Terraformのdynamic blockでHCL設定を動的に生成する方法｜繰り返し設定の簡潔化と実務パターン

この記事のポイント

・dynamic blockはresource内のネストブロックをリストや集合から動的に生成するHCL構文
・for_each + content{} の組み合わせが基本形。iterator引数で参照名を変更できる
・セキュリティグループのingress・EBSボリューム追加が代表的な実務ユースケース
・for式をfor_each内で使うと、変数リストの変換・フィルタリングを1行で書ける

# 静的記述の例 ── ポートが増えるたびにブロックをコピーする
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# dynamic blockの基本形
resource "リソースタイプ" "名前" {
  # 通常の属性

  dynamic "ネストブロック名" {
    for_each = 繰り返し元（リスト・マップ・集合）
    content {
      # ブロック内で使う属性
      属性名 = ネストブロック名.value.キー
    }
  }
}

# variables.tf
variable "ingress_rules" {
  description = "セキュリティグループのingressルール一覧"
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))
  default = [
    { from_port = 80,   to_port = 80,   protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] },
    { from_port = 443,  to_port = 443,  protocol = "tcp", cidr_blocks = ["0.0.0.0/0"] },
    { from_port = 8080, to_port = 8080, protocol = "tcp", cidr_blocks = ["10.0.0.0/8"] },
  ]
}

# main.tf
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = var.vpc_id

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
    }
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# iteratorで参照名を「rule」に変更する例
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = var.vpc_id

  dynamic "ingress" {
    for_each = var.ingress_rules
    iterator = rule           # デフォルトの「ingress」を「rule」に変更
    content {
      from_port   = rule.value.from_port
      to_port     = rule.value.to_port
      protocol    = rule.value.protocol
      cidr_blocks = rule.value.cidr_blocks
    }
  }
}

# variables.tf
variable "ebs_volumes" {
  description = "追加EBSボリュームのリスト"
  type = list(object({
    device_name = string
    volume_size = number
    volume_type = string
    encrypted   = bool
  }))
  default = [
    { device_name = "/dev/sdb", volume_size = 100, volume_type = "gp3", encrypted = true },
    { device_name = "/dev/sdc", volume_size = 200, volume_type = "gp3", encrypted = true },
  ]
}

# main.tf
resource "aws_instance" "app" {
  ami           = var.ami_id
  instance_type = var.instance_type

  dynamic "ebs_block_device" {
    for_each = var.ebs_volumes
    iterator = vol
    content {
      device_name = vol.value.device_name
      volume_size = vol.value.volume_size
      volume_type = vol.value.volume_type
      encrypted   = vol.value.encrypted
    }
  }
}

# variables.tf
variable "iam_statements" {
  description = "IAMポリシーのStatementリスト"
  type = list(object({
    sid       = string
    actions   = list(string)
    resources = list(string)
    effect    = string
  }))
  default = [
    {
      sid       = "AllowS3ReadOnly"
      actions   = ["s3:GetObject", "s3:ListBucket"]
      resources = ["arn:aws:s3:::my-app-bucket", "arn:aws:s3:::my-app-bucket/*"]
      effect    = "Allow"
    },
    {
      sid       = "AllowCloudWatchLogs"
      actions   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
      resources = ["arn:aws:logs:ap-northeast-1:123456789012:*"]
      effect    = "Allow"
    },
  ]
}

# main.tf
data "aws_iam_policy_document" "app" {
  dynamic "statement" {
    for_each = var.iam_statements
    iterator = stmt
    content {
      sid       = stmt.value.sid
      actions   = stmt.value.actions
      resources = stmt.value.resources
      effect    = stmt.value.effect
    }
  }
}

resource "aws_iam_policy" "app" {
  name   = "${var.env}-app-policy"
  policy = data.aws_iam_policy_document.app.json
}

# variables.tf
variable "ingress_rules" {
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
    prd_only    = optional(bool, false)  # 本番専用フラグ
  }))
  default = [
    { from_port = 80,   to_port = 80,   protocol = "tcp",
      cidr_blocks = ["0.0.0.0/0"],   prd_only = false },
    { from_port = 443,  to_port = 443,  protocol = "tcp",
      cidr_blocks = ["0.0.0.0/0"],   prd_only = false },
    { from_port = 8443, to_port = 8443, protocol = "tcp",
      cidr_blocks = ["0.0.0.0/0"],   prd_only = true },
  ]
}

# main.tf
resource "aws_security_group" "web" {
  name   = "${var.env}-web-sg"
  vpc_id = var.vpc_id

  dynamic "ingress" {
    # for式でフィルタリング: prd_onlyがtrueのルールは本番環境のみ生成
    for_each = [
      for rule in var.ingress_rules :
      rule
      if !rule.prd_only || var.env == "prd"
    ]
    iterator = rule
    content {
      from_port   = rule.value.from_port
      to_port     = rule.value.to_port
      protocol    = rule.value.protocol
      cidr_blocks = rule.value.cidr_blocks
    }
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# TF_VAR_envにdevを渡してplan
$ TF_VAR_env=dev terraform plan

# 出力（ingressブロックが2つ生成される ─ ポート8443は除外）
  # aws_security_group.web will be created
  + resource "aws_security_group" "web" {
      + ingress {
          + from_port   = 80
          + to_port     = 80
          ...
        }
      + ingress {
          + from_port   = 443
          + to_port     = 443
          ...
        }
    }

# TF_VAR_envにprdを渡してplan（ポート8443のブロックが追加される）
$ TF_VAR_env=prd terraform plan

  + resource "aws_security_group" "web" {
      + ingress { from_port = 80 ... }
      + ingress { from_port = 443 ... }
      + ingress { from_port = 8443 ... }
    }

Error: Invalid for_each argument

  on main.tf line 15, in dynamic "ingress":
  15:     for_each = aws_instance.app.*.network_interface

The "for_each" value depends on resource attributes that cannot be
determined until apply, so Terraform cannot determine the full set of
keys that will identify the instances of this resource.

Error: Reference to undeclared resource

  on main.tf line 18, in resource "aws_security_group" "web":
  18:       from_port = ingress.value.from_port

A managed resource "ingress" "value" has not been declared.

# フィルタ条件のミスで空リストになる例
dynamic "ingress" {
  for_each = [
    for rule in var.ingress_rules :
    rule
    if rule.prd_only && var.env == "dev"  # dev環境ではprd_only=trueが全除外
  ]
  ...
}

# 結果: ingress{}ブロックが1つも生成されない