Terraformで複数AWSアカウントをまたぐ設計｜provider aliasとassume_roleでマルチアカウント構成を実装する方法

この記事のポイント

・provider aliasで複数AWSアカウントへのproviderを1つのコードで定義できる
・assume_roleブロックにrole_arnを指定するだけでクロスアカウント認証が切り替わる
・リソース定義でprovider = aws.devのように明示すると作成先アカウントを固定できる
・本番/開発で構成差が大きい場合はディレクトリ分割のほうが安全

# providers.tf - 同一アカウントの東京/大阪リージョンにprovider aliasを定義
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# デフォルトprovider（東京リージョン）
provider "aws" {
  region = "ap-northeast-1"
}

# aliasを持つprovider（大阪リージョン）
provider "aws" {
  alias  = "osaka"
  region = "ap-northeast-3"
}

# main.tf - リソースにprovider aliasを指定
resource "aws_s3_bucket" "dr_backup" {
  provider = aws.osaka    # 大阪リージョンのproviderを明示
  bucket   = "my-app-dr-backup-osaka"

  tags = {
    Name = "DR用バックアップバケット"
  }
}

# providers.tf - マルチアカウント設定
# 管理アカウント（実行元）: 111122223333
# 開発アカウント:           123456789012
# 本番アカウント:           987654321098

# 実行元（管理アカウント）のデフォルトprovider
provider "aws" {
  region = "ap-northeast-1"
}

# 開発アカウントへのprovider alias
provider "aws" {
  alias  = "dev"
  region = "ap-northeast-1"

  assume_role {
    role_arn = "arn:aws:iam::123456789012:role/TerraformCrossAccountRole"
  }
}

# 本番アカウントへのprovider alias
provider "aws" {
  alias  = "prod"
  region = "ap-northeast-1"

  assume_role {
    role_arn = "arn:aws:iam::987654321098:role/TerraformCrossAccountRole"
  }
}

# AWSマネジメントコンソールまたはCLIで開発アカウント側に作成する信頼ポリシー
# （管理アカウントのアカウントID: 111122223333 を許可）
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

# 管理アカウントのIAMポリシー（TerraformExecutionRole または実行ユーザーにアタッチ）
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": [
        "arn:aws:iam::123456789012:role/TerraformCrossAccountRole",
        "arn:aws:iam::987654321098:role/TerraformCrossAccountRole"
      ]
    }
  ]
}

# main.tf - 開発・本番アカウントにVPCを作成する例

# 開発アカウントにVPCを作成（provider = aws.dev を明示）
resource "aws_vpc" "dev" {
  provider   = aws.dev
  cidr_block = "10.1.0.0/16"

  tags = {
    Name        = "dev-vpc"
    Environment = "dev"
  }
}

resource "aws_subnet" "dev_public" {
  provider          = aws.dev
  vpc_id            = aws_vpc.dev.id
  cidr_block        = "10.1.1.0/24"
  availability_zone = "ap-northeast-1a"

  tags = {
    Name = "dev-public-subnet"
  }
}

# 本番アカウントにVPCを作成（provider = aws.prod を明示）
resource "aws_vpc" "prod" {
  provider   = aws.prod
  cidr_block = "10.0.0.0/16"

  tags = {
    Name        = "prod-vpc"
    Environment = "prod"
  }
}

resource "aws_subnet" "prod_public" {
  provider          = aws.prod
  vpc_id            = aws_vpc.prod.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-northeast-1a"

  tags = {
    Name = "prod-public-subnet"
  }
}

# terraform init 後に terraform plan を実行
$ terraform plan

Terraform will perform the following actions:

  # aws_subnet.dev_public will be created
  + resource "aws_subnet" "dev_public" {
      + arn               = (known after apply)
      + availability_zone = "ap-northeast-1a"
      + cidr_block        = "10.1.1.0/24"
      + id                = (known after apply)
      + tags              = {
          + "Name" = "dev-public-subnet"
        }
      + vpc_id            = (known after apply)
    }

  # aws_vpc.dev will be created
  + resource "aws_vpc" "dev" {
      + arn        = (known after apply)
      + cidr_block = "10.1.0.0/16"
      + id         = (known after apply)
      + tags       = {
          + "Environment" = "dev"
          + "Name"        = "dev-vpc"
        }
    }

  # aws_subnet.prod_public will be created
  + resource "aws_subnet" "prod_public" {
      + arn               = (known after apply)
      + availability_zone = "ap-northeast-1a"
      + cidr_block        = "10.0.1.0/24"
      + id                = (known after apply)
      + tags              = {
          + "Name" = "prod-public-subnet"
        }
      + vpc_id            = (known after apply)
    }

  # aws_vpc.prod will be created
  + resource "aws_vpc" "prod" {
      + arn        = (known after apply)
      + cidr_block = "10.0.0.0/16"
      + id         = (known after apply)
      + tags       = {
          + "Environment" = "prod"
          + "Name"        = "prod-vpc"
        }
    }

Plan: 4 to add, 0 to change, 0 to destroy.

Error: No valid credential sources found

  with provider["registry.terraform.io/hashicorp/aws"].dev,
  on providers.tf line 14, in provider "aws":
  14:   assume_role {

Error: AuthFailure: AWS was not able to validate the provided access credentials

  Error: user: arn:aws:iam::111122223333:user/terraform-ci is not authorized
  to perform: sts:AssumeRole on resource:
  arn:aws:iam::123456789012:role/TerraformCrossAccountRole