Пример: VPC, подсети, Security Group и EC2-инстанс:
# __main__.py
import pulumi
import pulumi_aws as aws
config = pulumi.Config()
env = pulumi.get_stack() # dev / staging / prod
# VPC
vpc = aws.ec2.Vpc("main-vpc",
cidr_block="10.0.0.0/16",
enable_dns_hostnames=True,
tags={"Name": f"{env}-vpc", "Environment": env}
)
# Подсети (используем циклы Python!)
azs = aws.get_availability_zones(state="available")
subnets = []
for i, az in enumerate(azs.names[:3]):
subnet = aws.ec2.Subnet(f"subnet-{i}",
vpc_id=vpc.id,
cidr_block=f"10.0.{i}.0/24",
availability_zone=az,
map_public_ip_on_launch=True,
tags={"Name": f"{env}-subnet-{az}"}
)
subnets.append(subnet)
# Security Group с условной логикой
allow_ssh = config.get_bool("allow_ssh") or False
ingress_rules = [
aws.ec2.SecurityGroupIngressArgs(
protocol="tcp", from_port=80, to_port=80,
cidr_blocks=["0.0.0.0/0"], description="HTTP"
),
aws.ec2.SecurityGroupIngressArgs(
protocol="tcp", from_port=443, to_port=443,
cidr_blocks=["0.0.0.0/0"], description="HTTPS"
),
]
if allow_ssh:
ingress_rules.append(
aws.ec2.SecurityGroupIngressArgs(
protocol="tcp", from_port=22, to_port=22,
cidr_blocks=[config.require("admin_cidr")],
description="SSH admin"
)
)
sg = aws.ec2.SecurityGroup("web-sg",
vpc_id=vpc.id,
ingress=ingress_rules,
egress=[aws.ec2.SecurityGroupEgressArgs(
protocol="-1", from_port=0, to_port=0,
cidr_blocks=["0.0.0.0/0"]
)]
)
# EC2 инстанс
ami = aws.ec2.get_ami(
most_recent=True,
owners=["099720109477"], # Canonical (Ubuntu)
filters=[aws.ec2.GetAmiFilterArgs(
name="name", values=["ubuntu/images/hvm-ssd/ubuntu-*-24.04-amd64-server-*"]
)]
)
instance = aws.ec2.Instance("web-server",
ami=ami.id,
instance_type=config.get("instance_type") or "t3.micro",
subnet_id=subnets[0].id,
vpc_security_group_ids=[sg.id],
tags={"Name": f"{env}-web-server"}
)
# Экспорт значений (аналог output в Terraform)
pulumi.export("vpc_id", vpc.id)
pulumi.export("instance_ip", instance.public_ip)
pulumi.export("instance_id", instance.id)
Оставить комментарий