フルスタックアプリを AWS にデプロイする — ECS Fargate キャップストーン

                  Route 53 (ドメイン)
                       │
              ┌────────┴─────────┐
              ▼                  ▼
        CloudFront          ALB (HTTPS, ACM)
       (静的アセット/S3)    ╱            ╲
                         ▼              ▼
                 ECS Fargate      ECS Fargate
                 (Next.js SSR)    (FastAPI API)
                      private subnet (2 AZ)
                                   │
                                   ▼
                          RDS PostgreSQL
                       (Aurora Serverless v2)
                          isolated subnet
                                   ▲
                          Secrets Manager (DB 認証情報)

infra/
├── backend.tf          # 1ステップ: state の保存先
├── providers.tf        # provider + region
├── vpc.tf              # 2ステップ: 3-tier VPC
├── ecr.tf              # 3ステップ: イメージの保存先
├── rds.tf              # 4·5ステップ: Aurora Serverless v2 + シークレット
├── alb.tf              # 6ステップ: ALB + ACM + ターゲットグループ
├── ecs-api.tf          # 7·8ステップ: FastAPI Task/Service
├── ecs-web.tf          # 9ステップ: Next.js Task/Service
├── cdn.tf              # 10ステップ: S3 + CloudFront
├── dns.tf              # 11ステップ: Route 53
├── monitoring.tf       # 13ステップ: CloudWatch アラーム
└── variables.tf

terraform {
  required_version = ">= 1.9"
  backend "s3" {
    bucket         = "myapp-tfstate"
    key            = "capstone/terraform.tfstate"
    region         = "ap-northeast-2"
    dynamodb_table = "myapp-tflock"
    encrypt        = true
  }
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 6.0" }
  }
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "myapp"
  cidr = "10.0.0.0/16"
  azs  = ["ap-northeast-2a", "ap-northeast-2c"]

  public_subnets   = ["10.0.0.0/20", "10.0.128.0/20"]   # ALB, NAT
  private_subnets  = ["10.0.16.0/20", "10.0.144.0/20"]  # Fargate
  database_subnets = ["10.0.32.0/20", "10.0.160.0/20"]  # RDS (isolated)

  enable_nat_gateway = true
  single_nat_gateway = false   # AZ ごとに NAT (28章 推奨)
}

# S3 / ECR トラフィックは NAT ではなく Endpoint で (コスト削減)
module "vpc_endpoints" {
  source  = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"
  version = "~> 5.0"
  vpc_id  = module.vpc.vpc_id
  endpoints = {
    s3   = { service = "s3", service_type = "Gateway", route_table_ids = module.vpc.private_route_table_ids }
    ecr_api = { service = "ecr.api", subnet_ids = module.vpc.private_subnets }
    ecr_dkr = { service = "ecr.dkr", subnet_ids = module.vpc.private_subnets }
  }
}

resource "aws_ecr_repository" "api" {
  name                 = "myapp-api"
  image_tag_mutability = "MUTABLE"
  image_scanning_configuration { scan_on_push = true }
}

resource "aws_ecr_repository" "web" {
  name                 = "myapp-web"
  image_scanning_configuration { scan_on_push = true }
}

resource "aws_rds_cluster" "main" {
  cluster_identifier = "myapp"
  engine             = "aurora-postgresql"
  engine_version     = "16.4"
  database_name      = "myapp"
  master_username    = "myapp"

  manage_master_user_password = true            # → Secrets Manager に自動生成
  db_subnet_group_name        = module.vpc.database_subnet_group_name
  vpc_security_group_ids      = [aws_security_group.rds.id]

  serverlessv2_scaling_configuration {
    min_capacity = 0       # 0 ACU 自動一時停止 (アイドル時のコンピューティング課金 0)
    max_capacity = 4.0
  }
  skip_final_snapshot = true   # 学習環境限定
}

resource "aws_rds_cluster_instance" "main" {
  cluster_identifier = aws_rds_cluster.main.id
  instance_class     = "db.serverless"
  engine             = aws_rds_cluster.main.engine
}

# RDS が作ったシークレット ARN — ECS Task がこれを参照
output "db_secret_arn" {
  value = aws_rds_cluster.main.master_user_secret[0].secret_arn
}

resource "aws_lb" "main" {
  name               = "myapp-alb"
  load_balancer_type = "application"
  subnets            = module.vpc.public_subnets
  security_groups    = [aws_security_group.alb.id]
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = 443
  protocol          = "HTTPS"
  certificate_arn   = aws_acm_certificate.main.arn
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.web.arn   # デフォルト = Next.js
  }
}

resource "aws_lb_listener_rule" "api" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 10
  action { type = "forward", target_group_arn = aws_lb_target_group.api.arn }
  condition { host_header { values = ["api.example.com"] } }
}

resource "aws_ecs_task_definition" "api" {
  family                   = "myapp-api"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "512"
  memory                   = "1024"
  execution_role_arn       = aws_iam_role.ecs_exec.arn   # ECR pull, シークレット read
  task_role_arn            = aws_iam_role.app.arn        # アプリが使う権限

  container_definitions = jsonencode([{
    name         = "api"
    image        = "${aws_ecr_repository.api.repository_url}:latest"
    portMappings = [{ containerPort = 8000 }]
    secrets = [{
      name      = "DB_SECRET"   # RDS が作ったシークレット(ホスト・パスワードの JSON)
      valueFrom = aws_rds_cluster.main.master_user_secret[0].secret_arn
    }]
    logConfiguration = {
      logDriver = "awslogs"
      options = {
        "awslogs-group"         = "/ecs/myapp-api"
        "awslogs-region"        = "ap-northeast-2"
        "awslogs-stream-prefix" = "api"
      }
    }
  }])
}

resource "aws_ecs_service" "api" {
  name            = "myapp-api"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.api.arn
  desired_count   = 2                     # 2 AZ
  launch_type     = "FARGATE"
  network_configuration {
    subnets         = module.vpc.private_subnets
    security_groups = [aws_security_group.api.id]
  }
  load_balancer {
    target_group_arn = aws_lb_target_group.api.arn
    container_name   = "api"
    container_port   = 8000
  }
}

aws ecs run-task \
  --cluster myapp \
  --task-definition myapp-api \
  --launch-type FARGATE \
  --overrides '{"containerOverrides":[{"name":"api","command":["alembic","upgrade","head"]}]}' \
  --network-configuration "awsvpcConfiguration={subnets=[subnet-...],securityGroups=[sg-...]}"

resource "aws_route53_record" "web" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = "example.com"
  type    = "A"
  alias {
    name                   = aws_cloudfront_distribution.web.domain_name
    zone_id                = aws_cloudfront_distribution.web.hosted_zone_id
    evaluate_target_health = false
  }
}

resource "aws_route53_record" "api" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = "api.example.com"
  type    = "A"
  alias {
    name                   = aws_lb.main.dns_name
    zone_id                = aws_lb.main.zone_id
    evaluate_target_health = true
  }
}

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/gha-deploy
    aws-region: ap-northeast-2
- uses: aws-actions/amazon-ecr-login@v2
- run: |
    docker build -t $ECR/myapp-api:$GITHUB_SHA ./api
    docker push $ECR/myapp-api:$GITHUB_SHA
- run: |
    aws ecs update-service --cluster myapp --service myapp-api \
      --force-new-deployment

resource "aws_cloudwatch_metric_alarm" "alb_5xx" {
  alarm_name          = "myapp-alb-5xx"
  namespace           = "AWS/ApplicationELB"
  metric_name         = "HTTPCode_Target_5XX_Count"
  statistic           = "Sum"
  period              = 60
  evaluation_periods  = 5
  threshold           = 10
  comparison_operator = "GreaterThanThreshold"
  alarm_actions       = [aws_sns_topic.alerts.arn]   # 19章 SNS で通知
  dimensions          = { LoadBalancer = aws_lb.main.arn_suffix }
}

terraform destroy