tcp”
cidr_blocks = var.cidr_blocks
security_group_id = aws_security_group.ssm.id
}

resource “aws_iam_role” “rds_access” {
name = format(“%s-%s-aws_iam_role-rds_access”, var.environment, var.project)

assume_role_policy = jsonencode({
Version = “2012-10-17”
Statement = [
{
Effect = “Allow”
Principal = {
Service = “ec2.amazonaws.com”
}
Action = “sts:AssumeRole”
}
]
})
}

resource “aws_iam_role_policy” “rds_access” {
name = “RDSPolicy”
role = aws_iam_role.rds_access.id

policy = jsonencode({
Version = “2012-10-17”
Statement = [
{
Effect = “Allow”
Action = [
“rds:*”,
]
Resource = [“*”]
}
]
})
}

resource “aws_iam_role_policy_attachment” “ssm_managed_policy_attach” {
role = aws_iam_role.rds_access.name
policy_arn = “arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore”
}

resource “aws_iam_instance_profile” “rds_access” {
name = “RDSAccessProfile”
role = aws_iam_role.rds_access.name
}

resource “aws_instance” “ssm” {
ami = “ami-0947c48ae0aaf6781”
instance_type = “t2.micro”
iam_instance_profile = aws_iam_instance_profile.rds_access.name
subnet_id = aws_subnet.public[“1d”].id
vpc_security_group_ids = [aws_security_group.ssm.id]
associate_public_ip_address = true
key_name = “access_db”
user_data = <<-EOF
#!/bin/bash
sudo systemctl enable amazon-ssm-agent
sudo systemctl start amazon-ssm-agent
EOF

tags = {
Name = format(“%s-%s-aws-ssm-ec2-instance”, var.environment, var.project)
}
}

# ————————————————————#
# 输出
# ————————————————————#
output “DB_USER” {
value = “admin”
description = “数据库用户名”
}

output “DB_PASS” {
value = random_string.db_password.result
description = “数据库密码”
}

output “DB_HOST” {
value = aws_db_instance.main.address
description = “数据库端点”
}

output “DB_NAME” {
value = “golang”
description = “数据库名称”
}

output “DB_PORT” {
value = aws_db_instance.main.port
description = “数据库端口”
}

output “bastion_ec2_id” {
value = aws_instance.ssm.id
description = “堡垒机EC2实例ID”
}

tags = {
Name = format(“%s-%s-aws-security-group”, var.environment, var.project)
}
}

resource “aws_security_group_rule” “memcached” {
security_group_id = aws_security_group.memcached.id
type = “ingress”
from_port = 11211
to_port = 11211
protocol = “tcp”
source_security_group_id = aws_security_group.ecs.id
}

# ————————————————————#
# Memcached子网组
# ————————————————————#
resource “aws_elasticache_subnet_group” “memcached” {
name = format(“%s-%s-memcached-subnet-group”, var.environment, var.project)
subnet_ids = [
aws_subnet.private[“1c”].id,
aws_subnet.private[“1d”].id,
]
}

# ————————————————————#
# Memcached集群
# ————————————————————#
resource “aws_elasticache_cluster” “memcached” {
cluster_id = format(“%s-%s-memcached-cluster”, var.environment, var.project)
engine = “memcached”
node_type = “cache.t3.micro”
num_cache_nodes = 2
parameter_group_name = “default.memcached1.6”
subnet_group_name = aws_elasticache_subnet_group.memcached.name
security_group_ids = [aws_security_group.memcached.id]
}

# ————————————————————#
# 输出
# ————————————————————#
output “CACHE_HOST1” {
value = “${aws_elasticache_cluster.memcached.cache_nodes.0.address}:11211”
description = “缓存集群节点1的端点”
}

output “CACHE_HOST2” {
value = “${aws_elasticache_cluster.memcached.cache_nodes.1.address}:11211”
description = “缓存集群节点2的端点”
}