TerraformとAnsibleを役割分担させる設計｜プロビジョナーを使わずにterraform applyとAnsible Playbookを連携するCI/CDパターン

この記事のポイント

・Terraform provisionerでAnsibleを呼ぶのはアンチパターン——設計の問題点を解説する
・terraform outputでIPを取り出し、Ansibleのインベントリに動的に渡すのが正しい連携設計
・GitHub ActionsでTerraform jobとAnsible jobを順次実行してCI/CDで自動化できる
・AWS SSMセッションマネージャー経由でSSHなしにAnsibleを実行できる設計も選択肢になる

# outputs.tf
output "web_instance_ips" {
  description = "Web servers public IP list"
  value       = aws_instance.web[*].public_ip
}

output "db_instance_ip" {
  description = "DB server private IP"
  value       = aws_instance.db.private_ip
}

#!/bin/bash
# generate-inventory.sh
# terraform outputのJSON出力からAnsibleのINI形式インベントリを生成する

WEB_IPS=$(terraform output -json web_instance_ips | jq -r '.[]')
DB_IP=$(terraform output -raw db_instance_ip)

# [web]セクションにIPを追記してインベントリを生成する
echo "[web]" > inventory.ini
echo "${WEB_IPS}" >> inventory.ini
echo "" >> inventory.ini
echo "[db]" >> inventory.ini
echo "${DB_IP}" >> inventory.ini
echo "" >> inventory.ini
echo "[all:vars]" >> inventory.ini
echo "ansible_user=ec2-user" >> inventory.ini
echo "ansible_ssh_private_key_file=~/.ssh/deploy.pem" >> inventory.ini

# site.yml の例（Webサーバーにnginxをインストール）
---
- hosts: web
  become: true
  roles:
    - nginx
    - php-fpm
    - app-deploy

- hosts: db
  become: true
  roles:
    - mariadb
    - database-init

# 実行コマンド例
ansible-playbook -i inventory.ini site.yml --check  # ドライラン確認
ansible-playbook -i inventory.ini site.yml           # 本番実行

# 出力例（環境により異なります）
# PLAY [web] *************************************
# TASK [nginx : Install nginx] *******************
# ok: [10.0.1.100]
# TASK [nginx : Enable nginx service] ************
# changed: [10.0.1.100]
# PLAY RECAP *************************************
# 10.0.1.100 : ok=12   changed=3   unreachable=0   failed=0

# .github/workflows/deploy.yml
name: Infrastructure and Configuration Deploy

on:
  push:
    branches: [main]

jobs:
  terraform:
    name: Terraform Apply
    runs-on: ubuntu-latest
    outputs:
      web_ips: ${{ steps.tf_output.outputs.web_ips }}
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "1.9.0"

      - name: Terraform Init
        run: terraform init
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Terraform Apply
        run: terraform apply -auto-approve

      - name: Get Terraform Outputs
        id: tf_output
        run: |
          echo "web_ips=$(terraform output -json web_instance_ips)" >> "$GITHUB_OUTPUT"

  ansible:
    name: Ansible Configuration
    runs-on: ubuntu-latest
    needs: terraform   # terraform jobが完了してから実行
    steps:
      - uses: actions/checkout@v4

      - name: Install Ansible
        run: pip3 install ansible

      - name: Generate Inventory from Terraform Output
        run: |
          echo '[web]' > inventory.ini
          echo '${{ needs.terraform.outputs.web_ips }}' | jq -r '.[]' >> inventory.ini
          echo '' >> inventory.ini
          echo '[all:vars]' >> inventory.ini
          echo 'ansible_user=ec2-user' >> inventory.ini

      - name: Run Ansible Playbook
        run: |
          ansible-playbook -i inventory.ini site.yml
        env:
          ANSIBLE_HOST_KEY_CHECKING: "false"

# inventory.ini（SSM経由の場合）
[web]
i-0abc1234defg5678   # インスタンスIDで指定（IPではなく）

[all:vars]
ansible_connection=community.aws.aws_ssm
ansible_aws_ssm_region=ap-northeast-1
ansible_user=ec2-user

# Terraform側でSSMアクセス用IAMロールを定義する例
resource "aws_iam_role_policy_attachment" "ssm_managed" {
  role       = aws_iam_role.web_instance.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# Playbookの冒頭にwait_for_connectionを追加する例
- hosts: web
  gather_facts: false
  tasks:
    - name: Wait for SSH to become available
      ansible.builtin.wait_for_connection:
        delay: 10
        timeout: 120

- hosts: web
  become: true
  roles:
    - nginx