【手順解説】GitHub Actions×TerraformでAzure Functionsを自動構築する方法

az --version

Copy

terraform -v 

Copy

az login --use-device-code

Copy

$ az login--use-device-code
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXX to authenticate.

Retrieving tenants and subscriptionsforthe selection...

[Tenant and subscription selection]

No     Subscription name        Subscription ID             Tenant
-----  -----------------------  ----------------------  -----------
[1] *  XXXXXXXXXXXXXXXXXXXXXXX  XXXXXXXXXXXXXXXXXXXXXX  XXXXXXXXXXX

〜〜〜〜〜以下略〜〜〜〜〜

Copy

az group list --query "[].{Name:name, Location:location}" --output table

Copy

$ az group list --query "[].{Name:name, Location:location}" --output table
Name        Location
----------  ----------
XXXXXXXXXX  japaneast

Copy

az ad sp create-for-rbac --role="Contributor" --display-name="<任意のサービスプリンシパル名>" --scopes="/subscriptions/<サブスクリプションID>/resourceGroups/<リソースグループ名>"

Copy

$ az ad sp create-for-rbac --role="Contributor" --display-name="XXXXX" --scopes="/subscriptions/XXXXX/resourceGroups/XXXXX"
Creating 'Contributor' role assignment under scope '/subscriptions/XXXXX/resourceGroups/XXXXX'
The output includes credentials that you must protect. Be sure that youdonot include these credentialsinyour code or check the credentials into your source control. For more information, see <https://aka.ms/azadsp-cli>
{
  "appId": "XXXXX",
  "displayName": "XXXXX",
  "password": "XXXXX",
  "tenant": "XXXXX"
}

Copy

terraform-rag（任意のGitHubリポジトリ名）
├── .github
│   ├── workflows
│   │   └── terraform-apply.yml（任意のGitHub Actionsコードファイル名）
├── terraform（任意のTerraformコードディレクトリ名）
│   ├── .terraform.lock.hcl
│   ├── main.tf
│   ├── rg.tf
│   └── variables.tf
├── .gitignore
└── README.md

Copy

terraform {
        # Terraformプロバイダとそのバージョン指定（今回はAzureRM4.24.0以上を使用）
        required_providers {
                azurerm = {
                        source  = "hashicorp/azurerm"
                        version = "~> 4.24.0"
                }
        }
        # Terraform自体のバージョン指定（今回は1.10.1以上を使用）
        required_version = ">= 1.10.1"
}
provider "azurerm" {
        skip_provider_registration = true
        features {}
        subscription_id = var.subscription_id
        tenant_id       = var.tenant_id
        client_id       = var.client_id
        client_secret   = var.client_secret
}
resource "azurerm_api_management" "common" {
        name                = "rag-apim-${var.client}-${var.environment}"
        location            = data.azurerm_resource_group.rg.location
        resource_group_name = data.azurerm_resource_group.rg.name
        publisher_name      = "<APIの管理者名>"
        publisher_email     = "<ご自身のメールアドレス>"
        sku_name = "Consumption_0"
}
resource "azurerm_app_service_plan" "insertdb-function" {
        name                = "rag-appservice-${var.client}-${var.environment}"
        location            = data.azurerm_resource_group.rg.location
        resource_group_name = data.azurerm_resource_group.rg.name
        kind                = "Linux"
        reserved            = true
        sku {
                tier = "Standard"
                size = "S1"
        }
}
resource "azurerm_storage_account" "insertdb-function" {
        name                     = "raginsertdb${var.client}${var.environment}"
        resource_group_name      = data.azurerm_resource_group.rg.name
        location                 = data.azurerm_resource_group.rg.location
        account_tier             = "Standard"
        account_replication_type = "LRS"
}
resource "azurerm_function_app" "insertdb-function" {
        name                       = "rag-insertdb-${var.client}-${var.environment}"
        location                   = data.azurerm_resource_group.rg.location
        resource_group_name        = data.azurerm_resource_group.rg.name
        app_service_plan_id        = azurerm_app_service_plan.insertdb-function.id
        storage_account_name       = azurerm_storage_account.insertdb-function.name
        storage_account_access_key = azurerm_storage_account.insertdb-function.primary_access_key
        version                    = "~3"
        site_config {
                linux_fx_version        = "PYTHON|3.11"
        }
}
resource "azurerm_log_analytics_workspace" "insertdb-function" {
        name                = "rag-workspace-${var.client}-${var.environment}"
        location            = data.azurerm_resource_group.rg.location
        resource_group_name = data.azurerm_resource_group.rg.name
        sku                 = "PerGB2018"
        retention_in_days   = 30
}
resource "azurerm_application_insights" "insertdb-function" {
        name                = "rag-insights-${var.client}-${var.environment}"
        location            = data.azurerm_resource_group.rg.location
        resource_group_name = data.azurerm_resource_group.rg.name
        workspace_id        = azurerm_log_analytics_workspace.insertdb-function.id
        # アプリケーションタイプを指定（今回はHTTPベースのアプリケーションを監視するためwebを使用）
        application_type    = "web"
}

Copy

resource "azurerm_api_management" "common" {
        name                = "rag-apim-${var.client}-${var.environment}"
        location            = data.azurerm_resource_group.rg.location
        resource_group_name = data.azurerm_resource_group.rg.name
        publisher_name      = "<ご自身の会社名>"
        publisher_email     = "<ご自身のメールアドレス>"
        sku_name = "Consumption_0"
        tags = {
                AppName = "rag-common-${var.client}-${var.environment}"
                Author = "terraform"
                Client = var.client
                Env = var.environment
                System = "rag"
        }
}

Copy

# 既存のリソースグループの情報を取得
data "azurerm_resource_group" "rg" {
  name = var.resource_group_name
}

Copy

variable "subscription_id" {}
variable "client_id" {}
variable "client_secret" {}
variable "tenant_id" {}

# 任意のリージョンをデフォルトで設定可
variable "location" {
  default = "japaneast"
}

# GitHub Actions開始時の入力値を設定可
variable "resource_group_name" {
  default = "<リソースグループ名>"
}
variable "environment" {
  default = "<環境名>"
}
variable "client" {
  default = "<顧客名>"
}

Copy

name: '<フロー名>'
on:
  # 手動トリガーを設定
  workflow_dispatch:  
    inputs:
      resource_group_name:
        description: 'リソースグループ名'
        required: true
        default: '<リソースグループ名>'
      environment:
        description: '環境名'
        required: true
        default: '<環境名>'
      client:
        description: '顧客名'
        required: true
        default: '<顧客名>'
permissions:
  contents: read
  id-token: write
jobs:
  terraform:
    name: '<ジョブ名>'
    runs-on: ubuntu-latest
    environment: production
    steps:
    # リポジトリをGitHub Actionsランナーにチェックアウト
    - name: Checkout
      uses: actions/checkout@v4       
    # Azureにログイン
    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    # Terraformの指定バージョンをインストール
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v1
      with:
        terraform_version: 1.10.1
    # 新しいまたは既存のTerraform作業ディレクトリの初期ファイルを作成
    - name: Terraform Init
      run: terraform init
      working-directory: terraform
    # Terraformの実行プランを生成
    - name: Terraform Plan
      run: |
        terraform plan \\
          -var "environment=${{ github.event.inputs.environment }}" \\
          -input=false
      working-directory: terraform
    # Terraform設定ファイルに従ってインフラを構築または変更
    - name: Terraform Apply
      env:
        CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
        CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
        SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
        TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      run: |
        terraform apply -auto-approve \\
          -var "resource_group_name=${{ github.event.inputs.resource_group_name }}" \\
          -var "environment=${{ github.event.inputs.environment }}" \\
          -var "client=${{ github.event.inputs.client }}"
      working-directory: terraform

Copy

    # ステートファイルを指定のストレージにアップロード
    - name: Upload State File to Azure Storage
      run: |
        az storage blob upload \\
          --account-name "<ストレージアカウント名>" \\
          --container-name "<コンテナ名>" \\
          --file terraform/terraform.tfstate \\
          --name "${{ github.event.inputs.resource_group_name }}.tfstate"

Copy

resource "azurerm_api_management" "common" {
        name                = 
"rag-apim-${var.client}-${var.environment}"
〜〜〜〜〜以下略〜〜〜〜〜

Copy

resource "azurerm_app_service_plan" "insertdb-function" {
        name                = "rag-appservice-${var.client}-${var.environment}"
        location            = data.azurerm_resource_group.rg.location
        resource_group_name = data.azurerm_resource_group.rg.name
        kind                = "Linux"
        reserved            = true
        sku {
                tier = "Standard"
                size = "S1"
        }
}

Copy

output "instrumentation_key" {
  value = azurerm_application_insights.example.instrumentation_key
}

Copy