# 1. dev 환경 배포
cd terraform/envs/dev
terraform init
terraform apply

# 2. Terraform Output 저장 (중요!)
terraform output > /tmp/tf-output.txt

# 3. kubeconfig 업데이트
aws eks update-kubeconfig --name eks-dev --region ap-northeast-2

# 4. 클러스터 확인
kubectl get nodes

# dev 환경 추천
# - 첫 구축: dev로 시작
# - 테스트: 변경 사항 먼저 dev에서 검증
# - 비용: 가장 저렴

# stg 환경 추천
# - 프로덕션 배포 전 최종 검증
# - prd와 동일한 설정

# prd 환경 추천
# - 실제 운영 환경
# - 높은 가용성 요구

# 기본 프로필
aws configure --profile eks-admin

# 또는 직접 환경 변수로
export AWS_PROFILE=eks-admin
export AWS_REGION=ap-northeast-2

# macOS
brew install awscli

# Linux
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# 설치 확인
aws --version
aws sts get-caller-identity

# macOS
brew install session-manager-plugin

# Linux
curl -o session-manager-plugin.deb \
  https://s3.amazonaws.com/session-manager-downloads/plugin/latest/ubuntu_64bit/session-manager-plugin.deb
sudo dpkg -i session-manager-plugin.deb

# 설치 확인
session-manager-plugin --version

# Ed25519 권장 (더 짧고 안전)
ssh-keygen -t ed25519 -f ~/.ssh/aws-key -N ""

# AWS에 등록
aws ec2 import-key-pair \
  --key-name "aws-key" \
  --public-key-material fileb://~/.ssh/aws-key.pub

# 확인
aws ec2 describe-key-pairs --query 'KeyPairs[*].KeyName'

# macOS
brew install terraform

# Linux (또는 공식 설치)
curl https://releases.hashicorp.com/terraform/1.14.0/terraform_1.14.0_linux_amd64.zip -o terraform.zip
unzip terraform.zip
sudo mv terraform /usr/local/bin/

# 설치 확인
terraform --version  # v1.14.0 이상

# macOS
brew install kubectl

# Linux
curl -LO https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl
chmod +x kubectl
sudo mv kubectl /usr/local/bin/

# 설치 확인
kubectl version --client

# Helm
brew install helm  # macOS
# 또는 Linux: curl https://get.helm.sh/helm-v3.12.0-linux-amd64.tar.gz | tar -xz; sudo mv linux-amd64/helm /usr/local/bin/

# Kustomize
brew install kustomize  # macOS
# 또는 Linux: curl -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.8.0/kustomize_v5.8.0_linux_amd64.tar.gz | tar -xz; sudo mv kustomize /usr/local/bin/

# 확인
helm version
kustomize version

aws --version && kubectl version --client && terraform --version && helm version && kustomize version

# 기본 정보
name    = "eks-dev"
region  = "ap-northeast-2"

# 클러스터 설정
vpc_cidr                    = "10.0.0.0/16"
endpoint_public_access      = true              # dev: public 접근 허용
endpoint_public_access_cidrs = ["0.0.0.0/0"]    # dev: 제한 없음 (테스트용)

# 노드 그룹 설정 (관리형 노드, 항상 1개 유지)
node_group_instance_types = ["t3.medium"]
node_group_min_size       = 1
node_group_max_size       = 3
node_group_desired_size   = 2

# 노드 스케일링 선택
use_karpenter = true    # true: Karpenter, false: Cluster Autoscaler

# bastion ssh key
key_name = aws_key

# 기본 정보
name    = "eks-prd"
region  = "ap-northeast-2"

# 클러스터 설정
vpc_cidr                    = "10.0.0.0/16"
endpoint_public_access      = false             # prd: private 접근만

# 노드 그룹 설정
node_group_instance_types = ["m5.xlarge"]
node_group_min_size       = 2
node_group_max_size       = 10
node_group_desired_size   = 3

# 노드 스케일링
use_karpenter = true

terraform {
  backend "local" {
    path = "terraform.tfstate"
  }
}

# 1. S3 Bucket 생성
aws s3api create-bucket \
  --bucket eks-terraform-state-$(date +%Y%m%d) \
  --region ap-northeast-2 \
  --create-bucket-configuration LocationConstraint=ap-northeast-2

# 2. 버전 관리 활성화
BUCKET_NAME="eks-terraform-state-20260101"
aws s3api put-bucket-versioning \
  --bucket $BUCKET_NAME \
  --versioning-configuration Status=Enabled

# 3. DynamoDB Lock Table 생성
aws dynamodb create-table \
  --table-name terraform-locks \
  --attribute-definitions AttributeName=LockID,AttributeType=S \
  --key-schema AttributeName=LockID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST \
  --region ap-northeast-2

terraform {
  backend "s3" {
    bucket         = "eks-terraform-state-20260101"
    key            = "dev/terraform.tfstate"
    region         = "ap-northeast-2"
    dynamodb_table = "terraform-locks"
  }
}

aws s3 ls s3://eks-terraform-state-20260101/
aws dynamodb describe-table --table-name terraform-locks

# 로그 그룹 확인
export CLUSTER_NAME=eks-dev
aws logs describe-log-groups --log-group-name-prefix "/aws/eks/${CLUSTER_NAME}/cluster"

# 기존 로그 그룹 삭제 (필요시)
aws logs delete-log-group --log-group-name "/aws/eks/${CLUSTER_NAME}/cluster"

cd terraform/envs/dev

# 1. Backend 초기화
terraform init

# 2. 변수 검증
terraform validate

# 3. 배포 계획 확인
terraform plan -out=tfplan

# 배포 실행
terraform apply tfplan

# 소요 시간: 약 15~20분
aws eks describe-cluster --name eks-dev --query 'cluster.status'

# kubeconfig 업데이트
aws eks update-kubeconfig --name eks-dev --region ap-northeast-2

# 클러스터 정보 확인
kubectl cluster-info
kubectl get nodes

# 모든 Output 조회
terraform output

# 개별 Output 조회
terraform output eks_cluster_name
terraform output alb_controller_irsa_arn
terraform output karpenter_queue_name
terraform output vpc_id

# 파일로 저장
terraform output -json > /tmp/eks-outputs.json

# 또는 텍스트로
cat << EOF > /tmp/eks-info.txt
Cluster Name: $(terraform output -raw eks_cluster_name)
ALB IRSA ARN: $(terraform output -raw alb_controller_irsa_arn)
Karpenter Queue Name: $(terraform output -raw karpenter_queue_name)
VPC ID: $(terraform output -raw vpc_id)
EOF

# 현재 디렉토리에서 실행 (terraform/envs/dev)
terraform output -json > /tmp/eks-outputs.json

# 개별 값 확인
echo "Cluster Name: $(terraform output -raw eks_cluster_name)"
echo "ALB IRSA ARN: $(terraform output -raw alb_controller_irsa_arn)"
echo "Karpenter IRSA ARN: $(terraform output -raw karpenter_irsa_arn)"
echo "VPC ID: $(terraform output -raw vpc_id)"

helm version
kustomize version
kubectl version --client

# Prometheus CRD 설치 (ServiceMonitor 배포를 위해 필요)
export PROMETHEUS_VERSION=72.6.4
export PROMETHEUS_BASE_URL=https://raw.githubusercontent.com/prometheus-community/helm-charts/refs/tags/kube-prometheus-stack-${PROMETHEUS_VERSION}

kubectl apply --server-side=true -f ${PROMETHEUS_BASE_URL}/charts/kube-prometheus-stack/charts/crds/crds/crd-servicemonitors.yaml
kubectl apply --server-side=true -f ${PROMETHEUS_BASE_URL}/charts/kube-prometheus-stack/charts/crds/crds/crd-prometheuses.yaml

# 설치 확인
kubectl get crd | grep "servicemonitors\|prometheuses"

# 공통 환경 변수
export DEPLOY_ENV=dev  # dev, stg, prd

# 공통 명령어 패턴
make pull        # Helm Chart 다운로드 (해당하는 경우)
make preview     # 배포될 매니페스트 미리보기
make apply       # 배포 실행
make delete      # 배포 삭제

# 레이블 확인
kubectl get nodes -l node-role.kubernetes.io/system=true

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: gp3
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  fsType: ext4
  encrypted: "true"
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
reclaimPolicy: Delete

# 1. 기존 gp2 StorageClass에서 default 설정 제거
kubectl patch storageclass gp2 -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'

# 2. gp3 StorageClass 배포
cd gitops/storagclass

# 매니페스트 미리보기
make preview

# 배포
make apply

# StorageClass 및 EBS CSI Driver 확인
kubectl get storageclass
kubectl get pods -n kube-system | grep ebs-csi

cd gitops/cert-manager

make pull

# 배포
make apply

# 또는 환경 지정
make apply DEPLOY_ENV=dev

# Pod 상태 확인
kubectl get pods -n security

# Webhook 및 CRD 확인
kubectl get validatingwebhookconfigurations | grep cert-manager
kubectl get crd | grep cert-manager

# 테스트용 Issuer 생성
kubectl apply -f - << EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
EOF

# ClusterIssuer 확인
kubectl get clusterissuer

serviceAccount:
  create: true
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789:role/eks-dev-alb-controller-xxxx  # terraform output 값

clusterName: eks-dev  # terraform output 값

vpcId: vpc-0xxxxx  # terraform output 값

region: ap-northeast-2

# ALB Controller 설정
replicaCount: 2

# 리소스 제한
resources:
  limits:
    cpu: 200m
    memory: 500Mi
  requests:
    cpu: 100m
    memory: 200Mi

# 로그 레벨
logLevel: info

cd gitops/alb

# Helm Chart Pull
make pull

# 배포 미리보기
make preview DEPLOY_ENV=dev

# 배포 실행
make apply DEPLOY_ENV=dev

# Pod 및 IngressClass 확인
kubectl get pods -n kube-system | grep aws-load-balancer-controller
kubectl get ingressclass

# 로그 확인
kubectl logs -n kube-system -l app.kubernetes.io/name=aws-load-balancer-controller -f

# IAM 권한 확인
kubectl describe sa aws-load-balancer-controller -n kube-system | grep role-arn

cd gitops/karpenter

# Helm Chart Pull (ECR 인증 포함)
make pull

settings:
  clusterName: eks-dev  # terraform output 값
  interruptionQueue: Karpenter-eks-dev  # terraform output 값

# 컨트롤러를 관리형 노드에서만 실행
nodeSelector:
  karpenter.sh/controller: 'true'

# DNS 정책 설정
dnsPolicy: Default

# Webhook 비활성화 (단순화)
webhook:
  enabled: false

apiVersion: karpenter.k8s.aws/v1
kind: EC2NodeClass
metadata:
  name: eks-dev-nodeclass
spec:
  amiSelectorTerms:
    - alias: bottlerocket@latest
  role: eks-dev
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: eks-dev
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: eks-dev
  tags:
    karpenter.sh/discovery: eks-dev
  
  # 블록 디바이스 매핑
  blockDeviceMappings:
    - deviceName: /dev/xvdb
      ebs:
        volumeSize: 100Gi
        volumeType: gp3
        encrypted: true
        deleteOnTermination: true

apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: eks-dev-nodepool
spec:
  # 노드 템플릿
  template:
    metadata:
      labels:
        environment: dev
        team: platform
        provisioner: karpenter
    spec:
      # EC2NodeClass 참조
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: eks-dev-nodeclass

      # 인스턴스 요구사항
      requirements:
        # 아키텍처
        - key: kubernetes.io/arch
          operator: In
          values: ["amd64"]
        
        # 인스턴스 카테고리 (dev 환경: 비용 효율적)
        - key: "karpenter.k8s.aws/instance-category"
          operator: In
          values: ["t", "m", "c"]
        
        # 인스턴스 크기
        - key: "karpenter.k8s.aws/instance-size"
          operator: In
          values: ["medium", "large", "xlarge"]
        
        # 가용성 영역
        - key: "karpenter.sh/capacity-type"
          operator: In
          values: ["spot", "on-demand"]

  # 리소스 제한
  limits:
    cpu: "1000"
    memory: "1000Gi"

disruption:                                # 노드 삭제(disruption) 및 통합(consolidation) 동작을 제어하는 정책
  consolidationPolicy: WhenEmptyOrUnderutilized  # 노드가 비어있거나(Empty) 자원이 낮게 사용 중일 때만 통합 대상
  consolidateAfter: 30s                    # 해당 상태가 연속으로 30초 이상 유지돼야 통합 후보로 인정
  budgets:                                 # 노드 삭제를 허용하는 시간과 수량을 제한하는 budget 설정
  - nodes: "1"                             # budget이 활성화된 시간 전체 동안 최대 1개 노드만 중단 허용
    schedule: "*/5 * * * *"                # 5분마다 노드 삭제를 허용하는 시간 창(window)을 시작
    duration: 1m                           # window가 열린 후 1분 동안만 중단 허용(그 외 시간에는 중단 불가)

# 배포 미리보기
make preview DEPLOY_ENV=dev

# 배포 실행
make apply DEPLOY_ENV=dev

# Pod, NodePool, EC2NodeClass 확인
kubectl get pods -n kube-system | grep karpenter
kubectl get nodepool
kubectl get ec2nodeclass

# 로그 확인
kubectl logs -n kube-system -l app.kubernetes.io/name=karpenter -f

# 리소스 상태 확인
kubectl describe nodepool eks-dev-nodepool
kubectl describe ec2nodeclass eks-dev-nodeclass

# 기존 inflate deployment 확인 (이미 배포되어 있어야 함)
kubectl get deployment inflate -n kube-system

# 현재 replicas 수 확인
kubectl get deployment inflate -n kube-system -o jsonpath='{.spec.replicas}'

kubectl -n kube-system scale deploy inflate --replicas=5

kubectl get nodes -L karpenter.sh/registered
kubectl logs -f -n kube-system -l app.kubernetes.io/name=karpenter -c controller

kubectl -n kube-system scale deploy inflate --replicas=1

# 노드 상태 확인 (통합/삭제 대기)
watch kubectl get nodes

aws ssm start-session --target $KARPENTER_INSTANCE_ID

# CPU 코어 수 확인
cat /proc/cpuinfo | grep processor | wc -l

# 메모리 정보 확인
cat /proc/meminfo

# 디스크 사용량 확인
df -h

# 현재 실행 중인 Pod 확인 (kubelet 관점)
crictl ps

# 시스템 리소스 사용률 확인
top -n 1

# 네트워크 인터페이스 확인
ip addr show

# 노드 메타데이터 확인
curl -s http://169.254.169.254/latest/meta-data/instance-type
curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone

# Cluster Autoscaler 설정
cloudProvider: aws
awsRegion: ap-northeast-2  # 서울 리전 (필요시 변경)

# AWS IAM Role (IRSA)
rbac:
  create: true
  serviceAccount:
    create: true
    name: cluster-autoscaler
    annotations:
      eks.amazonaws.com/role-arn: "arn:aws:iam::020211325831:role/eks-stg-cluster-autoscaler-2025122802491282630000000e" # terraform output

# ASG 자동 발견
autoDiscovery:
  clusterName: eks-dev # terraform output
  enabled: true
  tags:
    - k8s.io/cluster-autoscaler/enabled
    - k8s.io/cluster-autoscaler/{{ .Values.autoDiscovery.clusterName }}

cd gitops/autoscaler

# Helm Chart Pull
make pull

# 배포
make apply DEPLOY_ENV=dev

# 배포 확인
kubectl get pods -n kube-system | grep cluster-autoscaler

# 업데이트 체크 주기 (매주 월,수 18:00)
scheduler_cron_expression: "0 0 18 * * Mon,Wed *"

# 업데이트 완료 후 로드밸런서에서 제외되는 대기 시간 (초)
exclude_from_lb_wait_time_in_sec: "180"

# 동시 업데이트 최대 노드 수
max_concurrent_updates: "1"

# Prometheus ServiceMonitor 활성화
prometheus:
  controller:
    serviceMonitor:
      enabled: true

cd gitops/bottlerocket-update

# Helm Chart Pull
make pull

# 배포
make apply DEPLOY_ENV=dev

# Pod 상태 확인
kubectl get pods -n kube-system

# CRD 확인
kubectl get crd | grep bottlerocket

# Update 정책 확인
kubectl get updatepolicy -A

# 로그 확인
kubectl logs -n kube-system -l  brupop.bottlerocket.aws/component: apiserver
kubectl logs -n kube-system -l  brupop.bottlerocket.aws/component: brupop-controller

# 1. Bastion Instance ID 확인
INSTANCE_ID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=*bastion*" \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

# 2. 세션 시작
aws ssm start-session --target $INSTANCE_ID

# 3. 내부에서
ubuntu@bastion:~$ aws eks update-kubeconfig --name eks-dev --region ap-northeast-2
ubuntu@bastion:~$ kubectl get nodes

# 1. Bastion EIP 확인
BASTION_IP=$(aws ec2 describe-addresses \
  --filters "Name=tag:Name,Values=*bastion*" \
  --query 'Addresses[0].PublicIp' \
  --output text)

# 2. SSH 접속
ssh -i ~/.ssh/aws-key ubuntu@$BASTION_IP

# 3. 내부에서
ubuntu@bastion:~$ kubectl get nodes

aws eks update-kubeconfig --name eks-dev --region ap-northeast-2
kubectl cluster-info

aws eks update-cluster-config \
  --name <CLUSTER_NAME> \
  --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true

aws eks update-kubeconfig --name <CLUSTER_NAME> --region <REGION>

sudo apt update
sudo apt install -y curl unzip

aws eks update-kubeconfig --name eks-dev --region ap-northeast-2
kubectl cluster-info

kubectl apply -f - << EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-ebs-pvc
  namespace: default
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
  storageClassName: gp3
EOF

kubectl apply -f - << EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80
        volumeMounts:
          - name: ebs-storage
            mountPath: /usr/share/nginx/html
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "200m"
            memory: "256Mi"
      volumes:
        - name: ebs-storage
          persistentVolumeClaim:
            claimName: my-ebs-pvc
EOF

kubectl apply -f - << EOF
apiVersion: v1
kind: Service
metadata:
  name: nginx
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
    service.beta.kubernetes.io/aws-load-balancer-target-type: ip
spec:
  type: LoadBalancer
  loadBalancerClass: service.k8s.aws/nlb
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 80
EOF

kubectl get pvc my-ebs-pvc              # PVC 상태 확인
kubectl get pods -l app=nginx           # Pod 상태 확인
kubectl get pv                          # PV 확인 (자동으로 생성됨)
kubectl describe pod -l app=nginx | grep -A 5 "Mounts:"  # 마운트 확인

kubectl get svc nginx
# EXTERNAL-IP 열의 주소로 접근 가능

kubectl apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/group.name: platform
spec:
  ingressClassName: alb
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx
            port:
              number: 80
EOF

kubectl get ingress nginx-ingress
kubectl describe ingress nginx-ingress

# ALB 주소 추출
ALB_ADDRESS=$(kubectl get ingress nginx-ingress -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
echo "ALB Address: $ALB_ADDRESS"

# Route53 또는 /etc/hosts에서 DNS 설정
echo "$ALB_ADDRESS app.example.com" | sudo tee -a /etc/hosts

# 접근 테스트
curl -H "Host: app.example.com" http://$ALB_ADDRESS

kubectl delete ingress --all
kubectl delete svc --all
kubectl delete sts --all
kubectl delete deployment --all

# PVC 및 PV 확인 후 삭제
kubectl get pvc -A
kubectl get pv
kubectl delete pvc --all -A
kubectl delete pv --all

cd gitops/bottlerocket && make delete DEPLOY_ENV=dev
cd gitops/alb && make delete DEPLOY_ENV=dev
cd gitops/cert-manager && make delete DEPLOY_ENV=dev
cd gitops/karpenter && make delete DEPLOY_ENV=dev

# karpenter.sh/do-not-disrupt annotation 제거
kubectl get pods -A -o json | jq -r '.items[] | select(.metadata.annotations["karpenter.sh/do-not-disrupt"]=="true" and .spec.nodeName!=null) | "\(.metadata.namespace) \(.metadata.name) \(.spec.nodeName)"'
kubectl annotate pod <pod-name> -n <namespace> karpenter.sh/do-not-disrupt-

# 특정 NodePool 삭제
kubectl get get nodepool
kubectl delete nodeclaim -l karpenter.sh/nodepool=<nodepool-name>
kubectl delete nodepool <nodepool-name>
kubectl delete node -l karpenter.sh/nodepool=<nodepool-name>

cd terraform/envs/dev && terraform destroy

aws dynamodb delete-table --table-name terraform-locks
aws s3 rb s3://eks-terraform-state-20260101 --force

export name=eks-dev
aws logs delete-log-group --log-group-name "/aws/eks/${name}/cluster"

# 1. kubeconfig 다시 생성
aws eks update-kubeconfig --name eks-dev --region ap-northeast-2

# 2. 권한 확인
aws sts get-caller-identity

# 3. 클러스터 접근 권한 확인
kubectl auth can-i create pods --as=$(aws sts get-caller-identity --query 'Arn' --output text)

kubectl describe nodes
kubectl logs -n kube-system -l app.kubernetes.io/name=karpenter -f

# EC2 제한 확인
aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceType' | sort | uniq -c

kubectl logs -n kube-system -l app=cluster-autoscaler -f

# 1. ALB Controller 상태 확인
kubectl get pods -n kube-system | grep alb
kubectl logs -n kube-system -l app.kubernetes.io/name=aws-load-balancer-controller -f

# 2. IAM 권한 확인
kubectl describe sa aws-load-balancer-controller -n kube-system | grep role-arn

# 3. Ingress 상태 확인
kubectl describe ingress <name>

export AWS_PROFILE=eks-prd
terraform apply

# 이전 state 버전 확인
aws s3api list-object-versions \
  --bucket eks-terraform-state-xxxx \
  --prefix path/to/terraform.tfstate

# 복구할 버전 다운로드
aws s3api get-object \
  --bucket eks-terraform-state-xxxx \
  --key path/to/terraform.tfstate \
  --version-id <VERSION_ID> \
  terraform.tfstate.recover

# 검증 후 state 복원
terraform state push terraform.tfstate.recover