Terraformのdynamic blockでHCL設定を動的に生成する方法｜繰り返し設定の簡潔化と実務パターン

この記事のポイント

・dynamic blockはresource内のネストブロックをリストや集合から動的に生成するHCL構文
・for_each + content{} の組み合わせが基本形。iterator引数で参照名を変更できる
・セキュリティグループのingress・EBSボリューム・DynamoDB GSIが代表的な実務ユースケース
・ネストしたdynamic blockで「typeに応じてブロックを切り替える」条件分岐パターンも実現できる

# 静的記述の例 ── ポートが増えるたびにブロックをコピーする
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# dynamic blockの基本形
resource "リソースタイプ" "名前" {
  # 通常の属性

  dynamic "ネストブロック名" {
    for_each = 繰り返し元（リスト・マップ・集合）
    content {
      # ブロック内で使う属性
      属性名 = ネストブロック名.value.キー
    }
  }
}

# variables.tf
variable "ingress_rules" {
  description = "セキュリティグループのingressルール一覧"
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))
  default = [
    { from_port = 80,   to_port = 80,   protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] },
    { from_port = 443,  to_port = 443,  protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] },
    { from_port = 8080, to_port = 8080, protocol = "tcp", cidr_blocks = ["10.0.0.0/8"] },
  ]
}

# main.tf
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = var.vpc_id

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
    }
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# iteratorで参照名を「rule」に変更する例
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = var.vpc_id

  dynamic "ingress" {
    for_each = var.ingress_rules
    iterator = rule           # デフォルトの「ingress」を「rule」に変更
    content {
      from_port   = rule.value.from_port
      to_port     = rule.value.to_port
      protocol    = rule.value.protocol
      cidr_blocks = rule.value.cidr_blocks
    }
  }
}

# variables.tf
variable "ebs_volumes" {
  description = "追加EBSボリュームのリスト"
  type = list(object({
    device_name = string
    volume_size = number
    volume_type = string
    encrypted   = bool
  }))
  default = [
    { device_name = "/dev/sdb", volume_size = 100, volume_type = "gp3", encrypted = true },
    { device_name = "/dev/sdc", volume_size = 200, volume_type = "gp3", encrypted = true },
  ]
}

# main.tf
resource "aws_instance" "app" {
  ami           = var.ami_id
  instance_type = var.instance_type

  dynamic "ebs_block_device" {
    for_each = var.ebs_volumes
    iterator = vol
    content {
      device_name = vol.value.device_name
      volume_size = vol.value.volume_size
      volume_type = vol.value.volume_type
      encrypted   = vol.value.encrypted
    }
  }
}

# variables.tf
variable "iam_statements" {
  description = "IAMポリシーのStatementリスト"
  type = list(object({
    sid       = string
    actions   = list(string)
    resources = list(string)
    effect    = string
  }))
  default = [
    {
      sid       = "AllowS3ReadOnly"
      actions   = ["s3:GetObject", "s3:ListBucket"]
      resources = ["arn:aws:s3:::my-app-bucket", "arn:aws:s3:::my-app-bucket/*"]
      effect    = "Allow"
    },
    {
      sid       = "AllowCloudWatchLogs"
      actions   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
      resources = ["arn:aws:logs:ap-northeast-1:123456789012:*"]
      effect    = "Allow"
    },
  ]
}

# main.tf
data "aws_iam_policy_document" "app" {
  dynamic "statement" {
    for_each = var.iam_statements
    iterator = stmt
    content {
      sid       = stmt.value.sid
      actions   = stmt.value.actions
      resources = stmt.value.resources
      effect    = stmt.value.effect
    }
  }
}

resource "aws_iam_policy" "app" {
  name   = "${var.env}-app-policy"
  policy = data.aws_iam_policy_document.app.json
}

# variables.tf
variable "gsi_definitions" {
  description = "DynamoDB GSIの定義リスト"
  type = list(object({
    name            = string
    hash_key        = string
    range_key       = optional(string)
    projection_type = optional(string, "ALL")
  }))
  default = [
    { name = "gsi-status-index",  hash_key = "status",   range_key = "created_at", projection_type = "ALL" },
    { name = "gsi-owner-index",   hash_key = "owner_id", projection_type = "KEYS_ONLY" },
  ]
}

# locals.tf ── GSIのキー属性名をユニークに集約する
locals {
  # GSIのhash_key/range_keyをフラット展開して重複を排除する
  gsi_attribute_names = toset(flatten([
    [for gsi in var.gsi_definitions : gsi.hash_key],
    [for gsi in var.gsi_definitions : gsi.range_key if gsi.range_key != null],
  ]))
}

# main.tf
resource "aws_dynamodb_table" "app" {
  name         = "${var.env}-app-table"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "pk"
  range_key    = "sk"

  # テーブルのプライマリキー属性（固定）
  attribute {
    name = "pk"
    type = "S"
  }
  attribute {
    name = "sk"
    type = "S"
  }

  # GSIで使うキー属性をプライマリキー以外で動的に追加
  dynamic "attribute" {
    for_each = setsubtract(local.gsi_attribute_names, toset(["pk", "sk"]))
    content {
      name = attribute.value
      type = "S"
    }
  }

  # GSI本体を動的に生成（リストをマップに変換してfor_eachに渡す）
  dynamic "global_secondary_index" {
    for_each = { for gsi in var.gsi_definitions : gsi.name => gsi }
    iterator = gsi
    content {
      name            = gsi.value.name
      hash_key        = gsi.value.hash_key
      range_key       = gsi.value.range_key
      projection_type = gsi.value.projection_type
    }
  }
}

# variables.tf
variable "routing_rules" {
  description = "ALBリスナールールの定義リスト"
  type = list(object({
    priority         = number
    target_group_arn = string
    conditions = list(object({
      type   = string        # "path" または "host"
      values = list(string)
    }))
  }))
  default = [
    {
      priority         = 100
      target_group_arn = "arn:aws:elasticloadbalancing:ap-northeast-1:123456789012:targetgroup/api/xxx"
      conditions = [
        { type = "path", values = ["/api/*"] },
        { type = "host", values = ["api.example.com"] },
      ]
    },
  ]
}

# main.tf
resource "aws_lb_listener_rule" "app" {
  for_each     = { for rule in var.routing_rules : rule.priority => rule }
  listener_arn = var.listener_arn
  priority     = each.value.priority

  action {
    type             = "forward"
    target_group_arn = each.value.target_group_arn
  }

  # 外側のdynamic block: conditionブロックをリストから生成
  dynamic "condition" {
    for_each = each.value.conditions
    content {
      # 内側のdynamic block: typeに応じてpath_patternまたはhost_headerを生成
      dynamic "path_pattern" {
        for_each = condition.value.type == "path" ? [condition.value] : []
        content {
          values = path_pattern.value.values
        }
      }

      dynamic "host_header" {
        for_each = condition.value.type == "host" ? [condition.value] : []
        content {
          values = host_header.value.values
        }
      }
    }
  }
}

# variables.tf
variable "ingress_rules" {
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
    prd_only    = optional(bool, false)  # 本番専用フラグ
  }))
  default = [
    { from_port = 80,   to_port = 80,   protocol = "tcp",
      cidr_blocks = ["0.0.0.0/0"],   prd_only = false },
    { from_port = 443,  to_port = 443,  protocol = "tcp",
      cidr_blocks = ["0.0.0.0/0"],   prd_only = false },
    { from_port = 8443, to_port = 8443, protocol = "tcp",
      cidr_blocks = ["0.0.0.0/0"],   prd_only = true },
  ]
}

# main.tf
resource "aws_security_group" "web" {
  name   = "${var.env}-web-sg"
  vpc_id = var.vpc_id

  dynamic "ingress" {
    # for式でフィルタリング: prd_onlyがtrueのルールは本番環境のみ生成
    for_each = [
      for rule in var.ingress_rules :
      rule
      if !rule.prd_only || var.env == "prd"
    ]
    iterator = rule
    content {
      from_port   = rule.value.from_port
      to_port     = rule.value.to_port
      protocol    = rule.value.protocol
      cidr_blocks = rule.value.cidr_blocks
    }
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# TF_VAR_envにdevを渡してplan
$ TF_VAR_env=dev terraform plan

# 出力（ingressブロックが2つ生成される ─ ポート8443は除外）
  # aws_security_group.web will be created
  + resource "aws_security_group" "web" {
      + ingress {
          + from_port   = 80
          + to_port     = 80
          ...
        }
      + ingress {
          + from_port   = 443
          + to_port     = 443
          ...
        }
    }

# TF_VAR_envにprdを渡してplan（ポート8443のブロックが追加される）
$ TF_VAR_env=prd terraform plan

  + resource "aws_security_group" "web" {
      + ingress { from_port = 80 ... }
      + ingress { from_port = 443 ... }
      + ingress { from_port = 8443 ... }
    }

Error: Invalid for_each argument

  on main.tf line 15, in dynamic "ingress":
  15:     for_each = aws_instance.app.*.network_interface

The "for_each" value depends on resource attributes that cannot be
determined until apply, so Terraform cannot determine the full set of
keys that will identify the instances of this resource.

Error: Reference to undeclared resource

  on main.tf line 18, in resource "aws_security_group" "web":
  18:       from_port = ingress.value.from_port

A managed resource "ingress" "value" has not been declared.

# フィルタ条件のミスで空リストになる例
dynamic "ingress" {
  for_each = [
    for rule in var.ingress_rules :
    rule
    if rule.prd_only && var.env == "dev"  # dev環境ではprd_only=trueが全除外
  ]
  ...
}

# 結果: ingress{}ブロックが1つも生成されない

Error: Invalid function argument

  on locals.tf line 4:
  4:     gsi_attribute_names = setsubtract(local.gsi_keys, ["pk", "sk"])

Invalid value for "a" parameter: argument must be a set type, not list of string.