TerraformでAWSのbackend.tf（S3 + DynamoDB）ステート管理を作成する

Posted at 2025-07-20

backend.tf（S3_+_DynamoDB）_ステート管理

EVENT

backend.tf（S3 + DynamoDB）でステート管理を
Terraformで作成したい

SOLUTION

必要なフォルダを作成する
S3バケット作成(tfstate-backend/main.tf)

resource "aws_s3_bucket" "state" {
  bucket = var.s3_bucket_name
}

resource "aws_s3_bucket_versioning" "state_ver" {
  bucket = aws_s3_bucket.state.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "state_config" {
  bucket = aws_s3_bucket.state.id
  rule {
      apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
      }
  }
}

DynamoDB作成(tfstate-backend/main.tf)

resource "aws_dynamodb_table" "lock_table" {
  name = var.dynamodb_table_name
  billing_mode = "PAY_PER_REQUEST"
  hash_key = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }

  tags = {
    name = "StateLockTable"
    Environment = "Backend"
  }
}

その他初期設定など

outputs.tf

output "s3_bucket_name" {
  description = "S3 bucket used for Terraform state."
  value = aws_s3_bucket.state.id
}

output "dynamodb_table_name" {
  description = "DynamoDB table used for Terraform state."
  value = aws_dynamodb_table.lock_table.id
}

variables.tf

variable "aws_region" {
  description = "The AWS REGION to deploy resources."
  type = string
  default = "us-west-2"
}

variable "s3_bucket_name" {
  description = "This S3 is Terraform state files."
  type = string
  default = "s3-tfstate"
}

variable "dynamodb_table_name" {
  description = "This DynamoDB is Terraform state locking."
  type = string
  default = "dynamodb-tfstate"
}

versions.tf

terraform {
  required_version = ">= 1.0.0"

  required_providers {
    aws = {
        source = "hashicorp/aws"
        version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

terraformコマンド実行

terraform init
terraform plan
terraform apply

AWSコンソールで確認

DynamoDB
S3

dev環境でbackend.tfを作成

~/dev/backend.tf

terraform {
 backend "s3" {
   bucket = "s3-tfstate-mori"
   key = "environments/dev/terraform.tfstate"
   region = "us-west-2"
   dynamodb_table = "dynamodb-tfstate-mori"
   encrypt = true
 } 
}

EC2を作成して確認してみる

~dev/main.tf

provider "aws" {
    region = "us-west-2"
}

resource "aws_instance" "dev_server_test" {
  # EC2 -> AMIカタログ参照
  ami = "ami-0be5f59fbc80d980c"
  instance_type = "t2.micro"

  tags = {
    name = "DevServer"
    environments = "Development"
  }
}

~/dev/versions.tf

terraform {
  required_version = ">= 1.0.0"

  required_providers {
    aws = {
        source = "hashicorp/aws"
        version = "~> 5.0"
    }
  }
}