130 lines
4.8 KiB
Markdown
130 lines
4.8 KiB
Markdown
# Assignment
|
|
|
|
The Nautilus DevOps team is currently engaged in a cleanup process, focusing on removing unnecessary data and services from their AWS account. As part of the migration process, several resources were created for one-time use only, necessitating a cleanup effort to optimize their AWS environment.
|
|
|
|
A S3 bucket named devops-bck-28889 already exists.
|
|
|
|
1) Copy the contents of devops-bck-28889 S3 bucket to /opt/s3-backup/ directory on terraform-client host (the landing host once you load this lab).
|
|
|
|
2) Delete the S3 bucket devops-bck-28889.
|
|
|
|
3) Use the AWS CLI through Terraform to accomplish this task—for example, by running AWS CLI commands within Terraform. The Terraform working directory is /home/bob/terraform. Update the main.tf file (do not create a separate .tf file) to accomplish this task.
|
|
|
|
Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
|
|
|
|
# Solution
|
|
|
|
# S3 Backup + Delete via Terraform — `devops-bck-28889`
|
|
|
|
This task runs **AWS CLI commands through Terraform** using a `null_resource` with a
|
|
`local-exec` provisioner: sync the bucket's contents to a local directory on the
|
|
`terraform-client` host, then delete the bucket.
|
|
|
|
## `main.tf` (append this block)
|
|
|
|
```hcl
|
|
terraform {
|
|
required_providers {
|
|
null = {
|
|
source = "hashicorp/null"
|
|
version = "~> 3.2"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "null_resource" "s3_backup_and_delete" {
|
|
provisioner "local-exec" {
|
|
interpreter = ["/bin/bash", "-c"]
|
|
command = <<-EOT
|
|
mkdir -p /opt/s3-backup/ && \
|
|
aws s3 sync s3://devops-bck-28889 /opt/s3-backup/ && \
|
|
aws s3 rb s3://devops-bck-28889 --force
|
|
EOT
|
|
}
|
|
}
|
|
```
|
|
|
|
## How to run
|
|
|
|
```bash
|
|
cd /home/bob/terraform
|
|
terraform init
|
|
terraform apply -auto-approve
|
|
```
|
|
|
|
## How it works
|
|
|
|
### Why a `null_resource` + `local-exec`
|
|
|
|
Terraform has no native resource for "copy bucket contents to a local path" or for a
|
|
force-delete of a populated bucket. When a task explicitly says *use the AWS CLI
|
|
through Terraform*, the idiomatic pattern is a `null_resource` whose `local-exec`
|
|
provisioner shells out to the CLI on the machine running Terraform (here, the
|
|
`terraform-client` landing host, which already has AWS credentials configured).
|
|
|
|
- **`null_resource`** — a resource that does nothing itself; it exists solely to hang
|
|
provisioners on. Creating it once (on `apply`) triggers its `local-exec` block.
|
|
- **`interpreter = ["/bin/bash", "-c"]`** — runs the script under bash. (The default
|
|
is `/bin/sh`; bash is set explicitly for predictable `&&` chaining and heredoc
|
|
behavior.)
|
|
|
|
### The command sequence
|
|
|
|
The three steps are chained with `&&`, so each runs only if the previous succeeded —
|
|
critical because step 3 is destructive:
|
|
|
|
1. **`mkdir -p /opt/s3-backup/`** — ensures the destination directory exists (and is a
|
|
no-op if it already does).
|
|
2. **`aws s3 sync s3://devops-bck-28889 /opt/s3-backup/`** — copies every object from
|
|
the bucket into the local directory, preserving key paths. `sync` only transfers
|
|
what's missing/changed, but on a fresh directory it pulls everything.
|
|
3. **`aws s3 rb s3://devops-bck-28889 --force`** — removes the bucket. `rb` (remove
|
|
bucket) normally refuses a non-empty bucket; `--force` first deletes all objects,
|
|
then the bucket itself.
|
|
|
|
The `&&` chaining is the safety mechanism: if the `sync` fails (network, permissions),
|
|
the `rb` never executes, so you don't delete data you failed to back up.
|
|
|
|
### Run-once semantics
|
|
|
|
A `null_resource` runs its provisioner when it's **created**. After a successful
|
|
apply it's in state and won't re-run on subsequent applies. That's the desired
|
|
behavior for a one-time cleanup. If you ever needed to run it again, you'd
|
|
`terraform taint null_resource.s3_backup_and_delete` (or
|
|
`terraform apply -replace=...`) to force recreation — but note the bucket is gone
|
|
after the first run, so a re-run would fail at the sync step anyway.
|
|
|
|
### Modern alternative
|
|
|
|
Terraform 1.4+ ships a built-in `terraform_data` resource that replaces
|
|
`null_resource` without needing the `hashicorp/null` provider. The same block written
|
|
with it:
|
|
|
|
```hcl
|
|
resource "terraform_data" "s3_backup_and_delete" {
|
|
provisioner "local-exec" {
|
|
interpreter = ["/bin/bash", "-c"]
|
|
command = <<-EOT
|
|
mkdir -p /opt/s3-backup/ && \
|
|
aws s3 sync s3://devops-bck-28889 /opt/s3-backup/ && \
|
|
aws s3 rb s3://devops-bck-28889 --force
|
|
EOT
|
|
}
|
|
}
|
|
```
|
|
|
|
Either works; `null_resource` is shown as the primary since it's the widely-recognized
|
|
form.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
# Backup landed locally
|
|
ls -la /opt/s3-backup/
|
|
|
|
# Bucket is gone (this should error with "NoSuchBucket" / "Not Found")
|
|
aws s3 ls s3://devops-bck-28889 || echo "Bucket deleted."
|
|
```
|
|
|
|
Expected — `/opt/s3-backup/` contains the former bucket contents, and the `s3 ls`
|
|
against the bucket fails because it no longer exists. |