WordPressをIaCで管理して自動デプロイを実現!!【前編】

.
├── .terraform
│   └── providers
│       └── registry.terraform.io
│           └── hashicorp
│               └── aws
│                   └── 4.57.1
│                       └── linux_amd64
│                           └── terraform-provider-aws_v4.57.1_x5
├── .terraform.lock.hcl
├── aws_asg.tf
├── aws_data.tf
├── aws_ec2.tf
├── aws_iam.tf
├── aws_vpc.tf
├── provider.tf
├── terraform.tfstate
└── terraform.tfstate.backup

.
├── ansible.cfg
├── hosts
├── roles
│   ├── common
│   │   ├── files
│   │   │   └── chrony.conf
│   │   └── tasks
│   │       └── main.yml
│   ├── mariadb
│   │   ├── tasks
│   │   │   └── main.yml
│   │   └── vars
│   │       └── main.yml
│   ├── nginx
│   │   ├── files
│   │   │   └── nginx.conf
│   │   └── tasks
│   │       └── main.yml
│   ├── php
│   │   ├── files
│   │   │   └── www.conf
│   │   └── tasks
│   │       └── main.yml
│   └── wp
│       ├── tasks
│       │   └── main.yml
│       └── vars
│           └── main.yml
└── site.yml

```~/.aws/credentials
[BlogUser]
aws_access_key_id = "ここにアクセスキーを記載"
aws_secret_access_key = "ここにシークレットアクセスキーを記載"
```

sudo apt -y update
mkdir ~/terraform-blog
cd ~/terraform-blog

provider "aws" {
  region  = "ap-northeast-1"
  profile = "BlogUser"
}

#----------------------------------------
# IAMポリシーを定義
#----------------------------------------
data "aws_iam_policy_document" "allow_asg" {
  statement {
    sid    = "EC2InstanceManagement"
    effect = "Allow"
    actions = [
      "ec2:AttachClassicLinkVpc",
      "ec2:CancelSpotInstanceRequests",
      "ec2:CreateFleet",
      "ec2:CreateTags",
      "ec2:DeleteTags",
      "ec2:Describe*",
      "ec2:DetachClassicLinkVpc",
      "ec2:ModifyInstanceAttribute",
      "ec2:RequestSpotInstances",
      "ec2:RunInstances",
      "ec2:StartInstances",
      "ec2:StopInstances",
      "ec2:TerminateInstances"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "EC2InstanceProfileManagement"
    effect = "Allow"
    actions = [
      "iam:PassRole"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "EC2SpotManagement"
    effect = "Allow"
    actions = [
      "iam:CreateServiceLinkedRole"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "ELBManagement"
    effect = "Allow"
    actions = [
      "elasticloadbalancing:Register*",
      "elasticloadbalancing:Deregister*",
      "elasticloadbalancing:Describe*"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "CWManagement"
    effect = "Allow"
    actions = [
      "cloudwatch:DeleteAlarms",
      "cloudwatch:DescribeAlarms",
      "cloudwatch:GetMetricData",
      "cloudwatch:PutMetricAlarm"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "SNSManagement"
    effect = "Allow"
    actions = [
      "sns:Publish"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "EventBridgeRuleManagement"
    effect = "Allow"
    actions = [
      "events:PutRule",
      "events:PutTargets",
      "events:RemoveTargets",
      "events:DeleteRule",
      "events:DescribeRule"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "SystemsManagerParameterManagement"
    effect = "Allow"
    actions = [
      "ssm:GetParameters"
    ]
    resources = ["*"]
  }
  statement {
    sid    = "VpcLatticeManagement"
    effect = "Allow"
    actions = [
      "vpc-lattice:DeregisterTargets",
      "vpc-lattice:GetTargetGroup",
      "vpc-lattice:ListTargets",
      "vpc-lattice:ListTargetGroups",
      "vpc-lattice:RegisterTargets"
    ]
    resources = ["*"]
  }
}

#----------------------------------------
# IAMユーザーを作成
#----------------------------------------
resource "aws_iam_user" "BlogUser" {
  name = "BlogUser"
  path = "/"
}

#----------------------------------------
# IAMポリシーを作成
#----------------------------------------
resource "aws_iam_policy" "AutoScalingServiceRolePolicy" {
  name   = "AutoScalingServiceRolePolicy"
  policy = data.aws_iam_policy_document.allow_asg.json
}

#----------------------------------------
# IAMロールを作成
#----------------------------------------
resource "aws_iam_role" "ROLE_BLOG" {
  name               = "ROLE_BLOG"
  assume_role_policy = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}"
  description        = "Allows EC2 instances to call AWS services on your behalf."
  path               = "/"
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMFullAccess",
  ]
  tags = {
    Name = "ROLE_BLOG"
  }
}

#----------------------------------------
# IAMロールを作成
#----------------------------------------
resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  name               = "AWSServiceRoleForAutoScaling"
  assume_role_policy = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"autoscaling.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}"
  description        = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  path               = "/aws-service-role/autoscaling.amazonaws.com/"
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy"
  ]
  tags = {
    Name = "AWSServiceRoleForAutoScaling"
  }
}

terraform init
terraform import aws_iam_user.BlogUser BlogUser
terraform import aws_iam_role.ROLE_BLOG ROLE_BLOG
terraform import aws_iam_role.AWSServiceRoleForAutoScaling AWSServiceRoleForAutoScaling

terraform plan
terraform apply

#----------------------------------------
# VPCの作成
#----------------------------------------
resource "aws_vpc" "vpc_blog" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = false
  tags = {
    Name = "vpc_blog"
  }
}

#----------------------------------------
# パブリックサブネット1aの作成
#----------------------------------------
resource "aws_subnet" "pub_subnet1a_blog" {
  vpc_id                  = aws_vpc.vpc_blog.id
  cidr_block              = "10.0.0.0/28"
  availability_zone       = "ap-northeast-1a"
  map_public_ip_on_launch = true
  tags = {
    Name = "pub_subnet1a_blog"
  }
}

#----------------------------------------
# パブリックサブネット1cの作成
#----------------------------------------
resource "aws_subnet" "pub_subnet1c_blog" {
  vpc_id                  = aws_vpc.vpc_blog.id
  cidr_block              = "10.0.0.16/28"
  availability_zone       = "ap-northeast-1a"
  map_public_ip_on_launch = true
  tags = {
    Name = "pub_subnet1c_blog"
  }
}

#----------------------------------------
# インターネットゲートウェイの作成
#----------------------------------------
resource "aws_internet_gateway" "igw_blog" {
  vpc_id = aws_vpc.vpc_blog.id

  tags = {
    Name = "igw_blog"
  }
}

#----------------------------------------
# ルートテーブルの作成
#----------------------------------------
resource "aws_route_table" "rtb_blog" {
  vpc_id = aws_vpc.vpc_blog.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw_blog.id
  }

  tags = {
    Name = "rtb_blog"
  }
}

#----------------------------------------
# パブリックサブネット1aにルートテーブルを紐づけ
#----------------------------------------
resource "aws_route_table_association" "rt_assoc_1a" {
  subnet_id      = aws_subnet.pub_subnet1a_blog.id
  route_table_id = aws_route_table.rtb_blog.id
}

#----------------------------------------
# パブリックサブネット1cにルートテーブルを紐づけ
#----------------------------------------
resource "aws_route_table_association" "rt_assoc_1c" {
  subnet_id      = aws_subnet.pub_subnet1c_blog.id
  route_table_id = aws_route_table.rtb_blog.id
}

#----------------------------------------
# セキュリティグループの作成
#----------------------------------------
resource "aws_security_group" "sg_blog" {
  name   = "sg_blog"
  vpc_id = aws_vpc.vpc_blog.id
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["(調べたGIPをここに記載)/32"]
  }
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["(調べたGIPをここに記載)/32"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  tags = {
    Name = "sg_blog"
  }
}

terraform plan
terraform apply

#----------------------------------------
# EC2インスタンスを作成
#----------------------------------------
resource "aws_instance" "blog_wp01" {
  ami                    = "ami-0329eac6c5240c99d"
  instance_type          = "t2.micro"
  subnet_id              = aws_subnet.pub_subnet1a_blog.id
  key_name               = "(作成済みのキーペア名をここに記載)"
  vpc_security_group_ids = [aws_security_group.sg_blog.id]
  private_ip             = "10.0.0.10"
  iam_instance_profile   = "ROLE_BLOG"
  tags = {
    Name   = "blog_wp01"
    System = "blog"
  }
}

terraform plan
terraform apply

sudo yum -y update
sudo su -
amazon-linux-extras install -y ansible2
ansible-galaxy collection install community.mysql

cd /etc/ansible
mkdir -p roles/common/files
mkdir roles/common/tasks
mkdir -p roles/nginx/files
mkdir roles/nginx/tasks
mkdir -p roles/mariadb/vars
mkdir roles/mariadb/tasks
mkdir -p roles/php/files
mkdir roles/php/tasks
mkdir -p roles/wp/vars
mkdir roles/wp/tasks

echo [all] >> hosts
echo localhost ansible_connection=local >> hosts

- hosts: all
  become: yes
  gather_facts: no
  name: common settings
  roles:
    - common
    - nginx
    - mariadb
    - php
    - wp

# Use NTP servers from DHCP.
sourcedir /run/chrony-dhcp

# Include configuration found in /etc/chrony.d/*.conf
confdir /etc/chrony.d

# Use NTP sources found in /etc/chrony.d/*.sources
sourcedir /etc/chrony.d

# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift

# Allow the system clock to be stepped in the first three updates
# if its offset is larger than 1 second.
makestep 1.0 3

# Enable kernel synchronization of the real-time clock (RTC).
rtcsync

# Specify file containing keys for NTP authentication.
keyfile /etc/chrony.keys

# Specify directory for log files.
logdir /var/log/chrony

# Select which information is logged.
log measurements statistics tracking

server 0.jp.pool.ntp.org iburst
server 1.jp.pool.ntp.org iburst
server 2.jp.pool.ntp.org iburst
server 3.jp.pool.ntp.org iburst

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80;
        listen       [::]:80;
        server_name  _;
        #root         /usr/share/nginx/html;
        root         /var/www/html;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        error_page 404 /404.html;
        location = /404.html {
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
        }
    }
}

; Start a new pool named 'www'.
; the variable $pool can we used in any directive and will be replaced by the
; pool name ('www' here)
[www]

; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
;       will be used.
; RPM: apache user chosen to provide access to the same directories as httpd
;user = apache
user = nginx
; RPM: Keep a group allowed to write in log dir.
;group = apache
group = nginx

; The address on which to accept FastCGI requests.
; Valid syntaxes are:
;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
;                            a specific port;
;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
;                            a specific port;
;   'port'                 - to listen on a TCP socket to all addresses
;                            (IPv6 and IPv4-mapped) on a specific port;
;   '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory.
listen = /run/php-fpm/www.sock

; Set permissions for unix socket, if one is used. In Linux, read/write
; permissions must be set in order to allow connections from a web server.
; Default Values: user and group are set as the running user
;                 mode is set to 0660
;listen.owner = nobody
listen.owner = nginx
;listen.group = nobody
listen.group = nginx
;listen.mode = 0660

; When POSIX Access Control Lists are supported you can set them using
; these options, value is a comma separated list of user/group names.
; When set, listen.owner and listen.group are ignored
listen.acl_users = apache,nginx
;listen.acl_groups =

; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
; must be separated by a comma. If this value is left blank, connections will be
; accepted from any ip address.
; Default Value: any
listen.allowed_clients = 127.0.0.1

; Choose how the process manager will control the number of child processes.
; Possible Values:
;   static  - a fixed number (pm.max_children) of child processes;
;   dynamic - the number of child processes are set dynamically based on the
;             following directives. With this process management, there will be
;             always at least 1 children.
;             pm.max_children      - the maximum number of children that can
;                                    be alive at the same time.
;             pm.start_servers     - the number of children created on startup.
;             pm.min_spare_servers - the minimum number of children in 'idle'
;                                    state (waiting to process). If the number
;                                    of 'idle' processes is less than this
;                                    number then some children will be created.
;             pm.max_spare_servers - the maximum number of children in 'idle'
;                                    state (waiting to process). If the number
;                                    of 'idle' processes is greater than this
;                                    number then some children will be killed.
;  ondemand - no children are created at startup. Children will be forked when
;             new requests will connect. The following parameter are used:
;             pm.max_children           - the maximum number of children that
;                                         can be alive at the same time.
;             pm.process_idle_timeout   - The number of seconds after which
;                                         an idle process will be killed.
; Note: This value is mandatory.
pm = dynamic

; The number of child processes to be created when pm is set to 'static' and the
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
; This value sets the limit on the number of simultaneous requests that will be
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
; CGI. The below defaults are based on a server without much resources. Don't
; forget to tweak pm.* to fit your needs.
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
; Note: This value is mandatory.
pm.max_children = 50

; The number of child processes created on startup.
; Note: Used only when pm is set to 'dynamic'
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
pm.start_servers = 5

; The desired minimum number of idle server processes.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
pm.min_spare_servers = 5

; The desired maximum number of idle server processes.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
pm.max_spare_servers = 35

; The log file for slow requests
; Default Value: not set
; Note: slowlog is mandatory if request_slowlog_timeout is set
slowlog = /var/log/php-fpm/www-slow.log

; Default Value: nothing is defined by default except the values in php.ini and
;                specified at startup with the -d argument
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
;php_flag[display_errors] = off
php_admin_value[error_log] = /var/log/php-fpm/www-error.log
php_admin_flag[log_errors] = on
;php_admin_value[memory_limit] = 128M

; Set the following data paths to directories owned by the FPM process user.
;
; Do not change the ownership of existing system directories, if the process
; user does not have write permission, create dedicated directories for this
; purpose.
;
; See warning about choosing the location of these directories on your system
; at http://php.net/session.save-path
php_value[session.save_handler] = files
php_value[session.save_path]    = /var/lib/php/session
php_value[soap.wsdl_cache_dir]  = /var/lib/php/wsdlcache
;php_value[opcache.file_cache]  = /var/lib/php/opcache

- name: set locale
  shell: "localectl set-locale LANG=ja_JP.UTF-8 LANGUAGE=\"ja_JP:ja\""

- name: set timezone
  timezone:
    name: Asia/Tokyo

- name: copy chrony.conf
  copy:
    src: ../files/chrony.conf
    dest: /etc/chrony

- name: Enable amzn2extra-nginx1 repository
  shell: amazon-linux-extras enable nginx1
  changed_when: false

- name: Install Nginx packages from amazon-linux-extras
  when: not ansible_check_mode
  yum:
    name: nginx
    state: present

- name: append nginx group to ec2-user user
  when: not ansible_check_mode
  user:
    name: ec2-user
    append: yes
    groups: ec2-user,nginx

- name: change owner and mode
  file:
    path: /var/www/html
    state: directory
    recurse: yes
    group: nginx
    owner: ec2-user
    mode: 0775

- name: copy nginx
  copy:
    src: ../files/nginx.conf
    dest: /etc/nginx

- name: chown nginx
  when: not ansible_check_mode
  file:
    path: /etc/nginx/nginx.conf
    state: file
    group: root
    owner: root
    mode: 0644

- name: restart nginx
  when: not ansible_check_mode
  service:
    name: nginx
    state: restarted
    enabled: yes

db_name: wordpress-db
db_user_name: wordpress-user
db_user_password: WPWP@123

- name: Enable amzn2extra-mariadb10.5 repository
  when: not ansible_check_mode
  shell: amazon-linux-extras enable mariadb10.5
  changed_when: false

- name: Install MariaDB packages from amazon-linux-extras
  yum:
    name: 
      - mariadb
      - MySQL-python
    state: present

- name: install PyMySQL
  pip:
    name: PyMySQL
    executable: pip3

- name: restart mariadb
  when: not ansible_check_mode
  service:
    name: mariadb
    state: restarted
    enabled: yes

- name: Create Database
  when: not ansible_check_mode
  mysql_db:
    login_unix_socket: /var/lib/mysql/mysql.sock
    login_user: root
    login_password: ""
    name: "{{ db_name }}"
    state: present
    encoding: utf8mb4
    collation: utf8mb4_general_ci

- name: Create Database User
  when: not ansible_check_mode
  mysql_user:
    login_unix_socket: /var/lib/mysql/mysql.sock
    login_user: root
    login_password: ""
    name: "{{ db_user_name }}"
    password: "{{ db_user_password }}"
    host: "localhost"
    priv: "{{ db_name }}.*:ALL,GRANT"
    state: present

- name: restart mariadb
  when: not ansible_check_mode
  service:
    name: mariadb
    state: restarted
    enabled: yes

- name: Enable amzn2extra-php7.4 repository
  when: not ansible_check_mode
  shell: amazon-linux-extras enable php7.4
  changed_when: false

- name: Install PHP packages from amazon-linux-extras
  yum:
    name:
      - php
      - php-pdo
      - php-mysqlnd
      - php-cli
      - php-json
      - php-gd
      - php-mbstring
      - php-xml
      - php-fpm
    state: present

- name: copy
  copy:
    src: ../files/www.conf
    dest: /etc/php-fpm.d/www.conf

- name: restart php-fpm
  when: not ansible_check_mode
  service:
    name: php-fpm
    state: restarted
    enabled: yes

db_name: wordpress-db
db_user_name: wordpress-user
db_user_password: WPWP@123
title: blogtest
admin_user: bloguser
admin_password: b10Gb10G
admin_email: blogtest@example.com

- name: Get wp-cli
  get_url:
    url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
    dest: /usr/local/bin/wp
    mode: 0755

- name: check file index.php
  stat:
    path: /var/www/html/index.php
  register: index_php

- name: wp download
  when: not index_php.stat.exists
  shell: "wp core download --locale=ja --path=/var/www/html --version=5.7.8"

- name: check file wp-config.php
  stat:
    path: /var/www/html/wp-config.php
  register: wpconfig_php

- name: wp config create
  when: not wpconfig_php.stat.exists
  shell: "wp config create --dbname={{ db_name }} --dbuser={{ db_user_name }} --dbpass={{ db_user_password }} --path=/var/www/html"

- name: wp install
  shell: "wp core install --url=http://$(curl inet-ip.info) --title={{ title }} --admin_user={{ admin_user }} --admin_password={{ admin_password }} --admin_email={{ admin_email }} --path=/var/www/html"

- name: restart nginx
  when: not ansible_check_mode
  service:
    name: nginx
    state: restarted
    enabled: yes

.
├── ansible.cfg
├── hosts
├── roles
│   ├── common
│   │   ├── files
│   │   │   └── chrony.conf
│   │   └── tasks
│   │       └── main.yml
│   ├── mariadb
│   │   ├── tasks
│   │   │   └── main.yml
│   │   └── vars
│   │       └── main.yml
│   ├── nginx
│   │   ├── files
│   │   │   └── nginx.conf
│   │   └── tasks
│   │       └── main.yml
│   ├── php
│   │   ├── files
│   │   │   └── www.conf
│   │   └── tasks
│   │       └── main.yml
│   └── wp
│       ├── tasks
│       │   └── main.yml
│       └── vars
│           └── main.yml
└── site.yml

ansible-playbook site.yml --check
ansible-playbook site.yml

wp option update home http://$(curl inet-ip.info) --path=/var/www/html

wp option update siteurl http://$(curl inet-ip.info) --path=/var/www/html

#----------------------------------------
# EC2インスタンスからAMIを作成
#----------------------------------------
resource "aws_ami_from_instance" "BlogAMI" {
  name               = "BlogAMI"
  source_instance_id = aws_instance.blog_wp01.id
  tags = {
    Name   = "BlogAMI"
  }
}

#----------------------------------------
# AMIから起動テンプレートを作成
#----------------------------------------
resource "aws_launch_template" "BlogTemplate" {
  name          = "BlogTemplate"
  image_id      = aws_ami_from_instance.BlogAMI.id
  instance_type = "t2.micro"
  key_name      = "KEY_BlogSample"
  user_data = base64encode(
    <<-EOF
      #!/bin/bash
      wp option update home http://$(curl inet-ip.info) --path=/var/www/html
      wp option update siteurl http://$(curl inet-ip.info) --path=/var/www/html
    EOF
  )
  network_interfaces {
    security_groups = [aws_security_group.sg_blog.id]
    subnet_id       = aws_subnet.pub_subnet1a_blog.id
  }
  iam_instance_profile {
    arn = "arn:aws:iam::596526128538:instance-profile/ROLE_BLOG"
  }
  tags = {
    Name      = "BlogTemplate"
  }
}

#----------------------------------------
# 起動テンプレートからASGを作成
#----------------------------------------
resource "aws_autoscaling_group" "BlogASG" {
  name                    = "BlogASG"
  protect_from_scale_in   = true
  service_linked_role_arn = aws_iam_role.AWSServiceRoleForAutoScaling.arn
  vpc_zone_identifier     = [aws_subnet.pub_subnet1a_blog.id]
  max_size                = 1
  min_size                = 1
  desired_capacity        = 1
  launch_template {
    name    = aws_launch_template.BlogTemplate.name
    version = "$Latest"
  }
  tag {
    key                 = "Name"
    propagate_at_launch = true
    value               = "BlogASG"
  }
}

terraform plan
terraform apply

.
├── .terraform
│   └── providers
│       └── registry.terraform.io
│           └── hashicorp
│               └── aws
│                   └── 4.57.1
│                       └── linux_amd64
│                           └── terraform-provider-aws_v4.57.1_x5
├── .terraform.lock.hcl
├── aws_asg.tf
├── aws_data.tf
├── aws_ec2.tf
├── aws_iam.tf
├── aws_vpc.tf
├── provider.tf
├── terraform.tfstate
└── terraform.tfstate.backup