Day 20-state inspection-更改 state 有其风险，State manipulation 有赚有赔，更改前应详阅官方文件说明书之二

更改 state 有其风险，State manipulation 有赚有赔，更改前应详阅官方文件说明书之二

state inspection

课程内容与代码会放在 Github 上: https://github.com/chechiachang/terraform-30-days

赛後文章会整理放到个人的部落格上 http://chechia.net/

追踪粉专可以收到文章的主动推播

Terraform supported manipulation

既然手动直接 vim 下去不是一个好方法，我们先来看 terraform 官方支援的 state 操作

state

list
show
mv
rm
refresh
taint/untaint
import

list

terraform state list 上堂课已经说明过，放在这边做范例

cd azure/foundation/compute_network
terragrunt state list

module.network.data.azurerm_resource_group.network
module.network.azurerm_subnet.subnet[0]
module.network.azurerm_subnet.subnet[1]
module.network.azurerm_subnet.subnet[2]
module.network.azurerm_virtual_network.vnet

另外一个用例是，有时我们在 web console 上看到 azure cloud 上的 remote resource，例如：在 azure web console 上看到一个 subnet，我们想要

根据 subnet 在 web consoel 上的资讯查询对应的 .tf resource {} 在哪以便更改
根据我们对 terraform 的理解，实际的 subnet 需要透过 state 查询，才能对应到 .tf resource
然而在一个复杂的 module 中 state list 出来的 resource 可能很多
直接阅读 .tf 也会十分花时间，复杂的 terraform module 的 directory 也会十分复杂，可能会在引用外部 module，例如：azure/modules/compute_network 内又引用 Azure/network/azurerm

terraform 提供了 state filter by id 的方式

在 web console 查到实际物件的 id
直接在 state list 中 filter by id 就可以快速查到 state
也可以根据 resource address 轻松找到 .tf resource

terraform state list -id /subscriptions/6fce7237-7e8e-4053-8e7d-ecf8a7c392ce/resourceGroups/terraform-30-days/providers/Microsoft.Network/virtualNetworks/acctvnet/subnets/dev-1

module.network.azurerm_subnet.subnet[0]

show

这时我们可以进一步 show 出 state 的内容

terragrunt state show module.network.azurerm_virtual_network.vnet

resource "azurerm_virtual_network" "vnet" {
    address_space         = [
        "10.2.0.0/16",
    ]
    dns_servers           = []
    guid                  = "5e5fb9de-600b-4085-a59d-0792c567c3a3"
    id                    = "/subscriptions/6fce7237-7e8e-4053-8e7d-ecf8a7c392ce/resourceGroups/terraform-30-days/providers/Microsoft.Network/virtualNetworks/acctvnet"
    location              = "southeastasia"
    name                  = "acctvnet"
    resource_group_name   = "terraform-30-days"
    subnet                = [
        {
            address_prefix = "10.2.1.0/24"
            id             = "/subscriptions/6fce7237-7e8e-4053-8e7d-ecf8a7c392ce/resourceGroups/terraform-30-days/providers/Microsoft.Network/virtualNetworks/acctvnet/subnets/dev-1"
            name           = "dev-1"
            security_group = ""
        },
        {
            address_prefix = "10.2.2.0/24"
            id             = "/subscriptions/6fce7237-7e8e-4053-8e7d-ecf8a7c392ce/resourceGroups/terraform-30-days/providers/Microsoft.Network/virtualNetworks/acctvnet/subnets/dev-2"
            name           = "dev-2"
            security_group = ""
        },
        {
            address_prefix = "10.2.3.0/24"
            id             = "/subscriptions/6fce7237-7e8e-4053-8e7d-ecf8a7c392ce/resourceGroups/terraform-30-days/providers/Microsoft.Network/virtualNetworks/acctvnet/subnets/dev-3"
            name           = "dev-3"
            security_group = ""
        },
    ]
    tags                  = {
        "environment" = "foundation"
    }
    vm_protection_enabled = false
}

基本上所有 terraform 中设定 / 产生的资料，state 里面都有

设定的 resource argument 参数
apply 之後，API 回传的实际 id / guid，对应远端的 resource

在看另外一个

[] 是 bash 的特殊字元，再进到 terraform 前，就被 bash 判定语法有误
记得要使用 double / single quote

terragrunt state show module.network.azurerm_subnet.subnet[0]
zsh: no matches found: module.network.azurerm_subnet.subnet[0]

terragrunt state show 'module.network.azurerm_subnet.subnet[0]'

resource "azurerm_subnet" "subnet" {
    address_prefix                                 = "10.2.1.0/24"
    address_prefixes                               = [
        "10.2.1.0/24",
    ]
    enforce_private_link_endpoint_network_policies = false
    enforce_private_link_service_network_policies  = false
    id                                             = "/subscriptions/6fce7237-7e8e-4053-8e7d-ecf8a7c392ce/resourceGroups/terraform-30-days/providers/Microsoft.Network/virtualNetworks/acctvnet/subnets/dev-1"
    name                                           = "dev-1"
    resource_group_name                            = "terraform-30-days"
    service_endpoint_policy_ids                    = []
    service_endpoints                              = []
    virtual_network_name                           = "acctvnet"
}