AzureでApplication Gatewayを作る

Application Gatewayを作ってApplication分散処理Terraformで書いた。

main.tf

provider "azurerm" {
  features {}
  subscription_id = ""
}

resource "azurerm_resource_group" "rg" {
  name     = "appgw-rg"
  location = "japaneast"
}

# 仮想ネットワークとサブネット
resource "azurerm_virtual_network" "vnet" {
  name                = "appgw-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_subnet" "gateway" {
  name                 = "gateway-subnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_subnet" "backend" {
  name                 = "backend-subnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.2.0/24"]
}

# パブリックIP（Application Gateway用）
resource "azurerm_public_ip" "pip" {
  name                = "appgw-pip"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

# Application Gateway
resource "azurerm_application_gateway" "appgw" {
  name                = "appgw-example"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  sku {
    name     = "Standard_v2"
    tier     = "Standard_v2"
    capacity = 2
  }

  gateway_ip_configuration {
    name      = "gateway-ip-config"
    subnet_id = azurerm_subnet.gateway.id
  }

  frontend_port {
    name = "port-80"
    port = 80
  }

  frontend_ip_configuration {
    name                 = "frontend-ip"
    public_ip_address_id = azurerm_public_ip.pip.id
  }

  backend_address_pool {
    name = "backend-pool"
  }

  backend_http_settings {
    name                  = "http-settings"
    cookie_based_affinity = "Disabled"
    port                  = 80
    protocol              = "Http"
    request_timeout       = 60
  }

  http_listener {
    name                           = "http-listener"
    frontend_ip_configuration_name = "frontend-ip"
    frontend_port_name             = "port-80"
    protocol                       = "Http"
  }

  request_routing_rule {
    name                       = "rule-http"
    priority                   = 100
    rule_type                  = "Basic"
    http_listener_name         = "http-listener"
    backend_address_pool_name  = "backend-pool"
    backend_http_settings_name = "http-settings"
  }
}

# バックエンドVM用NIC（2台）
resource "azurerm_network_interface" "vm_nic" {
  count               = 2
  name                = "vm-nic-${count.index}"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.backend.id
    private_ip_address_allocation = "Dynamic"
  }
}

# NICをApplication Gatewayのバックエンドプールに関連付け
resource "azurerm_network_interface_application_gateway_backend_address_pool_association" "assoc" {
  count                   = 2
  network_interface_id    = azurerm_network_interface.vm_nic[count.index].id
  ip_configuration_name   = "internal"
  backend_address_pool_id = {
    for p in azurerm_application_gateway.appgw.backend_address_pool :
    p.name => p.id
  }["backend-pool"]
}

# === SSH鍵ペアを自動生成 ===
resource "tls_private_key" "ssh" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

# 生成した公開鍵をローカルファイルに保存
resource "local_file" "public_key" {
  content  = tls_private_key.ssh.public_key_openssh
  filename = "${path.module}/appgw-ssh-key.pub"
}

# 生成した秘密鍵をローカルファイルに保存（重要：権限を600に）
resource "local_sensitive_file" "private_key" {
  content         = tls_private_key.ssh.private_key_pem
  filename        = "${path.module}/appgw-ssh-key"
  file_permission = "0600"
}

# Ubuntu VM（自動生成したSSH鍵を使用）
resource "azurerm_linux_virtual_machine" "vm" {
  count                           = 2
  name                            = "backend-vm-${count.index}"
  location                        = azurerm_resource_group.rg.location
  resource_group_name             = azurerm_resource_group.rg.name
  size                            = "Standard_DS1_v2"
  admin_username                  = "adminuser"
  disable_password_authentication = true

  network_interface_ids = [azurerm_network_interface.vm_nic[count.index].id]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts-gen2"
    version   = "latest"
  }

  admin_ssh_key {
    username   = "adminuser"
    public_key = tls_private_key.ssh.public_key_openssh
  }
}

# 出力：Application GatewayのフロントエンドIP + SSH接続情報
output "gateway_frontend_ip" {
  description = "Application GatewayのパブリックIPアドレス"
  value       = azurerm_public_ip.pip.ip_address
}

output "gateway_frontend_fqdn" {
  description = "Application GatewayのFQDN"
  value       = azurerm_public_ip.pip.fqdn
}

output "ssh_connection_command" {
  description = "バックエンドVMへのSSH接続例（プライベートIPはデプロイ後に確認）"
  value       = "ssh -i ${path.module}/appgw-ssh-key adminuser@<VMのプライベートIP>"
}

output "ssh_private_key_saved" {
  description = "秘密鍵が保存されたパス"
  value       = "${path.module}/appgw-ssh-key"
  sensitive   = true
}