すべてをTerraformで管理しない。ecspressoを組み合わせたECS運用構成の検証

.
├── README.md
├── backend
│   ├── Dockerfile
│   ├── ecs
│   │   ├── config.yaml
│   │   ├── ecs-service-def.json
│   │   └── ecs-task-def.json
│   ├── go.mod
│   └── main.go
└── terraform
    ├── main.tf
    ├── modules
    │   ├── ecr
    │   │   └── ecr.tf
    │   ├── ecs
    │   │   ├── ecs.tf
    │   │   └── variables.tf
    │   ├── network
    │   │   ├── network.tf
    │   │   └── variables.tf
    │   └── security
    │       ├── iam.tf
    │       ├── security_group.tf
    │       └── variables.tf
    └── provider.tf

Copy

# iam.tfの一部

data "aws_iam_policy_document" "github_actions_assume_role" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    effect  = "Allow"

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::AWSアカウントID:oidc-provider/token.actions.githubusercontent.com"]
    }

    # 宛先(Audience)のチェック
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }

    # ★ここで「特定のリポジトリ・ブランチ」に絞り込む
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:GitHubアカウント名/リポジトリ名:ref:refs/heads/main"]
    }
  }
}

resource "aws_iam_role" "github_actions" {
  name               = "${var.app_name}-github-actions-deploy-role"
  assume_role_policy = data.aws_iam_policy_document.github_actions_assume_role.json
}

data "aws_iam_policy_document" "ecr_push_limited" {
  statement {
    actions   = ["ecr:GetAuthorizationToken"]
    resources = ["*"]
  }

  statement {
    actions = [
      "ecr:CompleteLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:InitiateLayerUpload",
      "ecr:BatchCheckLayerAvailability",
      "ecr:PutImage",
      "ecr:BatchGetImage"
    ]
    resources = [var.ecr_repository_arn]
  }
}

resource "aws_iam_policy" "ecr_push_policy" {
  name   = "${var.app_name}-ecr-push-policy"
  policy = data.aws_iam_policy_document.ecr_push_limited.json
}

resource "aws_iam_role_policy_attachment" "attach_ecr_push" {
  role       = aws_iam_role.github_actions.name
  policy_arn = aws_iam_policy.ecr_push_policy.arn
}

data "aws_iam_policy_document" "ecspresso_deploy" {
  statement {
    effect = "Allow"
    actions = [
      "ecs:RegisterTaskDefinition",
      "ecs:UpdateService",
      "ecs:DescribeServices",
      "ecs:DescribeTaskDefinition",
      "ecs:DescribeTasks",
      "ecs:ListTasks",
      "ecs:TagResource",
      "ecs:DescribeServiceDeployments"
    ]
    resources = ["*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "application-autoscaling:DescribeScalableTargets",
      "application-autoscaling:DescribeScalingPolicies"
    ]
    resources = ["*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:ListBucket"
    ]
    resources = [
      "arn:aws:s3:::バケット名",
      "arn:aws:s3:::バケット名/*"
    ]
  }

  statement {
    effect  = "Allow"
    actions = ["iam:PassRole"]
    resources = [
      aws_iam_role.ecs_execution_role.arn,
      aws_iam_role.ecs_task_role.arn
    ]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "ecspresso_deploy_policy" {
  name   = "${var.app_name}-ecspresso-deploy-policy"
  policy = data.aws_iam_policy_document.ecspresso_deploy.json
}

resource "aws_iam_role_policy_attachment" "attach_ecspresso_deploy" {
  role       = aws_iam_role.github_actions.name
  policy_arn = aws_iam_policy.ecspresso_deploy_policy.arn
}

Copy

# deploy.yaml

name: Deploy to AWS ECS

on:
  push:
    branches: [ "main" ]
    paths:
      - 'backend/'
      - '.github/workflows/'

env:
  AWS_REGION: ap-northeast-1
  ECR_REPOSITORY: ECRリポジトリ名
  ECS_CLUSTER: ECSクラスター名
  ECS_SERVICE: ECSサービス名

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build, tag, and push image to Amazon ECR
        id: build-image
        working-directory: ./backend
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT


      - name: Install ecspresso
        uses: kayac/ecspresso@v2
        with:
          version: v2.7.0 

      - name: Deploy to Amazon ECS
        working-directory: ./backend/ecs
        env:
          IMAGE_TAG: ${{ steps.build-image.outputs.image_tag }}
        run: |
          ecspresso deploy --config config.yaml

Copy