TerraformでRDSをプロビジョニングする方法｜aws_db_instanceとサブネットグループ・パラメータグループの実践設計

この記事のポイント

・aws_db_instanceの前にサブネットグループとセキュリティグループの定義が必要
・aws_db_parameter_groupで文字コード・タイムゾーンをコードで管理できる
・本番環境ではdeletion_protection=trueとskip_final_snapshot=falseを必ず設定する
・terraform applyは完了まで最大20分かかるためCI/CDのタイムアウト設定に注意

# subnet_group.tf
resource "aws_db_subnet_group" "main" {
  name       = "main-db-subnet-group"
  subnet_ids = [
    aws_subnet.private_a.id,  # ap-northeast-1a のプライベートサブネット
    aws_subnet.private_c.id,  # ap-northeast-1c のプライベートサブネット
  ]

  tags = {
    Name        = "main-db-subnet-group"
    Environment = "production"
  }
}

# security_group.tf
resource "aws_security_group" "rds" {
  name        = "rds-sg"
  description = "Security group for RDS MySQL"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port       = 3306
    to_port         = 3306
    protocol        = "tcp"
    # アプリケーションサーバーのSGからのみ許可
    security_groups = [aws_security_group.app.id]
    description     = "MySQL from app servers"
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "rds-sg"
  }
}

# rds.tf
resource "aws_db_instance" "main" {
  identifier        = "main-mysql"
  engine            = "mysql"
  engine_version    = "8.0.35"
  instance_class    = "db.t3.micro"
  allocated_storage = 20
  storage_type      = "gp3"

  db_name  = "appdb"
  username = "admin"
  password = var.db_password  # variables.tfで定義したsensitive変数

  db_subnet_group_name   = aws_db_subnet_group.main.name
  vpc_security_group_ids = [aws_security_group.rds.id]
  parameter_group_name   = aws_db_parameter_group.main.name

  # 本番必須設定
  deletion_protection       = true
  skip_final_snapshot       = false
  final_snapshot_identifier = "main-mysql-final-snapshot"
  backup_retention_period   = 7
  backup_window             = "02:00-03:00"
  maintenance_window        = "mon:03:00-mon:04:00"

  tags = {
    Name        = "main-mysql"
    Environment = "production"
  }
}

# variables.tf
variable "db_password" {
  description = "RDS admin password"
  type        = string
  sensitive   = true  # terraform planとログに値が表示されなくなる
}

$ terraform apply -var="db_password=MySecretPass123!"

aws_db_subnet_group.main: Creating...
aws_db_subnet_group.main: Creation complete after 4s [id=main-db-subnet-group]
aws_security_group.rds: Creating...
aws_security_group.rds: Creation complete after 3s [id=sg-0a1b2c3d4e5f67890]
aws_db_instance.main: Creating...
aws_db_instance.main: Still creating... [10s elapsed]
aws_db_instance.main: Still creating... [1m0s elapsed]
# ... （RDSの作成は通常5分～20分かかる）
aws_db_instance.main: Creation complete after 8m42s [id=main-mysql]

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

# parameter_group.tf
resource "aws_db_parameter_group" "main" {
  name   = "main-mysql80"
  family = "mysql8.0"  # engineとengine_versionに対応したfamilyを指定

  description = "Custom parameter group for MySQL 8.0"

  parameter {
    name  = "character_set_server"
    value = "utf8mb4"
  }

  parameter {
    name  = "character_set_client"
    value = "utf8mb4"
  }

  parameter {
    name         = "time_zone"
    value        = "Asia/Tokyo"
    apply_method = "immediate"  # 再起動なしで即時反映
  }

  parameter {
    name  = "slow_query_log"
    value = "1"
  }

  parameter {
    name  = "long_query_time"
    value = "1"  # 1秒以上のクエリをスロークエリとして記録
  }

  tags = {
    Name = "main-mysql80"
  }
}

$ terraform destroy

Error: RDS DB Instance is protected from deletion.
  with aws_db_instance.main,
  on rds.tf line 1, in resource "aws_db_instance" "main":
  Please disable deletion protection before deleting.

resource "aws_db_instance" "main" {
  # ... 既存の設定 ...
  multi_az = true  # スタンバイレプリカを別AZに自動配置
}

output "rds_endpoint" {
  value     = aws_db_instance.main.endpoint
  sensitive = false
}

$ terraform apply
Error: InvalidParameterCombination: Cannot specify a DB subnet group for DB instances in VPC.
# またはサブネットグループのAZが不足している場合:
Error: DB subnet group "main-db-subnet-group" is invalid because
  it must have at least 2 availability zones.

$ terraform apply
Error: InvalidParameterValue: Could not find parameter group family "mysql8.0"
  for parameter group "main-mysql80"
# familyの名前は厳密に確認する（例: mysql8.0, mysql8.4, aurora-mysql8.0 は別物）

resource "aws_db_instance" "main" {
  # ...

  timeouts {
    create = "40m"  # デフォルトは40m。CI側も合わせて延長する
    update = "80m"  # マルチAZ変更などは時間がかかる
    delete = "40m"
  }
}