【AWS】2026年最新機能「S3 Files」をTerraformで構築する手順と3つのハマりどころ

terraform/
├── main.tf
├── provider.tf
├── variables.tf
└── modules/
    ├── network/   # VPC, Subnet, NAT Gateway
    ├── security/  # Security Group
    ├── storage/   # S3, S3 Files
    ├── app/       # EC2, IAM
    └── alb/       # ALB, Target Group

Copy

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 6.40.0"
    }
  }
  required_version = ">= 1.0"
}

Copy

resource "aws_s3_bucket" "this" {
  bucket        = "${var.project_name}-data-bucket"
  force_destroy = true
}

resource "aws_s3_bucket_versioning" "this" {
  bucket = aws_s3_bucket.this.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

Copy

resource "aws_iam_role" "s3_files_role" {
  name = "${var.project_name}-s3-files-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "elasticfilesystem.amazonaws.com" }
      Action    = "sts:AssumeRole"
      Condition = {
        StringEquals = { "aws:SourceAccount" = var.account_id }
        ArnLike      = { "aws:SourceArn" = "arn:aws:s3files:${var.region}:${var.account_id}:file-system/*" }
      }
    }]
  })
}

Copy

resource "aws_iam_role_policy" "s3_files_policy" {
  name = "${var.project_name}-s3-files-policy"
  role = aws_iam_role.s3_files_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid      = "S3BucketPermissions"
        Effect   = "Allow"
        Action   = ["s3:ListBucket", "s3:ListBucketVersions"]
        Resource = aws_s3_bucket.this.arn
        Condition = {
          StringEquals = { "aws:ResourceAccount" = var.account_id }
        }
      },
      {
        Sid    = "S3ObjectPermissions"
        Effect = "Allow"
        Action = ["s3:AbortMultipartUpload", "s3:DeleteObject*", 
"s3:GetObject*", "s3:List*", "s3:PutObject*"]
        Resource = "${aws_s3_bucket.this.arn}/*"
        Condition = {
          StringEquals = { "aws:ResourceAccount" = var.account_id }
        }
      },
      {
        Sid    = "EventBridgeManage"
        Effect = "Allow"
        Action = [
          "events:DeleteRule", "events:DisableRule", 
"events:EnableRule",
          "events:PutRule", "events:PutTargets", "events:RemoveTargets"
        ]
        Condition = {
          StringEquals = { "events:ManagedBy" = "elasticfilesystem.amazonaws.com" }
        }
        Resource = 
["arn:aws:events:*:*:rule/DO-NOT-DELETE-S3-Files*"]
      },
      {
        Sid      = "EventBridgeRead"
        Effect   = "Allow"
        Action   = ["events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule"]
        Resource = ["arn:aws:events:*:*:rule/*"]
      }
    ]
  })
}

Copy

resource "aws_s3files_file_system" "this" {
  bucket   = aws_s3_bucket.this.arn
  role_arn = aws_iam_role.s3_files_role.arn

  depends_on = [
    aws_s3_bucket_versioning.this,
    aws_s3_bucket_server_side_encryption_configuration.this,
  ]
}

Copy

resource "aws_s3files_mount_target" "this" {
  count           = length(var.private_subnet_ids)
  file_system_id  = aws_s3files_file_system.this.id
  subnet_id       = var.private_subnet_ids[count.index]
  security_groups = [var.s3_files_mount_target_sg_id]
}

Copy

resource "aws_security_group" "s3_files_mount_target" {
  name   = "${var.project_name}-s3-files-mount-target-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port       = 2049
    to_port         = 2049
    protocol        = "tcp"
    security_groups = [aws_security_group.app.id]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Copy

resource "aws_iam_role" "app_role" {
  name = "${var.project_name}-app-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "s3_files_access" {
  role       = aws_iam_role.app_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3FilesClientFullAccess"
}

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.app_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

Copy

resource "aws_iam_role_policy" "s3_read_policy" {
  name = "${var.project_name}-s3-read-policy"
  role = aws_iam_role.app_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid      = "S3ObjectReadAccess"
        Effect   = "Allow"
        Action   = ["s3:GetObject", "s3:GetObjectVersion"]
        Resource = "${aws_s3_bucket.this.arn}/*"
      },
      {
        Sid      = "S3BucketListAccess"
        Effect   = "Allow"
        Action   = "s3:ListBucket"
        Resource = aws_s3_bucket.this.arn
      }
    ]
  })
}

Copy

resource "aws_instance" "app" {
  count                = 2
  ami                  = data.aws_ami.al2023.id
  instance_type        = "t3.micro"
  iam_instance_profile = aws_iam_instance_profile.app_profile.name
  subnet_id            = var.private_subnet_ids[count.index]
  vpc_security_group_ids = [var.app_sg_id]

  user_data = <<-EOT
    #!/bin/bash
    yum -y install amazon-efs-utils
    mkdir -p /mnt/s3files
    echo "${var.s3_file_system_id}:/ /mnt/s3files s3files _netdev 0 0" >> /etc/fstab
    mount -a
  EOT
}

Copy

Failed to resolve 
"apne1-az4.fs-xxxxxx.s3files.ap-northeast-1.on.aws"
- ensure that the VPC has an S3Files mount target for this file system ID.

Copy