TerraformでVPCエンドポイントを一括定義する方法｜インターフェース型のサブネット配置とプライベートDNS有効化の実装

この記事のポイント

・Interface型エンドポイントはsubnet_ids・security_group_ids・private_dns_enabledの3点セットが必須
・for_eachでlocalsのサービスマップを回すとDRYな一括定義が実現できる
・マルチAZにサブネットを分散するだけでエンドポイントもHA構成になる
・private_dns_enabledにはVPCのenable_dns_hostnames/supportが有効である前提条件がある

resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.ssm"
  vpc_endpoint_type   = "Interface"

  # ENIを配置するサブネット（マルチAZを推奨）
  subnet_ids = [
    aws_subnet.private_1a.id,
    aws_subnet.private_1c.id,
  ]

  # エンドポイント専用のセキュリティグループ
  security_group_ids = [aws_security_group.vpc_endpoint.id]

  # デフォルトDNS名をエンドポイントIPに解決させる
  private_dns_enabled = true

  tags = {
    Name = "ssm-endpoint"
  }
}

data "aws_region" "current" {}

# service_name をリージョン変数で組み立てる
service_name = "com.amazonaws.${data.aws_region.current.name}.ssm"

resource "aws_security_group" "vpc_endpoint" {
  name        = "vpc-endpoint-sg"
  description = "Allow HTTPS from VPC to interface endpoints"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "HTTPS from VPC"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.main.cidr_block]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = { Name = "vpc-endpoint-sg" }
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"

  # この2つがtrueでないとprivate_dns_enabled = trueが機能しない
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = { Name = "main-vpc" }
}

locals {
  # ECS Fargate + SSM Session Manager で最低限必要なエンドポイント群
  interface_endpoints = {
    ssm            = "ssm"
    ssmmessages    = "ssmmessages"
    ec2messages    = "ec2messages"
    ecr_api        = "ecr.api"
    ecr_dkr        = "ecr.dkr"
    logs           = "logs"
    secretsmanager = "secretsmanager"
  }
}

data "aws_region" "current" {}

resource "aws_vpc_endpoint" "interface" {
  for_each = local.interface_endpoints

  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${data.aws_region.current.name}.${each.value}"
  vpc_endpoint_type = "Interface"

  subnet_ids = [
    aws_subnet.private_1a.id,
    aws_subnet.private_1c.id,
  ]

  security_group_ids  = [aws_security_group.vpc_endpoint.id]
  private_dns_enabled = true

  tags = {
    Name = "${each.key}-endpoint"
  }
}

$ terraform plan

Terraform will perform the following actions:

  # aws_vpc_endpoint.interface["ec2messages"] will be created
  + resource "aws_vpc_endpoint" "interface" {
      + service_name        = "com.amazonaws.ap-northeast-1.ec2messages"
      + vpc_endpoint_type   = "Interface"
      + private_dns_enabled = true
      ...
    }

  # aws_vpc_endpoint.interface["ecr_api"] will be created
  ...（以下5リソース分続く）

Plan: 7 to add, 0 to change, 0 to destroy.

resource "aws_subnet" "private" {
  for_each = {
    "ap-northeast-1a" = "10.0.1.0/24"
    "ap-northeast-1c" = "10.0.2.0/24"
    "ap-northeast-1d" = "10.0.3.0/24"
  }

  vpc_id            = aws_vpc.main.id
  cidr_block        = each.value
  availability_zone = each.key

  tags = { Name = "private-${each.key}" }
}

resource "aws_vpc_endpoint" "interface" {
  for_each = local.interface_endpoints

  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${data.aws_region.current.name}.${each.value}"
  vpc_endpoint_type = "Interface"

  # values()でサブネットIDの一覧を渡す（3AZ分のENIが作成される）
  subnet_ids          = values(aws_subnet.private)[*].id
  security_group_ids  = [aws_security_group.vpc_endpoint.id]
  private_dns_enabled = true

  tags = { Name = "${each.key}-endpoint" }
}

# VPCのDNS設定を確認する（vpc-idは実際のIDに置き換え）
$ aws ec2 describe-vpc-attribute \
    --vpc-id vpc-0a1b2c3d4e5f \
    --attribute enableDnsHostnames

{
    "VpcId": "vpc-0a1b2c3d4e5f",
    "EnableDnsHostnames": {
        "Value": false
    }
}
# Value: false の場合はenable_dns_hostnames = trueをterraform applyで反映する

# エンドポイントのステータスと配置を確認する
$ aws ec2 describe-vpc-endpoints \
    --filters "Name=vpc-id,Values=vpc-0a1b2c3d4e5f" \
    --query "VpcEndpoints[*].{Service:ServiceName,State:State,Subnets:SubnetIds}" \
    --output table

----------------------------------------------------------------------
|                      DescribeVpcEndpoints                          |
+--------------------------+----------+------------------------------+
|         Service          |  State   |  Subnets                     |
+--------------------------+----------+------------------------------+
|  com.amazonaws.ap-..ssm  | available|  subnet-xxx, subnet-yyy      |
|  com.amazonaws.ap-..ecr  | available|  subnet-xxx, subnet-yyy      |
+--------------------------+----------+------------------------------+