Skip to content

Commit 3281ad7

Browse files
fengchi@alibaba-inc.comshanye997
fengchi@alibaba-inc.com
authored and
shanye997
committed
添加 构建大模型应用的安全防护体系 的 terraform 模板
1 parent bca8118 commit 3281ad7

File tree

6 files changed

+174
-40
lines changed

6 files changed

+174
-40
lines changed

‎solution/tech-solution/build-large-model-application-security-system/README.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
## Introduction
2+
3+
<!-- DOCS_DESCRIPTION_CN -->
4+
本示例用于实现解决方案[构建大模型应用的安全防护体系](https://www.aliyun.com/solution/tech-solution/build-large-model-application-security-system), 涉及到专有网络（VPC）、交换机（VSwitch）、云服务器（ECS）、RAM 用户等资源的创建。
5+
<!-- DOCS_DESCRIPTION_CN -->
6+
7+
<!-- DOCS_DESCRIPTION_EN -->
8+
This example demonstrates the implementation of the solution [Building a Security Protection System for Large Model Applications](https://www.aliyun.com/solution/tech-solution/build-large-model-application-security-system). It involves the creation, and deployment of resources such as Virtual Private Cloud (VPC), VSwitch, Elastic Compute Service (ECS), and RAM users.
9+
<!-- DOCS_DESCRIPTION_EN -->
10+
11+
12+
<!-- BEGIN_TF_DOCS -->
13+
## Providers
14+
15+
| Name | Version |
16+
|------|---------|
17+
| <a name="provider_alicloud"></a> [alicloud](#provider\_alicloud) | n/a |
18+
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
19+
20+
## Modules
21+
22+
No modules.
23+
24+
## Resources
25+
26+
| Name | Type |
27+
|------|------|
28+
| [alicloud_ecs_command.run_command](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ecs_command) | resource |
29+
| [alicloud_ecs_invocation.invoke_script](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ecs_invocation) | resource |
30+
| [alicloud_instance.ecs_instance](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/instance) | resource |
31+
| [alicloud_ram_access_key.ramak](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_access_key) | resource |
32+
| [alicloud_ram_user.ram_user](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_user) | resource |
33+
| [alicloud_ram_user_policy_attachment.attach_policy_to_user](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_user_policy_attachment) | resource |
34+
| [alicloud_security_group.security_group](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group) | resource |
35+
| [alicloud_security_group_rule.allow_tcp_80](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group_rule) | resource |
36+
| [alicloud_vpc.vpc](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vpc) | resource |
37+
| [alicloud_vswitch.vswitch1](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vswitch) | resource |
38+
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
39+
| [alicloud_images.default](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/data-sources/images) | data source |
40+
41+
## Inputs
42+
43+
| Name | Description | Type | Default | Required |
44+
|------|-------------|------|---------|:--------:|
45+
| <a name="input_bai_lian_api_key"></a> [bai\_lian\_api\_key](#input\_bai\_lian\_api\_key) | 百炼 API-KEY，需开通百炼模型服务再获取 API-KEY，详情请参考：https://help.aliyun.com/zh/model-studio/developer-reference/get-api-key | `string` | n/a | yes |
46+
| <a name="input_ecs_instance_password"></a> [ecs\_instance\_password](#input\_ecs\_instance\_password) | 服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()\`~!@#$%^&*_-+=\|{}[]:;'<>,.?/ 中的特殊符号） | `string` | n/a | yes |
47+
| <a name="input_instance_type"></a> [instance\_type](#input\_instance\_type) | 实例类型 | `string` | `"ecs.e-c1m2.large"` | no |
48+
| <a name="input_region"></a> [region](#input\_region) | 地域，例如：cn-hangzhou。所有地域及可用区请参见文档：https://help.aliyun.com/document_detail/40654.html#09f1dc16b0uke | `string` | `"cn-hangzhou"` | no |
49+
| <a name="input_zone_id1"></a> [zone\_id1](#input\_zone\_id1) | 可用区ID。选择可用区前请确认该可用区是否支持创建ECS资源的规格。例如：cn-hangzhou-k | `string` | `"cn-hangzhou-k"` | no |
50+
<!-- END_TF_DOCS -->

‎solution/tech-solution/build-large-model-application-security-system/main.tf

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
provider "alicloud" {
2+
region = var.region
3+
}
4+
5+
resource "random_id" "suffix" {
6+
byte_length = 8
7+
}
8+
9+
locals {
10+
common_name = random_id.suffix.id
11+
}
12+
13+
data "alicloud_images" "default" {
14+
name_regex = "^aliyun_3_x64_20G_alibase_.*"
15+
most_recent = true
16+
owners = "system"
17+
}
18+
19+
resource "alicloud_ram_user" "ram_user" {
20+
name = "create_by_solution-${local.common_name}"
21+
}
22+
23+
resource "alicloud_ram_access_key" "ramak" {
24+
user_name = alicloud_ram_user.ram_user.name
25+
}
26+
27+
resource "alicloud_ram_user_policy_attachment" "attach_policy_to_user" {
28+
user_name = alicloud_ram_user.ram_user.name
29+
policy_type = "System"
30+
policy_name = "AliyunYundunGreenWebFullAccess"
31+
}
32+
33+
resource "alicloud_security_group" "security_group" {
34+
security_group_name = "SG_${local.common_name}"
35+
vpc_id = alicloud_vpc.vpc.id
36+
}
37+
38+
resource "alicloud_security_group_rule" "allow_tcp_80" {
39+
type = "ingress"
40+
ip_protocol = "tcp"
41+
policy = "accept"
42+
port_range = "80/80"
43+
priority = 1
44+
security_group_id = alicloud_security_group.security_group.id
45+
cidr_ip = "0.0.0.0/0"
46+
}
47+
48+
resource "alicloud_vswitch" "vswitch1" {
49+
vpc_id = alicloud_vpc.vpc.id
50+
cidr_block = "192.168.1.0/24"
51+
zone_id = var.zone_id1
52+
vswitch_name = "VSW_${local.common_name}"
53+
}
54+
55+
resource "alicloud_instance" "ecs_instance" {
56+
instance_name = "ecs-${local.common_name}"
57+
system_disk_category = "cloud_essd"
58+
image_id = data.alicloud_images.default.images[0].id
59+
vswitch_id = alicloud_vswitch.vswitch1.id
60+
password = var.ecs_instance_password
61+
instance_type = var.instance_type
62+
internet_max_bandwidth_out = 5
63+
security_groups = [alicloud_security_group.security_group.id]
64+
}
65+
66+
resource "alicloud_vpc" "vpc" {
67+
cidr_block = "192.168.0.0/16"
68+
vpc_name = "VPC_${local.common_name}"
69+
}
70+
71+
resource "alicloud_ecs_command" "run_command" {
72+
name = "commond-install"
73+
command_content = base64encode(<<EOF
74+
cat <<EOT >> ~/.bash_profile
75+
export ROS_DEPLOY=true
76+
export BAILIAN_API_KEY=${var.bai_lian_api_key}
77+
export ALIBABA_CLOUD_ACCESS_KEY_ID=${alicloud_ram_access_key.ramak.id}
78+
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=${alicloud_ram_access_key.ramak.secret}
79+
EOT
80+
81+
source ~/.bash_profile
82+
curl -fsSL https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/install-script/ai-security/install.sh | bash
83+
EOF
84+
)
85+
working_dir = "/root"
86+
type = "RunShellScript"
87+
timeout = 3600
88+
}
89+
90+
resource "alicloud_ecs_invocation" "invoke_script" {
91+
instance_id = [alicloud_instance.ecs_instance.id]
92+
command_id = alicloud_ecs_command.run_command.id
93+
timeouts {
94+
create = "15m"
95+
}
96+
}

‎solution/tech-solution/build-large-model-application-security-system/outputs.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "web_url" {
2+
description = "Web 访问地址"
3+
value = format("http://%s", alicloud_instance.ecs_instance.public_ip)
4+
}

‎solution/tech-solution/build-large-model-application-security-system/variables.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
variable "region" {
2+
type = string
3+
default = "cn-hangzhou"
4+
description = "地域，例如：cn-hangzhou。所有地域及可用区请参见文档：https://help.aliyun.com/document_detail/40654.html#09f1dc16b0uke"
5+
}
6+
variable "zone_id1" {
7+
type = string
8+
default = "cn-hangzhou-k"
9+
description = "可用区ID。选择可用区前请确认该可用区是否支持创建ECS资源的规格。例如：cn-hangzhou-k"
10+
}
11+
variable "instance_type" {
12+
type = string
13+
default = "ecs.e-c1m2.large"
14+
description = "实例类型"
15+
}
16+
variable "ecs_instance_password" {
17+
type = string
18+
sensitive = true
19+
description = "服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）"
20+
}
21+
variable "bai_lian_api_key" {
22+
type = string
23+
description = "百炼 API-KEY，需开通百炼模型服务再获取 API-KEY，详情请参考：https://help.aliyun.com/zh/model-studio/developer-reference/get-api-key"
24+
}

‎tech-solution/solution-example/README.md

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎tech-solution/solution-example/main.tf

Lines changed: 0 additions & 15 deletions
This file was deleted.

0 commit comments

Comments
 (0)