どういう記事か

terraform, samの初心者がapi gateway + lambda + cloudfrontの環境構築をしたときのメモです。

前提

m1 mac
macos big sur

参考

terraformのダウンロード&インストール

tfenvから導入を始めます。
tfenvが正しい方法なのかはよくわかっていませんが、、

brew install tfenv

今回は 0.15.5をインストールしてみました。

tfenv install 1.0.5

Installation of terraform v1.0.5 successful. To make this your default version, run 'tfenv use 1.0.5'

これで設定します。

$ tfenv use 1.0.5

$ terraform --version
Terraform v1.0.5
on darwin_amd64

aws samのダウンロードとインストール

homebrewでインストールしようとするとpermission deniedエラーが出てきて解決できなかったのでpipで解決しました。

$ pip install aws-sam-cli

$ sam --version
SAM CLI, version 1.29.0

terraform初期化

terraform initでプロジェクトをスタートします。

terraform init

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 3.0"...
- Installing hashicorp/aws v3.56.0...
- Installed hashicorp/aws v3.56.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

samの初期化

python 3.9で作成しました。photo-stackというフォルダが作成されます。

$ sam init

	SAM CLI now collects telemetry to better understand customer needs.

	You can OPT OUT and disable telemetry collection by setting the
	environment variable SAM_CLI_TELEMETRY=0 in your shell.
	Thanks for your help!

	Learn More: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-telemetry.html

Which template source would you like to use?
	1 - AWS Quick Start Templates
	2 - Custom Template Location
Choice: 1
What package type would you like to use?
	1 - Zip (artifact is a zip uploaded to S3)
	2 - Image (artifact is an image uploaded to an ECR image repository)
Package type: 1

Which runtime would you like to use?
	1 - nodejs14.x
	2 - python3.9
	3 - ruby2.7
	4 - go1.x
	5 - java11
	6 - dotnetcore3.1
	7 - nodejs12.x
	8 - nodejs10.x
	9 - python3.8
	10 - python3.7
	11 - python3.6
	12 - python2.7
	13 - ruby2.5
	14 - java8.al2
	15 - java8
	16 - dotnetcore2.1
Runtime: 2

Project name [sam-app]: photo-stack

Cloning from https://github.com/aws/aws-sam-cli-app-templates

AWS quick start application templates:
	1 - Hello World Example
	2 - EventBridge Hello World
	3 - EventBridge App from scratch (100+ Event Schemas)
	4 - Step Functions Sample App (Stock Trader)
	5 - Elastic File System Sample App
Template selection: 1

    -----------------------
    Generating application:
    -----------------------
    Name: photo-stack
    Runtime: python3.9
    Dependency Manager: pip
    Application Template: hello-world
    Output Directory: .

    Next steps can be found in the README file at ./photo-stack/README.md

pythonのバージョンをpipenvで調整

pipenvを使ってpython 3.9を使うようにしました。

$ pipenv --python 3.9
Warning: the environment variable LANG is not set!
We recommend setting this in ~/.profile (or equivalent) for proper expected behavior.
Creating a virtualenv for this project...
Pipfile: /xxxxxx
Using /usr/local/bin/python3.9 (3.9.6) to create virtualenv...
⠼ Creating virtual environment...created virtual environment CPython3.9.6.final.0-64 in 220ms
  creator CPython3Posix(dest=/Users/xxxxx/.local/share/virtualenvs/photo-stack-ZfxSBrfk, clear=False, no_vcs_ignore=False, global=False)
  seeder FromAppData(download=False, pip=bundle, setuptools=bundle, wheel=bundle, via=copy, app_data_dir=/Users/xxxxxx/Library/Application Support/virtualenv)
    added seed packages: pip==21.1.2, setuptools==57.0.0, wheel==0.36.2
  activators BashActivator,CShellActivator,FishActivator,PowerShellActivator,PythonActivator,XonshActivator

✔ Successfully created virtual environment!
Virtualenv location: /Users/xxxxxxxx/.local/share/virtualenvs/photo-stack-ZfxSBrfk
Creating a Pipfile for this project...

バケットの作成

以下のコマンドでバケットを作成します。

$ aws s3api create-bucket --bucket photo-stack --region ap-northeast-1 --acl private --create-bucket-configu
ration LocationConstraint=ap-northeast-1

sam/template.ymlの修正

APIのドメインをアウトプットとして出すようにします。

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  HelloWorldApiDomain:
    Value: !Sub "${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com"

その他terraformファイルの作成

cloudformationの設定です。

【注意】こちらの3行目のtemplate.ymlはsam/template.ymlではなく、terraformによって生成されるtemplate.ymlのことです。

cloudformation.tf

resource "aws_cloudformation_stack" "sam" {
  name = "sam"
  template_body = file("template.yaml")
  capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
}

data "aws_cloudformation_stack" "sam" {
  name = "sam"
  depends_on = [
    aws_cloudformation_stack.sam
  ]
}

cloudfrontの設定：

cloudfront.tf

resource "aws_cloudfront_distribution" "api_dist" {
  origin {
    domain_name = data.aws_cloudformation_stack.sam.outputs["HelloWorldApiDomain"]
    origin_id = "sam-api-gateway"

    custom_origin_config {
      https_port = 443
      http_port = 80
      origin_protocol_policy = "https-only"
      origin_ssl_protocols = ["TLSv1.2"]
    }
  }

  enabled = true
  default_cache_behavior {
    allowed_methods = [ "GET", "HEAD" ]
    cached_methods = ["GET", "HEAD"]
    target_origin_id = "sam-api-gateway"

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "https-only"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }

  restrictions {
      geo_restriction {
          restriction_type = "whitelist"
          locations = [ "JP" ]
      }
  }
  viewer_certificate {
      cloudfront_default_certificate = true
  }
}

deploy用のMakefileを作成しました。

PROFILE=default
SAM_APP_DIR=photo-stack
SAM_BUCKET=photo-stack
TEMPLATE_FILE=template.yaml

deploy:
	cd $(SAM_APP_DIR) && pipenv run sam build
	cd $(SAM_APP_DIR) && sam package --profile $(PROFILE) --s3-bucket $(SAM_BUCKET) --output-template-file ../$(TEMPLATE_FILE)
	terraform apply

deployする

make deployすると以下のような感じでデプロイが進んで終了します。

$ make deploy
cd photo-stack && pipenv run sam build
Building codeuri: /Users/xxxxxxxxx/Documents/zeroboard-C-photo-editor/photo-stack/hello_world runtime: python3.9 metadata: {} functions: ['HelloWorldFunction']
Running PythonPipBuilder:ResolveDependencies
Running PythonPipBuilder:CopySource

Build Succeeded

Built Artifacts  : .aws-sam/build
Built Template   : .aws-sam/build/template.yaml

Commands you can use next
=========================
[*] Invoke Function: sam local invoke
[*] Deploy: sam deploy --guided

cd photo-stack && sam package --profile default --s3-bucket photo-stack --output-template-file ../template.yaml
File with same data already exists at 88bd6722efd39f95c2a8ca00aad6e623, skipping upload

Successfully packaged artifacts and wrote output template to file ../template.yaml.
Execute the following command to deploy the packaged template
sam deploy --template-file /Users/xxxxxxx/Documents/zeroboard-C-photo-editor/template.yaml --stack-name <YOUR STACK NAME>

terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

====== 略　======

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_cloudformation_stack.sam: Creating...
aws_cloudformation_stack.sam: Still creating... [10s elapsed]
aws_cloudformation_stack.sam: Still creating... [20s elapsed]
aws_cloudformation_stack.sam: Still creating... [30s elapsed]
aws_cloudformation_stack.sam: Still creating... [40s elapsed]
aws_cloudformation_stack.sam: Still creating... [50s elapsed]
aws_cloudformation_stack.sam: Still creating... [1m0s elapsed]
aws_cloudformation_stack.sam: Creation complete after 1m8s [id=arn:aws:cloudformation:ap-northeast-1:803801015105:stack/sam/528f5330-06d8-11ec-adb9-0adad91fe6c5]
data.aws_cloudformation_stack.sam: Reading...
data.aws_cloudformation_stack.sam: Read complete after 1s [id=arn:aws:cloudformation:ap-northeast-1:803801015105:stack/sam/528f5330-06d8-11ec-adb9-0adad91fe6c5]
aws_cloudfront_distribution.api_dist: Creating...
aws_cloudfront_distribution.api_dist: Still creating... [10s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [20s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [30s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [40s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [50s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [1m0s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [1m10s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [1m20s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [1m30s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [1m40s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [1m50s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [2m0s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [2m10s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [2m20s elapsed]
aws_cloudfront_distribution.api_dist: Still creating... [2m30s elapsed]
aws_cloudfront_distribution.api_dist: Creation complete after 2m38s [id=E3AH96C5XZK11E]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

動作確認

hello worldというメッセージが返ってきたらOKです。

$ curl https://xxxxxxx.cloudfront.net/Prod/hello
{"message": "hello world"}%

消去

バケットを消去して、以下のコマンドでできます。

$ terraform destroy
aws_cloudformation_stack.sam: Refreshing state... [id=arn:aws:cloudformation:ap-northeast-1:803801015105:stack/sam/528f5330-06d8-11ec-adb9-0adad91fe6c5]
aws_cloudfront_distribution.api_dist: Refreshing state... [id=E3AH96C5XZK11E]

Note: Objects have changed outside of Terraform

===== 略 =====

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

aws_cloudfront_distribution.api_dist: Destroying... [id=E3AH96C5XZK11E]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 10s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 20s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 30s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 40s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 50s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 1m0s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 1m10s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 1m20s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 1m30s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 1m40s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 1m50s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 2m0s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 2m10s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 2m20s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 2m30s elapsed]
aws_cloudfront_distribution.api_dist: Still destroying... [id=E3AH96C5XZK11E, 2m40s elapsed]
aws_cloudfront_distribution.api_dist: Destruction complete after 2m41s
aws_cloudformation_stack.sam: Destroying... [id=arn:aws:cloudformation:ap-northeast-1:803801015105:stack/sam/528f5330-06d8-11ec-adb9-0adad91fe6c5]
aws_cloudformation_stack.sam: Still destroying... [id=arn:aws:cloudformation:ap-northeast-1:8...m/528f5330-06d8-11ec-adb9-0adad91fe6c5, 10s elapsed]
aws_cloudformation_stack.sam: Still destroying... [id=arn:aws:cloudformation:ap-northeast-1:8...m/528f5330-06d8-11ec-adb9-0adad91fe6c5, 20s elapsed]
aws_cloudformation_stack.sam: Still destroying... [id=arn:aws:cloudformation:ap-northeast-1:8...m/528f5330-06d8-11ec-adb9-0adad91fe6c5, 30s elapsed]
aws_cloudformation_stack.sam: Destruction complete after 37s

Destroy complete! Resources: 2 destroyed.