Terraformのmoduleとfor_each・countで構成を再利用する設計パターン

この記事のポイント

・terraform moduleでリソース定義を再利用可能な単位にまとめられる
・countは数値で繰り返し、for_eachはマップで繰り返す
・削除が伴う変更にはfor_eachの方がリスクが低い
・inputとoutputを設計すればmodule間を疎結合につなげる

# プロジェクトルート構成
.
├── main.tf           # ルートモジュール（moduleを呼び出す側）
├── variables.tf
├── outputs.tf
└── modules/
    ├── ec2/          # EC2モジュール
    │   ├── main.tf
    │   ├── variables.tf
    │   └── outputs.tf
    └── vpc/          # VPCモジュール
        ├── main.tf
        ├── variables.tf
        └── outputs.tf

# ルートのmain.tf
module "web_server" {
  source        = "./modules/ec2"
  instance_type = "t3.micro"
  ami_id        = "ami-0c7217cdde317cfec"
  name          = "web"
}

module "app_server" {
  source        = "./modules/ec2"
  instance_type = "t3.small"
  ami_id        = "ami-0c7217cdde317cfec"
  name          = "app"
}

# modules/ec2/variables.tf
variable "instance_type" {
  description = "EC2インスタンスタイプ"
  type        = string
  default     = "t3.micro"
}

variable "ami_id" {
  description = "AMI ID"
  type        = string
}

variable "name" {
  description = "リソース名（Nameタグに使用）"
  type        = string
}

# modules/ec2/outputs.tf
output "instance_id" {
  value = aws_instance.this.id
}

output "private_ip" {
  value = aws_instance.this.private_ip
}

# 3台のEC2インスタンスを作る例
resource "aws_instance" "worker" {
  count         = 3
  ami           = "ami-0c7217cdde317cfec"
  instance_type = "t3.micro"

  tags = {
    Name = "worker-${count.index}"  # worker-0, worker-1, worker-2
  }
}

variable "worker_count" {
  type    = number
  default = 3
}

resource "aws_instance" "worker" {
  count         = var.worker_count
  ami           = "ami-0c7217cdde317cfec"
  instance_type = "t3.micro"

  tags = {
    Name = "worker-${count.index}"
  }
}

module "web_server" {
  count         = 3
  source        = "./modules/ec2"
  instance_type = "t3.micro"
  ami_id        = "ami-0c7217cdde317cfec"
  name          = "web-${count.index}"
}

# 参照はインデックスで行う
output "web_server_ids" {
  value = module.web_server[*].instance_id
}

variable "servers" {
  type = map(object({
    instance_type = string
    ami_id        = string
  }))
  default = {
    "web" = {
      instance_type = "t3.micro"
      ami_id        = "ami-0c7217cdde317cfec"
    }
    "app" = {
      instance_type = "t3.small"
      ami_id        = "ami-0c7217cdde317cfec"
    }
    "db"  = {
      instance_type = "t3.medium"
      ami_id        = "ami-0c7217cdde317cfec"
    }
  }
}

resource "aws_instance" "servers" {
  for_each      = var.servers
  ami           = each.value.ami_id
  instance_type = each.value.instance_type

  tags = {
    Name = each.key  # "web", "app", "db"
  }
}

locals {
  environments = {
    dev = {
      instance_type = "t3.micro"
      min_size      = 1
    }
    staging = {
      instance_type = "t3.small"
      min_size      = 2
    }
    prod = {
      instance_type = "t3.large"
      min_size      = 3
    }
  }
}

module "env" {
  for_each      = local.environments
  source        = "./modules/app-env"
  env_name      = each.key
  instance_type = each.value.instance_type
  min_size      = each.value.min_size
}

# 環境ごとのURLを出力する例
output "env_urls" {
  value = { for k, v in module.env : k => v.app_url }
}

# modules/app-env/main.tf
# このmodule内でvpcモジュールを呼び出す

module "vpc" {
  source     = "../vpc"
  cidr_block = var.vpc_cidr
  env_name   = var.env_name
}

module "ec2" {
  source        = "../ec2"
  subnet_id     = module.vpc.public_subnet_id
  instance_type = var.instance_type
  name          = "${var.env_name}-app"
}

# modules/ec2/variables.tf （丁寧な定義の例）
variable "instance_type" {
  description = "EC2インスタンスタイプ（t3.micro / t3.small / t3.medium）"
  type        = string
  default     = "t3.micro"

  validation {
    condition     = contains(["t3.micro", "t3.small", "t3.medium", "t3.large"], var.instance_type)
    error_message = "許可されるインスタンスタイプ: t3.micro, t3.small, t3.medium, t3.large"
  }
}

variable "tags" {
  description = "リソースに付与するタグのマップ"
  type        = map(string)
  default     = {}
}

# modules/ec2/outputs.tf
output "instance_id" {
  description = "EC2インスタンスID"
  value       = aws_instance.this.id
}

output "private_ip" {
  description = "プライベートIPアドレス"
  value       = aws_instance.this.private_ip
}

# sensitive=trueで機密値をplan/applyの出力に表示させない
output "connection_string" {
  description = "DB接続文字列（機密）"
  value       = local.db_connection_string
  sensitive   = true
}

# エラーになる例（重複キー）
variable "servers" {
  default = {
    "web" = { ... }
    "web" = { ... }  # NG: 同じキー "web" が2つある
  }
}

# 実際の確認コマンド
terraform plan 2>&1 | grep -i "duplicate"

# 削除を防ぐlifecycleの設定
resource "aws_db_instance" "main" {
  ...
  lifecycle {
    prevent_destroy = true
  }
}

# terraformplanで削除対象を必ず確認する
terraform plan -out=tfplan
terraform show -json tfplan | jq '.resource_changes[] | select(.change.actions[] == "delete")'

# setを使う例（シンプルなケース）
variable "availability_zones" {
  type    = set(string)
  default = ["ap-northeast-1a", "ap-northeast-1c", "ap-northeast-1d"]
}

resource "aws_subnet" "public" {
  for_each          = var.availability_zones
  vpc_id            = aws_vpc.main.id
  availability_zone = each.key
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, index(tolist(var.availability_zones), each.key))
}

# stateを移動してリソースを保護する例
# 旧アドレス → 新アドレスに移動
terraform state mv \
  'module.old_name.aws_instance.web' \
  'module.new_name.aws_instance.web'

# 確認
terraform state list | grep module