{Alibaba VPC} VPCピアリング接続の作成と管理

https://www.alibabacloud.com/help/ja/vpc/user-guide/create-and-manage-vpc-peering-connection
https://www.alibabacloud.com/help/ja/vpc/user-guide/examples-of-vpc-peering-connections
https://www.softbank.jp/biz/blog/cloud-technology/articles/202211/alibabacloud-vpc/

同一アカウント
クロスリージョン

Terraform で異なる2リージョンにVPCとECSインスタンスを作成する
VPCのアドレス範囲は重複しないようにする

前提: 
コンソールより「CDTサービスの有効化」実施済
ECS-KeyPairをTokyoとSeoulで作成済

tfファイル相違点: 

Japna(Tokyo)
ap-northeast-1
ap-northeast-1a
ecs.t5-lc2m1.nano
alibabakey01
cloud_ssd
10.11.1.0/24

South Korea (Seoul)
ap-northeast-2
ap-northeast-2a
ecs.t6-c4m1.large
alibabakey03
cloud_essd
10.2.1.0/24

-- 1. VPCとECSの作成(Tokyo)
-- セキュリティグループにSeoulからのICMP許可追加必要

cd ${BASE_DIR}/tokyo

cat <<-'EOF' > variables.tf

locals {
  availability_zone = "ap-northeast-1a"
}

variable "instance_type" {
  description = "instance_type"
  type = string
  default = "ecs.t5-lc2m1.nano"
}

variable "image_id" {
  description = "image_id"
  type = string
  default = "aliyun_2_1903_x64_20G_alibase_20231221.vhd"
}

EOF

cat <<-'EOF' > main.tf

terraform {
  required_version = ">= 1.0.0, < 2.0.0"
  required_providers {
    alicloud = {
       source  = "aliyun/alicloud"
       version = "= 1.217.0"
    }
  }
}

provider "alicloud" {
    region  = "ap-northeast-1"
}

resource "alicloud_vpc" "vpc01" {
  vpc_name          = "vpc01"
  description       = "vpc01"
  cidr_block        = "10.11.0.0/16"
}

resource "alicloud_vswitch" "sw01" {
  vswitch_name      = "sw01"
  description       = "sw01"
  vpc_id            = alicloud_vpc.vpc01.id
  cidr_block        = "10.11.1.0/24"
  zone_id           = local.availability_zone
}

resource "alicloud_security_group" "sg01" {
  name                = "sg01"
  description         = "sg01"
  vpc_id              = alicloud_vpc.vpc01.id
  security_group_type = "normal"
}

resource "alicloud_security_group_rule" "sg0101" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "22/22"
  security_group_id = alicloud_security_group.sg01.id
  nic_type          = "intranet"
  policy            = "accept"
  priority          = 10
  cidr_ip           = "0.0.0.0/0"
  description       = "sg0101"
}

resource "alicloud_security_group_rule" "sg0102" {
  type              = "ingress"
  ip_protocol       = "icmp"
  port_range        = "-1/-1"
  security_group_id = alicloud_security_group.sg01.id
  nic_type          = "intranet"
  policy            = "accept"
  priority          = 10
  cidr_ip           = "10.2.1.0/24"
  description       = "sg0102"
}

resource "alicloud_vpc_ipv4_gateway" "gw01" {
  ipv4_gateway_name        = "gw01"
  ipv4_gateway_description = "gw01"
  vpc_id                   = alicloud_vpc.vpc01.id
  enabled                  = true
}

# ルートテーブルへvSwitchの関連付け
resource "alicloud_route_table_attachment" "sw01_rt01" {
  vswitch_id     = alicloud_vswitch.sw01.id
  route_table_id = alicloud_vpc.vpc01.route_table_id
}

# ルートテーブルへカスタムルート追加
resource "alicloud_route_entry" "rt0101" {
  name                  = "rt0101"
  route_table_id        = alicloud_vpc.vpc01.route_table_id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.gw01.id
}

resource "alicloud_instance" "instance01" {

  image_id                   = var.image_id
  instance_type              = var.instance_type
  security_groups            = [alicloud_security_group.sg01.id]
  instance_name              = "instance01"
  system_disk_category       = "cloud_ssd"
  system_disk_name           = "instance01"
  system_disk_size           = 20
  description                = "instance01"
  internet_charge_type       = "PayByBandwidth"
  internet_max_bandwidth_out = 0
  host_name                  = "instance01"
  vswitch_id                 = alicloud_vswitch.sw01.id
  instance_charge_type       = "PostPaid"
  key_name                   = "alibabakey01"
  deletion_protection        = false
  credit_specification       = "Standard"

}

resource "alicloud_eip_address" "eip01" {
  address_name              = "eip01"
  bandwidth                 = 1
  deletion_protection       = false
  description               = "eip01"
  internet_charge_type      = "PayByTraffic"
  isp                       = "BGP"
  payment_type              = "PayAsYouGo"
  netmode                   = "public"
}

# インスタンスとEIPの関連付け
resource "alicloud_eip_association" "instance01_eip01" {
  instance_id              = alicloud_instance.instance01.id
  allocation_id            = alicloud_eip_address.eip01.id
}

EOF

cat <<-'EOF' > outputs.tf

output "vpc01_id" {
  value = alicloud_vpc.vpc01.id
  description = "vpc01.id"
}

output "vpc01_route_table_id" {
  value = alicloud_vpc.vpc01.route_table_id
  description = "vpc01.route_table_id"
}

output "sw01_id" {
  value = alicloud_vswitch.sw01.id
  description = "sw01.id"
}

output "sg01_id" {
  value = alicloud_security_group.sg01.id
  description = "sg01.id"
}

output "gw01_id" {
  value = alicloud_vpc_ipv4_gateway.gw01.id
  description = "gw01.id"
}

output "instance01_id" {
  value = alicloud_instance.instance01.id
  description = "instance01.id"
}

output "eip01_id" {
  value = alicloud_eip_address.eip01.id
  description = "eip01.id"
}

EOF

terraform init
terraform fmt
terraform -version

terraform plan

terraform apply -auto-approve

-- 2. VPCとECSの作成(Seoul)
-- セキュリティグループにTokyoからのICMP許可追加必要

cd ${BASE_DIR}/seoul

cat <<-'EOF' > variables.tf

locals {
  availability_zone = "ap-northeast-2a"
}

variable "instance_type" {
  description = "instance_type"
  type = string
  default = "ecs.t6-c4m1.large"
}

variable "image_id" {
  description = "image_id"
  type = string
  default = "aliyun_2_1903_x64_20G_alibase_20231221.vhd"
}

EOF

cat <<-'EOF' > main.tf

terraform {
  required_version = ">= 1.0.0, < 2.0.0"
  required_providers {
    alicloud = {
       source  = "aliyun/alicloud"
       version = "= 1.217.0"
    }
  }
}

provider "alicloud" {
    region  = "ap-northeast-2"
}

resource "alicloud_vpc" "vpc01" {
  vpc_name          = "vpc01"
  description       = "vpc01"
  cidr_block        = "10.2.0.0/16"
}

resource "alicloud_vswitch" "sw01" {
  vswitch_name      = "sw01"
  description       = "sw01"
  vpc_id            = alicloud_vpc.vpc01.id
  cidr_block        = "10.2.1.0/24"
  zone_id           = local.availability_zone
}

resource "alicloud_security_group" "sg01" {
  name                = "sg01"
  description         = "sg01"
  vpc_id              = alicloud_vpc.vpc01.id
  security_group_type = "normal"
}

resource "alicloud_security_group_rule" "sg0101" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "22/22"
  security_group_id = alicloud_security_group.sg01.id
  nic_type          = "intranet"
  policy            = "accept"
  priority          = 10
  cidr_ip           = "0.0.0.0/0"
  description       = "sg0101"
}

resource "alicloud_security_group_rule" "sg0102" {
  type              = "ingress"
  ip_protocol       = "icmp"
  port_range        = "-1/-1"
  security_group_id = alicloud_security_group.sg01.id
  nic_type          = "intranet"
  policy            = "accept"
  priority          = 10
  cidr_ip           = "10.11.1.0/24"
  description       = "sg0102"
}

resource "alicloud_vpc_ipv4_gateway" "gw01" {
  ipv4_gateway_name        = "gw01"
  ipv4_gateway_description = "gw01"
  vpc_id                   = alicloud_vpc.vpc01.id
  enabled                  = true
}

# ルートテーブルへvSwitchの関連付け
resource "alicloud_route_table_attachment" "sw01_rt01" {
  vswitch_id     = alicloud_vswitch.sw01.id
  route_table_id = alicloud_vpc.vpc01.route_table_id
}

# ルートテーブルへカスタムルート追加
resource "alicloud_route_entry" "rt0101" {
  name                  = "rt0101"
  route_table_id        = alicloud_vpc.vpc01.route_table_id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Ipv4Gateway"
  nexthop_id            = alicloud_vpc_ipv4_gateway.gw01.id
}

resource "alicloud_instance" "instance01" {

  image_id                   = var.image_id
  instance_type              = var.instance_type
  security_groups            = [alicloud_security_group.sg01.id]
  instance_name              = "instance01"
  system_disk_category       = "cloud_essd"
  system_disk_name           = "instance01"
  system_disk_size           = 20
  description                = "instance01"
  internet_charge_type       = "PayByBandwidth"
  internet_max_bandwidth_out = 0
  host_name                  = "instance01"
  vswitch_id                 = alicloud_vswitch.sw01.id
  instance_charge_type       = "PostPaid"
  key_name                   = "alibabakey03"
  deletion_protection        = false
  credit_specification       = "Standard"

}

resource "alicloud_eip_address" "eip01" {
  address_name              = "eip01"
  bandwidth                 = 1
  deletion_protection       = false
  description               = "eip01"
  internet_charge_type      = "PayByTraffic"
  isp                       = "BGP"
  payment_type              = "PayAsYouGo"
  netmode                   = "public"
}

# インスタンスとEIPの関連付け
resource "alicloud_eip_association" "instance01_eip01" {
  instance_id              = alicloud_instance.instance01.id
  allocation_id            = alicloud_eip_address.eip01.id
}

EOF

cat <<-'EOF' > outputs.tf

output "vpc01_id" {
  value = alicloud_vpc.vpc01.id
  description = "vpc01.id"
}

output "vpc01_route_table_id" {
  value = alicloud_vpc.vpc01.route_table_id
  description = "vpc01.route_table_id"
}

output "sw01_id" {
  value = alicloud_vswitch.sw01.id
  description = "sw01.id"
}

output "sg01_id" {
  value = alicloud_security_group.sg01.id
  description = "sg01.id"
}

output "gw01_id" {
  value = alicloud_vpc_ipv4_gateway.gw01.id
  description = "gw01.id"
}

output "instance01_id" {
  value = alicloud_instance.instance01.id
  description = "instance01.id"
}

output "eip01_id" {
  value = alicloud_eip_address.eip01.id
  description = "eip01.id"
}

EOF

terraform init
terraform fmt
terraform -version

terraform plan

terraform apply -auto-approve

-- 3. VPCピアリング接続の作成(Tokyo)
-- AcceptingAliUidパラメータ
-- はメインアカウントIDを使用する。 aliyun ram GetAccountAlias で取得可能

aliyun vpcpeer CreateVpcPeerConnection \
--AcceptingAliUid 1111111111111111 \
--AcceptingRegionId ap-northeast-2 \
--AcceptingVpcId vpc-111111111111111111111 \
--RegionId ap-northeast-1 \
--VpcId vpc-111111111111111111111 \
--Bandwidth 1 \
--Name vpcc01 

aliyun vpcpeer ListVpcPeerConnections 

-- 4. カスタムルート追加

-- 4.1 Tokyo → Seoul

aliyun vpc DescribeRouteEntryList \
--RouteTableId vtb-111111111111111111111

aliyun vpc CreateRouteEntries \
--RouteEntries.1.RouteTableId vtb-111111111111111111111 \
--RouteEntries.1.DstCidrBlock 10.2.1.0/24 \
--RouteEntries.1.NextHop pcc-111111111111111111 \
--RouteEntries.1.NextHopType VpcPeer \
--RouteEntries.1.Name rte01

-- 4.2 Seoul → Tokyo

aliyun vpc DescribeRouteEntryList \
--RouteTableId vtb-111111111111111111111 

aliyun vpc CreateRouteEntries \
--RouteEntries.1.RouteTableId vtb-111111111111111111111 \
--RouteEntries.1.DstCidrBlock 10.11.1.0/24 \
--RouteEntries.1.NextHop pcc-111111111111111111 \
--RouteEntries.1.NextHopType VpcPeer \
--RouteEntries.1.Name rte01

-- 5. 動作確認
-- 5.1 Tokyo → Seoul

ping 10.2.1.116 

-- 5.2 Seoul → Tokyo

ping 10.11.1.77 

-- 6. クリーンアップ

-- 6.1 VPCピアリング接続の削除(Tokyo)

aliyun vpcpeer ListVpcPeerConnections 

aliyun vpcpeer DeleteVpcPeerConnection \
--InstanceId pcc-111111111111111111 \
--Force true 

-- 6.2 VPCとECSの削除(Tokyo)

cd ${BASE_DIR}/tokyo
terraform destroy -auto-approve

-- 6.3 VPCとECSの削除(Seoul)

cd ${BASE_DIR}/seoul
terraform destroy -auto-approve