CI/CD-Automated Terraform Infrastructure Deployment

Scenario

Use this workflow when you need to version-control and automatically deploy a complete Alibaba Cloud environment (VPC, ECS instances, and storage) on every code commit. It eliminates manual console operations by chaining secure credential management, declarative infrastructure provisioning, and GitLab CI/CD execution into a single, auditable pipeline.

Integration steps

1. Configure Secure Authentication: Follow the RAM role path for CI/CD. Create a RAM Role with AliyunVPCFullAccess and AliyunECSFullAccess, then inject temporary credentials into your runner via ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, and ALICLOUD_SECURITY_TOKEN.
2. Initialize Remote State: Configure backend.tf to store state in Alibaba Cloud OSS, preventing local drift and enabling team collaboration:

``hcl terraform { backend "oss" { bucket = "tf-state-prod"; key = "infra/terraform.tfstate"; region = "cn-hangzhou"; lock = true } } ``

3. Define Infrastructure Stack: Use the full-stack provisioning path. In main.tf, declare VPC, security groups, and ECS instances:

``hcl resource "alicloud_vpc" "main" { vpc_name = "prod-vpc"; cidr_block = "172.16.0.0/16" } resource "alicloud_instance" "web" { instance_type = "ecs.t6-c1m2.large"; security_groups = [alicloud_security_group.ecs_sg.id]; vswitch_id = alicloud_vswitch.main.id } ``

4. Configure ECS Networking: Follow the ECS networking path. Attach a secondary ENI and bind an EIP using alicloud_network_interface and alicloud_eip_association to ensure public reachability.
5. Create CI/CD Pipeline: Add .gitlab-ci.yml to trigger Terraform on merge:

``yaml stages: [plan, apply] plan: { script: ["terraform init", "terraform plan -out=tfplan"], only: [merge_requests] } apply: { script: ["terraform apply -auto-approve tfplan"], only: [main] } ``

6. Deploy on Commit: Push to main. The pipeline authenticates via RAM, executes terraform plan, and provisions the full stack via terraform apply.

Architecture

The Git repository serves as the infrastructure source of truth. On commit, the CI/CD runner pulls code, authenticates with Alibaba Cloud using temporary RAM credentials, and executes Terraform. Terraform calls Alibaba Cloud OpenAPI endpoints (ecs.aliyuncs.com, vpc.aliyuncs.com) to provision resources, while state is persisted and locked in an OSS bucket. ECS instances automatically inherit VPC routing and security group rules defined in the .tf configuration.

Prerequisites

• Alibaba Cloud account with RAM permissions for VPC, ECS, and OSS
• GitLab CI/CD runner with shell or Docker executor
• Terraform CLI (v1.5+) with alicloud provider plugin
• Pre-created OSS bucket for remote state storage
• SSH key pair registered in Alibaba Cloud for ECS access

Common pitfalls

• Hardcoded Credentials: Embedding access_key in .tf files instead of CI/CD variables risks leaks and violates compliance.
• State Lock Conflicts: Running concurrent pipelines without oss backend locking causes terraform apply failures; always enable lock = true.
• ECS Security Group Misconfiguration: Omitting alicloud_security_group_rule for ports 22/80 blocks post-deployment SSH/HTTP access.
• Provider Version Drift: Skipping required_providers leads to breaking API changes; pin version = "~> 1.200.0" for alicloud.

Typical questions

• automate terraform deploy on Alibaba Cloud
• terraform CI/CD pipeline with ECS
• 阿里云 terraform 自动化部署
• set up terraform auth and deploy infra
• terraform gitlab pipeline ECS cluster
• 一键部署阿里云基础设施
• terraform credential setup and provision
• CI/CD terraform 部署 VPC ECS

Q: How do I automate Terraform infrastructure deployment on Alibaba Cloud using a CI/CD pipeline? A: Automating Terraform infrastructure deployment on Alibaba Cloud involves configuring authentication credentials, provisioning resources like VPCs and ECS clusters, and routing the workflow through a CI/CD pipeline that triggers on code commits. This setup utilizes integrated Terraform skills for authentication management, infrastructure provisioning, and continuous delivery automation alongside ECS configuration tools.