Terraformのmoduleとfor_each・countで構成を再利用する設計パターン

この記事のポイント

・terraform moduleでリソース定義を再利用可能な単位にまとめられる
・countはインデックス（数値）でリソースを識別するため途中削除でずれが起きる
・for_eachはキー名（文字列）で管理するため途中追加・削除しても影響が限定される
・dynamic blockでfor_eachを使うとリソース内のブロックを宣言的に管理できる

# プロジェクトルート構成
.
├── main.tf           # ルートモジュール（moduleを呼び出す側）
├── variables.tf
├── outputs.tf
└── modules/
    ├── ec2/          # EC2モジュール
    │   ├── main.tf
    │   ├── variables.tf
    │   └── outputs.tf
    └── vpc/          # VPCモジュール
        ├── main.tf
        ├── variables.tf
        └── outputs.tf

# ルートのmain.tf
module "web_server" {
  source        = "./modules/ec2"
  instance_type = "t3.micro"
  ami_id        = "ami-0c7217cdde317cfec"
  name          = "web"
}

module "app_server" {
  source        = "./modules/ec2"
  instance_type = "t3.small"
  ami_id        = "ami-0c7217cdde317cfec"
  name          = "app"
}

# moduleのsourceを変更・追加した後は必ずinitを再実行する
$ terraform init

# エラーが出た場合は -upgrade フラグで強制更新できる
$ terraform init -upgrade

# modules/ec2/variables.tf
variable "instance_type" {
  description = "EC2インスタンスタイプ"
  type        = string
  default     = "t3.micro"
}

variable "ami_id" {
  description = "AMI ID"
  type        = string
}

variable "name" {
  description = "リソース名（Nameタグに使用）"
  type        = string
}

# modules/ec2/outputs.tf
output "instance_id" {
  value = aws_instance.this.id
}

output "private_ip" {
  value = aws_instance.this.private_ip
}

# 3台のEC2インスタンスを作る例
resource "aws_instance" "worker" {
  count         = 3
  ami           = "ami-0c7217cdde317cfec"
  instance_type = "t3.micro"

  tags = {
    Name = "worker-${count.index}"  # worker-0, worker-1, worker-2
  }
}

variable "worker_count" {
  type    = number
  default = 3
}

resource "aws_instance" "worker" {
  count         = var.worker_count
  ami           = "ami-0c7217cdde317cfec"
  instance_type = "t3.micro"

  tags = {
    Name = "worker-${count.index}"
  }
}

$ terraform state list
aws_instance.worker[0]
aws_instance.worker[1]
aws_instance.worker[2]

# リスト変更後のterraform plan出力（抜粋）
# aws_instance.web[1] will be destroyed
  - resource "aws_instance" "web" {
      - tags = { "Name" = "web-02" -> null }
    }
# aws_instance.web[1] will be created
  + resource "aws_instance" "web" {
      + tags = { "Name" = "web-03" }
    }
# aws_instance.web[2] will be destroyed
  - resource "aws_instance" "web" {
      - tags = { "Name" = "web-03" -> null }
    }

Plan: 1 to add, 0 to change, 2 to destroy.

module "web_server" {
  count         = 3
  source        = "./modules/ec2"
  instance_type = "t3.micro"
  ami_id        = "ami-0c7217cdde317cfec"
  name          = "web-${count.index}"
}

# 参照はインデックスで行う
output "web_server_ids" {
  value = module.web_server[*].instance_id
}

variable "instance_names" {
  type    = set(string)
  default = ["web-01", "web-02", "web-03"]
}

resource "aws_instance" "web" {
  for_each      = var.instance_names
  ami           = "ami-0c7217cdde317cfec"
  instance_type = "t3.micro"

  tags = {
    Name = each.key  # "web-01", "web-02", "web-03"
  }
}

$ terraform state list
aws_instance.web["web-01"]
aws_instance.web["web-02"]
aws_instance.web["web-03"]

variable "servers" {
  type = map(object({
    instance_type = string
    ami_id        = string
  }))
  default = {
    "web" = {
      instance_type = "t3.micro"
      ami_id        = "ami-0c7217cdde317cfec"
    }
    "app" = {
      instance_type = "t3.small"
      ami_id        = "ami-0c7217cdde317cfec"
    }
    "db"  = {
      instance_type = "t3.medium"
      ami_id        = "ami-0c7217cdde317cfec"
    }
  }
}

resource "aws_instance" "servers" {
  for_each      = var.servers
  ami           = each.value.ami_id
  instance_type = each.value.instance_type

  tags = {
    Name = each.key  # "web", "app", "db"
  }
}

locals {
  environments = {
    dev = {
      instance_type     = "t3.micro"
      min_size          = 1
      max_size          = 2
      db_instance_class = "db.t3.micro"
    }
    staging = {
      instance_type     = "t3.small"
      min_size          = 1
      max_size          = 3
      db_instance_class = "db.t3.small"
    }
    prod = {
      instance_type     = "t3.large"
      min_size          = 3
      max_size          = 10
      db_instance_class = "db.m5.large"
    }
  }
}

module "env" {
  for_each          = local.environments
  source            = "./modules/app-env"
  env_name          = each.key
  instance_type     = each.value.instance_type
  min_size          = each.value.min_size
  max_size          = each.value.max_size
  db_instance_class = each.value.db_instance_class
}

# 環境ごとのURLを出力する例
output "env_urls" {
  value = { for k, v in module.env : k => v.app_url }
}

# NATゲートウェイを作る・作らないを変数で切り替える例
resource "aws_eip" "nat" {
  count  = var.create_nat ? 1 : 0
  domain = "vpc"
}

# modules/app-env/main.tf
# このmodule内でvpcモジュールを呼び出す

module "vpc" {
  source     = "../vpc"
  cidr_block = var.vpc_cidr
  env_name   = var.env_name
}

module "ec2" {
  source        = "../ec2"
  subnet_id     = module.vpc.public_subnet_id
  instance_type = var.instance_type
  name          = "${var.env_name}-app"
}

# modules/ec2/variables.tf （丁寧な定義の例）
variable "instance_type" {
  description = "EC2インスタンスタイプ（t3.micro / t3.small / t3.medium）"
  type        = string
  default     = "t3.micro"

  validation {
    condition     = contains(["t3.micro", "t3.small", "t3.medium", "t3.large"], var.instance_type)
    error_message = "許可されるインスタンスタイプ: t3.micro, t3.small, t3.medium, t3.large"
  }
}

variable "tags" {
  description = "リソースに付与するタグのマップ"
  type        = map(string)
  default     = {}
}

# modules/ec2/outputs.tf
output "instance_id" {
  description = "EC2インスタンスID"
  value       = aws_instance.this.id
}

output "private_ip" {
  description = "プライベートIPアドレス"
  value       = aws_instance.this.private_ip
}

# sensitive=trueで機密値をplan/applyの出力に表示させない
output "connection_string" {
  description = "DB接続文字列（機密）"
  value       = local.db_connection_string
  sensitive   = true
}

# locals.tf: 環境設定をマップで一元管理する
locals {
  env_config = {
    dev = {
      instance_type              = "t3.micro"
      min_size                   = 1
      max_size                   = 2
      db_instance_class          = "db.t3.micro"
      enable_deletion_protection = false
    }
    staging = {
      instance_type              = "t3.small"
      min_size                   = 1
      max_size                   = 3
      db_instance_class          = "db.t3.small"
      enable_deletion_protection = false
    }
    prod = {
      instance_type              = "m5.large"
      min_size                   = 2
      max_size                   = 10
      db_instance_class          = "db.m5.large"
      enable_deletion_protection = true
    }
  }
}

# main.tf: localsのマップをfor_eachで展開する
module "app_env" {
  for_each = local.env_config
  source   = "./modules/app-env"

  env_name                   = each.key
  instance_type              = each.value.instance_type
  min_size                   = each.value.min_size
  max_size                   = each.value.max_size
  db_instance_class          = each.value.db_instance_class
  enable_deletion_protection = each.value.enable_deletion_protection
}

# dynamic blockでingressルールを動的生成する例
variable "ingress_rules" {
  type = list(object({
    port        = number
    protocol    = string
    cidr_blocks = list(string)
    description = string
  }))
  default = [
    { port = 22,  protocol = "tcp", cidr_blocks = ["10.0.0.0/8"], description = "SSH from internal" },
    { port = 80,  protocol = "tcp", cidr_blocks = ["0.0.0.0/0"],  description = "HTTP" },
    { port = 443, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"],  description = "HTTPS" },
  ]
}

resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = var.vpc_id

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.port
      to_port     = ingress.value.port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
      description = ingress.value.description
    }
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# エラーになる例（重複キー）
variable "servers" {
  default = {
    "web" = { ... }
    "web" = { ... }  # NG: 同じキー "web" が2つある
  }
}

# 実際の確認コマンド
terraform plan 2>&1 | grep -i "duplicate"

# エラーになるパターン（list型をそのまま渡している）
for_each = var.instance_names  # type = list(string) だとエラー

# 解決策1: 変数の型をset(string)に変更する（推奨）
variable "instance_names" {
  type = set(string)
}

# 解決策2: toset()関数でlist型をset型に変換する
for_each = toset(var.instance_names)

# エラーになるパターン（apply前未確定の値をキーに使う）
resource "aws_subnet" "main" {
  for_each = aws_vpc.main.id  # plan時点ではidが確定しないためエラー
  ...
}

# エラーメッセージ（抜粋）
# Error: Invalid for_each argument
# The "for_each" value depends on resource attributes that cannot be
# determined until apply, so Terraform cannot predict how many instances
# will be created. To work around this, use the -target argument to first
# apply only the resources that the for_each depends on.

# 解決策1: plan時点で確定できる固定文字列をキーにする
locals {
  subnet_types = toset(["public", "private"])
}

resource "aws_subnet" "main" {
  for_each          = local.subnet_types
  vpc_id            = aws_vpc.main.id
  cidr_block        = each.key == "public" ? "10.0.1.0/24" : "10.0.2.0/24"
  availability_zone = "ap-northeast-1a"
  tags = { Name = each.key }
}

# 解決策2: -targetで依存元リソースを先にapplyする（2段階実行）
# ステップ1: for_eachが依存するVPCだけ先にapply
terraform apply -target=aws_vpc.main

# ステップ2: VPCのidが確定した後で全体をapply
terraform apply

# 削除を防ぐlifecycleの設定
resource "aws_db_instance" "main" {
  ...
  lifecycle {
    prevent_destroy = true
  }
}

# terraform planで削除対象を必ず確認する
terraform plan -out=tfplan
terraform show -json tfplan | jq '.resource_changes[] | select(.change.actions[] == "delete")'

# setを使う例（シンプルなケース）
variable "availability_zones" {
  type    = set(string)
  default = ["ap-northeast-1a", "ap-northeast-1c", "ap-northeast-1d"]
}

resource "aws_subnet" "public" {
  for_each          = var.availability_zones
  vpc_id            = aws_vpc.main.id
  availability_zone = each.key
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, index(tolist(var.availability_zones), each.key))
}

# countからfor_eachへの移行手順（3台の例）
# 移行前: aws_instance.web[0] → 移行後: aws_instance.web["web-01"]

terraform state mv 'aws_instance.web[0]' 'aws_instance.web["web-01"]'
terraform state mv 'aws_instance.web[1]' 'aws_instance.web["web-02"]'
terraform state mv 'aws_instance.web[2]' 'aws_instance.web["web-03"]'

# state移行後にコードをfor_eachに書き換えてplan実行
# Plan: 0 to add, 0 to change, 0 to destroy. になれば成功

# state mv後の確認（「No changes」になれば移行成功）
$ terraform plan
No changes. Your infrastructure matches the configuration.

# 差分が出た場合は中止して原因を調査する

# stateを移動してリソースを保護する例
# 旧アドレス → 新アドレスに移動
terraform state mv 'module.old_name.aws_instance.web' 'module.new_name.aws_instance.web'

# 確認
terraform state list | grep module

resource "aws_eip" "nat" {
  count  = var.create_nat ? 1 : 0
  domain = "vpc"
}

# NG: count = 0のとき aws_eip.nat はリスト（長さゼロ）になるため直接参照はエラー
output "nat_ip" {
  value = aws_eip.nat.public_ip  # エラー
}

# OK: length()で存在確認してから参照する
output "nat_ip" {
  value = length(aws_eip.nat) > 0 ? aws_eip.nat[0].public_ip : null
}

# Terraformプロジェクトの標準 .gitignore
.terraform/
.terraform.lock.hcl   # lockファイルはチームで共有する場合は含める
terraform.tfstate
terraform.tfstate.backup
*.tfvars              # 機密値を含む変数ファイルは必ず除外