Amazon ECS で WordPress サイトを構築する

terraform {
  required_providers {
    aws ={
      source="hashicorp/aws"
      version="~> 5.57.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
  profile ="inaba"
}

# Data sources
data "aws_availability_zones" "available" {
  state ="available"
}
data "aws_caller_identity" "current" {}

# VPC
resource "aws_vpc" "main" {
  cidr_block ="10.0.0.0/16"
  enable_dns_hostnames =true
  enable_dns_support =true
  tags ={
    Name="${var.project_name}-vpc"
  }
}

# Internet Gateway
resource "aws_internet_gateway" "main" {
  vpc_id =aws_vpc.main.id
  tags ={
    Name="${var.project_name}-igw"
  }
}

# Public Subnets
resource "aws_subnet" "public" {
  count =2
  vpc_id =aws_vpc.main.id
  cidr_block ="10.0.${count.index+1}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch =true
  tags ={
    Name="${var.project_name}-public-subnet-${count.index+1}"
  }
}

# Private Subnets
resource "aws_subnet" "private" {
  count =2
  vpc_id =aws_vpc.main.id
  cidr_block ="10.0.${count.index+10}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]
  tags ={
    Name="${var.project_name}-private-subnet-${count.index+1}"
  }
}

# Route Table for Public Subnets
resource "aws_route_table" "public" {
  vpc_id =aws_vpc.main.id
  route {
    cidr_block ="0.0.0.0/0"
    gateway_id =aws_internet_gateway.main.id
  }
  tags ={
    Name="${var.project_name}-public-rt"
  }
}

# Route Table Associations for Public Subnets
resource "aws_route_table_association" "public" {
  count =2
  subnet_id =aws_subnet.public[count.index].id
  route_table_id =aws_route_table.public.id
}

# NAT Gateway for Private Subnets (1台のみ)
resource "aws_eip" "nat" {
  domain ="vpc"
  depends_on =[aws_internet_gateway.main]
  tags ={
    Name="${var.project_name}-nat-eip"
  }
}

resource "aws_nat_gateway" "main" {
  allocation_id =aws_eip.nat.id
  subnet_id =aws_subnet.public[0].id
  tags ={
    Name="${var.project_name}-nat-gateway"
  }
  depends_on =[aws_internet_gateway.main]
}

# Route Table for Private Subnets (共通)
resource "aws_route_table" "private" {
  vpc_id =aws_vpc.main.id
  route {
    cidr_block ="0.0.0.0/0"
    nat_gateway_id =aws_nat_gateway.main.id
  }
  tags ={
    Name="${var.project_name}-private-rt"
  }
}

# Route Table Associations for Private Subnets
resource "aws_route_table_association" "private" {
  count =2
  subnet_id =aws_subnet.private[count.index].id
  route_table_id =aws_route_table.private.id
}

# Security Group for ALB
resource "aws_security_group" "alb" {
  name_prefix ="${var.project_name}-alb-"
  vpc_id =aws_vpc.main.id
  ingress {
    description ="HTTP from allowed IP"
    from_port =80
    to_port =80
    protocol ="tcp"
    cidr_blocks =["x.x.x.x7/32"]
  }
  ingress {
    description ="HTTPS from allowed IP"
    from_port =443
    to_port =443
    protocol ="tcp"
    cidr_blocks =["x.x.x.x/32"]
  }
  egress {
    description ="All outbound traffic"
    from_port =0
    to_port =0
    protocol ="-1"
    cidr_blocks =["0.0.0.0/0"]
  }
  tags ={
    Name="${var.project_name}-alb-sg"
  }
  lifecycle {
    create_before_destroy =true
  }
}

# Security Group for ECS
resource "aws_security_group" "ecs" {
  name_prefix ="${var.project_name}-ecs-"
  vpc_id =aws_vpc.main.id
  ingress {
    description ="HTTP from ALB"
    from_port =80
    to_port =80
    protocol ="tcp"
    security_groups =[aws_security_group.alb.id]
  }
  egress {
    description ="All outbound traffic"
    from_port =0
    to_port =0
    protocol ="-1"
    cidr_blocks =["0.0.0.0/0"]
  }
  tags ={
    Name="${var.project_name}-ecs-sg"
  }
  lifecycle {
    create_before_destroy =true
  }
}

# Security Group for EFS
resource "aws_security_group" "efs" {
  name_prefix ="${var.project_name}-efs-"
  vpc_id =aws_vpc.main.id
  ingress {
    description ="NFS from ECS"
    from_port =2049
    to_port =2049
    protocol ="tcp"
    security_groups =[aws_security_group.ecs.id]
  }
  egress {
    description ="All outbound traffic"
    from_port =0
    to_port =0
    protocol ="-1"
    cidr_blocks =["0.0.0.0/0"]
  }
  tags ={
    Name="${var.project_name}-efs-sg"
  }
  lifecycle {
    create_before_destroy =true
  }
}

# Security Group for RDS
resource "aws_security_group" "rds" {
  name_prefix ="${var.project_name}-rds-"
  vpc_id =aws_vpc.main.id
  ingress {
    description ="MySQL from ECS"
    from_port =3306
    to_port =3306
    protocol ="tcp"
    security_groups =[aws_security_group.ecs.id]
  }
  egress {
    description ="All outbound traffic"
    from_port =0
    to_port =0
    protocol ="-1"
    cidr_blocks =["0.0.0.0/0"]
  }
  tags ={
    Name="${var.project_name}-rds-sg"
  }
  lifecycle {
    create_before_destroy =true
  }
}

# EFS File System
resource "aws_efs_file_system" "wordpress" {
  creation_token ="${var.project_name}-efs"
  performance_mode ="generalPurpose"
  throughput_mode ="provisioned"
  provisioned_throughput_in_mibps =10
  encrypted =true
  tags ={
    Name="${var.project_name}-efs"
  }
}

# EFS Mount Targets
resource "aws_efs_mount_target" "wordpress" {
  count =2
  file_system_id =aws_efs_file_system.wordpress.id
  subnet_id =aws_subnet.private[count.index].id
  security_groups =[aws_security_group.efs.id]
}

# Aurora Subnet Group
resource "aws_db_subnet_group" "main" {
  name ="${var.project_name}-aurora-subnet-group"
  subnet_ids =aws_subnet.private[*].id
  tags ={
    Name="${var.project_name}-aurora-subnet-group"
  }
}

# Aurora Cluster
resource "aws_rds_cluster" "main" {
  cluster_identifier ="${var.project_name}-aurora-cluster"
  engine ="aurora-mysql"
  engine_version ="8.0.mysql_aurora.3.04.2"
  database_name ="wordpress"
  master_username = var.db_username
  master_password = var.db_password
  db_subnet_group_name =aws_db_subnet_group.main.name
  vpc_security_group_ids =[aws_security_group.rds.id]
  backup_retention_period =7
  preferred_backup_window ="03:00-04:00"
  skip_final_snapshot =true
  deletion_protection =false
  tags ={
    Name="${var.project_name}-aurora-cluster"
  }
}

# Aurora Instance (1台のみ)
resource "aws_rds_cluster_instance" "main" {
  identifier ="${var.project_name}-aurora-instance"
  cluster_identifier =aws_rds_cluster.main.id
  instance_class ="db.r5.large"
  engine =aws_rds_cluster.main.engine
  engine_version =aws_rds_cluster.main.engine_version
  tags ={
    Name="${var.project_name}-aurora-instance"
  }
}

# CloudWatch Log Group

resource "aws_cloudwatch_log_group" "ecs" {
  name ="/ecs/${var.project_name}"
  retention_in_days =7
  tags ={
    Name="${var.project_name}-log-group"
  }
}

# ECS Cluster
resource "aws_ecs_cluster" "main" {
  name ="${var.project_name}-cluster"
  tags ={
    Name="${var.project_name}-cluster"
  }
}

# IAM Role for ECS Execution
resource "aws_iam_role" "ecs_execution" {
  name ="${var.project_name}-ecs-execution-role"
  assume_role_policy =jsonencode({
    Version="2012-10-17"
      Statement= [
        {
          Action="sts:AssumeRole"
          Effect="Allow"
          Principal= {
            Service="ecs-tasks.amazonaws.com"
          }
        }
      ]
  })
  tags ={
    Name="${var.project_name}-ecs-execution-role"
  }
}

resource "aws_iam_role_policy_attachment" "ecs_execution" {
  role =aws_iam_role.ecs_execution.name
  policy_arn ="arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

# CloudWatch Logs用のIAMポリシー
resource "aws_iam_role_policy" "ecs_logs" {
  name ="${var.project_name}-ecs-logs-policy"
  role =aws_iam_role.ecs_execution.id
  policy =jsonencode({
    Version="2012-10-17"
    Statement= [
      {
        Effect="Allow"
        Action= [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Resource="arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:*"
       }
    ]
  })
}

# ECS Task Definition
resource "aws_ecs_task_definition" "main" {
  family = var.project_name
  network_mode ="awsvpc"
  requires_compatibilities =["FARGATE"]
  cpu ="512"
  memory ="1024"
  execution_role_arn =aws_iam_role.ecs_execution.arn
  volume {
    name ="wordpress-efs"
    efs_volume_configuration {
      file_system_id =aws_efs_file_system.wordpress.id
      root_directory ="/"
    }
  }
  container_definitions =jsonencode([
    {
      name="nginx"
      image="${data.aws_caller_identity.current.account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/${var.project_name}-nginx:latest"
      portMappings= [
        {
          containerPort=80
          protocol="tcp"
        }
      ]
      essential= true
      dependsOn= [
        {
          containerName="php-fpm"
          condition="START"
        }
      ]
      mountPoints= [ 
        {
          sourceVolume="wordpress-efs"
          containerPath="/var/www/html"
          readOnly= false
        }
      ]
      logConfiguration= {
        logDriver="awslogs"
        options= {
          "awslogs-group" = aws_cloudwatch_log_group.ecs.name
          "awslogs-region" = var.aws_region
          "awslogs-stream-prefix" = "nginx"
        }
      }
    },
    {
      name="php-fpm"
      image="${data.aws_caller_identity.current.account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/${var.project_name}-php:latest"
      essential= true
      mountPoints= [
        {
          sourceVolume="wordpress-efs"
          containerPath="/var/www/html"
          readOnly= false
        }
      ]
      environment= [
        {
          name="WORDPRESS_DB_HOST"
          value= aws_rds_cluster.main.endpoint
        },
        {
          name="WORDPRESS_DB_NAME"
          value= aws_rds_cluster.main.database_name
        },
        {
          name="WORDPRESS_DB_USER"
          value= aws_rds_cluster.main.master_username
        },
        {
          name="WORDPRESS_DB_PASSWORD"
          value=var.db_password
        }
      ]
      logConfiguration= {
        logDriver="awslogs"
        options= {
          "awslogs-group" = aws_cloudwatch_log_group.ecs.name
          "awslogs-region" = var.aws_region
          "awslogs-stream-prefix" = "php-fpm"
        }
      }
    }
  ])
  tags ={
    Name="${var.project_name}-task"
  }
}

# Application Load Balancer
resource "aws_lb" "main" {
  name ="${var.project_name}-alb"
  internal =false
  load_balancer_type ="application"
  security_groups =[aws_security_group.alb.id]
  subnets =aws_subnet.public[*].id
  enable_deletion_protection =false
  tags ={
    Name="${var.project_name}-alb"
  }
}

# Target Group
resource "aws_lb_target_group" "main" {
name ="${var.project_name}-tg"
  port =80
  protocol ="HTTP"
  vpc_id =aws_vpc.main.id
  target_type ="ip"
  health_check {
    enabled =true
    healthy_threshold =2
    interval =30
    matcher ="200,302"
    path ="/"
    port ="traffic-port"
    protocol ="HTTP"
    timeout =5
    unhealthy_threshold =2
  }
  tags ={
    Name="${var.project_name}-tg"
  }
}

# ALB Listener
resource "aws_lb_listener" "main" {
  load_balancer_arn =aws_lb.main.arn
  port ="80"
  protocol ="HTTP"
  default_action {
  type ="forward"
    target_group_arn =aws_lb_target_group.main.arn
  }
}

# ECS Service
resource "aws_ecs_service" "main" {
  name ="${var.project_name}-service"
  cluster =aws_ecs_cluster.main.id
  task_definition =aws_ecs_task_definition.main.arn
  desired_count =1
  launch_type ="FARGATE"
  network_configuration {
  subnets =aws_subnet.private[*].id
  security_groups =[aws_security_group.ecs.id]
    assign_public_ip =false
  }
  load_balancer {
    target_group_arn =aws_lb_target_group.main.arn
    container_name ="nginx"
    container_port =80
  } 
  depends_on =[
    aws_lb_listener.main,
    aws_efs_mount_target.wordpress
  ]
  tags ={
    Name="${var.project_name}-service"
  }
}