Terraformで複数AWSアカウントをまたぐ設計｜provider aliasとassume_roleでマルチアカウント構成を実装する方法

この記事のポイント

・provider aliasで複数AWSアカウントへのproviderを1つのコードで定義できる
・assume_roleブロックにrole_arnを指定するだけでクロスアカウント認証が切り替わる
・リソース定義でprovider = aws.devのように明示すると作成先アカウントを固定できる
・一度作成したaliasをproviders.tfから削除するとstateが壊れるので慎重に扱う

# providers.tf - 同一アカウントの東京/大阪リージョンにprovider aliasを定義
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# デフォルトprovider（東京リージョン）
provider "aws" {
  region = "ap-northeast-1"
}

# aliasを持つprovider（大阪リージョン）
provider "aws" {
  alias  = "osaka"
  region = "ap-northeast-3"
}

# main.tf - リソースにprovider aliasを指定
resource "aws_s3_bucket" "dr_backup" {
  provider = aws.osaka    # 大阪リージョンのproviderを明示
  bucket   = "my-app-dr-backup-osaka"

  tags = {
    Name = "DR用バックアップバケット"
  }
}

# providers.tf - マルチアカウント設定
# 管理アカウント（実行元）: 111122223333
# 開発アカウント:           123456789012
# 本番アカウント:           987654321098

# 実行元（管理アカウント）のデフォルトprovider
provider "aws" {
  region = "ap-northeast-1"
}

# 開発アカウントへのprovider alias
provider "aws" {
  alias  = "dev"
  region = "ap-northeast-1"

  assume_role {
    role_arn = "arn:aws:iam::123456789012:role/TerraformCrossAccountRole"
  }
}

# 本番アカウントへのprovider alias
provider "aws" {
  alias  = "prod"
  region = "ap-northeast-1"

  assume_role {
    role_arn = "arn:aws:iam::987654321098:role/TerraformCrossAccountRole"
  }
}

# 開発アカウントの既存VPC IDを取得する例
data "aws_vpc" "dev_existing" {
  provider = aws.dev    # 開発アカウントのproviderを指定

  tags = {
    Name = "existing-dev-vpc"
  }
}

# 本番アカウントのAMI IDを取得する例（本番アカウントが所有するゴールデンAMI）
data "aws_ami" "prod_golden" {
  provider    = aws.prod
  most_recent = true
  owners      = ["self"]

  filter {
    name   = "name"
    values = ["golden-ami-*"]
  }
}

# AWSマネジメントコンソールまたはCLIで開発アカウント側に作成する信頼ポリシー
# （管理アカウントのアカウントID: 111122223333 を許可）
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

# 管理アカウントのIAMポリシー（TerraformExecutionRole または実行ユーザーにアタッチ）
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": [
        "arn:aws:iam::123456789012:role/TerraformCrossAccountRole",
        "arn:aws:iam::987654321098:role/TerraformCrossAccountRole"
      ]
    }
  ]
}

# main.tf - 開発・本番アカウントにVPCを作成する例

# 開発アカウントにVPCを作成（provider = aws.dev を明示）
resource "aws_vpc" "dev" {
  provider   = aws.dev
  cidr_block = "10.1.0.0/16"

  tags = {
    Name        = "dev-vpc"
    Environment = "dev"
  }
}

resource "aws_subnet" "dev_public" {
  provider          = aws.dev
  vpc_id            = aws_vpc.dev.id
  cidr_block        = "10.1.1.0/24"
  availability_zone = "ap-northeast-1a"

  tags = {
    Name = "dev-public-subnet"
  }
}

# 本番アカウントにVPCを作成（provider = aws.prod を明示）
resource "aws_vpc" "prod" {
  provider   = aws.prod
  cidr_block = "10.0.0.0/16"

  tags = {
    Name        = "prod-vpc"
    Environment = "prod"
  }
}

resource "aws_subnet" "prod_public" {
  provider          = aws.prod
  vpc_id            = aws_vpc.prod.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-northeast-1a"

  tags = {
    Name = "prod-public-subnet"
  }
}

# terraform init 後に terraform plan を実行
$ terraform plan

Terraform will perform the following actions:

  # aws_subnet.dev_public will be created
  + resource "aws_subnet" "dev_public" {
      + arn               = (known after apply)
      + availability_zone = "ap-northeast-1a"
      + cidr_block        = "10.1.1.0/24"
      + id                = (known after apply)
      + tags              = {
          + "Name" = "dev-public-subnet"
        }
      + vpc_id            = (known after apply)
    }

  # aws_vpc.dev will be created
  + resource "aws_vpc" "dev" {
      + arn        = (known after apply)
      + cidr_block = "10.1.0.0/16"
      + id         = (known after apply)
      + tags       = {
          + "Environment" = "dev"
          + "Name"        = "dev-vpc"
        }
    }

  # aws_subnet.prod_public will be created
  + resource "aws_subnet" "prod_public" {
      + arn               = (known after apply)
      + availability_zone = "ap-northeast-1a"
      + cidr_block        = "10.0.1.0/24"
      + id                = (known after apply)
      + tags              = {
          + "Name" = "prod-public-subnet"
        }
      + vpc_id            = (known after apply)
    }

  # aws_vpc.prod will be created
  + resource "aws_vpc" "prod" {
      + arn        = (known after apply)
      + cidr_block = "10.0.0.0/16"
      + id         = (known after apply)
      + tags       = {
          + "Environment" = "prod"
          + "Name"        = "prod-vpc"
        }
    }

Plan: 4 to add, 0 to change, 0 to destroy.

# main.tf（呼び出し元）
# 同じVPCモジュールを開発・本番の両アカウントに展開する例

module "vpc_dev" {
  source = "./modules/vpc"

  providers = {
    aws = aws.dev   # 開発アカウントのproviderを渡す
  }

  vpc_cidr = "10.1.0.0/16"
  env_name = "dev"
}

module "vpc_prod" {
  source = "./modules/vpc"

  providers = {
    aws = aws.prod   # 本番アカウントのproviderを渡す
  }

  vpc_cidr = "10.0.0.0/16"
  env_name = "prod"
}

# VPCピアリングmodule（管理アカウントと開発アカウントをまたぐ操作）
module "vpc_peering" {
  source = "./modules/vpc-peering"

  providers = {
    aws.requester = aws       # 管理アカウント（ピアリングをリクエストする側）
    aws.accepter  = aws.dev   # 開発アカウント（ピアリングを承認する側）
  }

  requester_vpc_id = "vpc-xxx"
  accepter_vpc_id  = "vpc-yyy"
}

# modules/vpc-peering/versions.tf
terraform {
  required_version = ">= 1.3"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
      configuration_aliases = [aws.requester, aws.accepter]
    }
  }
}

Error: No valid credential sources found

  with provider["registry.terraform.io/hashicorp/aws"].dev,
  on providers.tf line 14, in provider "aws":
  14:   assume_role {

Error: AuthFailure: AWS was not able to validate the provided access credentials

  Error: user: arn:aws:iam::111122223333:user/terraform-ci is not authorized
  to perform: sts:AssumeRole on resource:
  arn:aws:iam::123456789012:role/TerraformCrossAccountRole

Error: No configuration for provider "aws" with alias "dev"

  on modules/vpc/main.tf line 3, in resource "aws_vpc" "main":
   3:   provider = aws.dev

# エラー出力例（環境により異なります）
Error: Provider configuration not present

To work with aws_vpc.dev its original provider configuration at
provider["registry.terraform.io/hashicorp/aws"].dev is required,
but it has been removed. Add back its configuration.