云架构师

资深云架构师,专精 AWS、Azure、GCP 三大平台的企业级架构设计、多云策略、迁移模式、成本优化与云原生架构,遵循 Well-Architected Framework 原则提供高可用、安全、经济的云基础设施设计.

请求格式

# main.tf - AWS 多可用区生产架构
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {
    bucket         = "tf-state-prod"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "tf-locks"
    encrypt        = true
  }
}
# ...
provider "aws" {
  region = "us-east-1"
}
# ...
# VPC 与子网(3 可用区高可用)
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.0"
# ...
  name                 = "prod-vpc"
  cidr                 = "10.0.0.0/16"
  azs                  = ["us-east-1a", "us-east-1b", "us-east-1c"]
  public_subnets       = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets      = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
  database_subnets     = ["10.0.21.0/24", "10.0.22.0/24", "10.0.23.0/24"]
  enable_nat_gateway   = true
  single_nat_gateway   = false
  enable_dns_hostnames = true
}
# ...
# KMS 密钥用于 RDS 加密
resource "aws_kms_key" "rds" {
  description             = "KMS key for RDS encryption"
  enable_key_rotation     = true
  deletion_window_in_days = 30
}
# ...
# RDS 数据库 多可用区部署
resource "aws_db_instance" "main" {
  engine                  = "postgres"
  engine_version          = "15.4"
  instance_class          = "db.r6g.xlarge"
  allocated_storage       = 200
  storage_type            = "gp3"
  storage_encrypted       = true
  kms_key_id              = aws_kms_key.rds.arn
  multi_az                = true
  db_name                 = "prodapp"
  username                = "dbadmin"
  password                = var.db_password
  db_subnet_group_name    = module.vpc.database_subnet_group_name
  backup_retention_period = 7
  monitoring_interval     = 60
  skip_final_snapshot     = false
  final_snapshot_identifier = "prod-rds-final-${formatdate("YYYYMMDD", timestamp())}"
}
# ...
# EC2 Auto Scaling: Web 层
resource "aws_launch_template" "web" {
  name_prefix          = "web-asg"
  image_id             = "ami-0c7217cdde317cfec"
  instance_type        = "t3.large"
  key_name             = "prod-key"
  vpc_security_group_ids = [aws_security_group.web.id]
# ...
  user_data = base64encode(<<-EOF
    #!/bin/sh
    yum install -y nginx
    systemctl enable nginx
    systemctl start nginx
  EOF
  )
}
# ...
resource "aws_autoscaling_group" "web" {
  vpc_zone_identifier = module.vpc.private_subnets
  desired_capacity    = 3
  max_size             = 6
  min_size             = 2
  target_group_arns    = [aws_lb_target_group.web.arn]
# ...
  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }
# ...
  tag {
    key                 = "Name"
    value               = "web-asg"
    propagate_at_launch = true
  }
}

AWS CloudFormation: S3 加密存储桶(版本控制 + 生命周期 + KMS)

# s3-secure-bucket.yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Secure S3 bucket with KMS encryption, versioning, and lifecycle'
# ...
Resources:
  SecureBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'prod-data-${AWS::AccountId}'
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref BucketKMSKey
      LifecycleConfiguration:
        Rules:
          - Id: TransitionToGlacier
            Status: Enabled
            Transitions:
              - StorageClass: GLACIER
                TransitionInDays: 90
              - StorageClass: DEEP_ARCHIVE
                TransitionInDays: 365
            NoncurrentVersionTransitions:
              - StorageClass: GLACIER
                TransitionInDays: 90
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
# ...
  BucketKMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: 'KMS key for S3 bucket encryption'
      EnableKeyRotation: true
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action: 'kms:*'
            Resource: '*'
# ...
  BucketDenyInsecureTransport:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref SecureBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !GetAtt SecureBucket.Arn
              - !Sub '${SecureBucket.Arn}/*'
            Condition:
              Bool:
                aws:SecureTransport: false

前置条件

运行环境

• Agent平台: 支持SKILL.md的任意AI Agent（Claude Code / Cursor / Codex / Gemini CLI等）
• 操作系统: Windows / macOS / Linux

依赖项