Terraformのcreate_before_destroyでゼロダウンタイム更新する方法｜ALBリスナールール・ACM証明書切り替えとlifecycle設計の実践

この記事のポイント

・create_before_destroyで新リソースを先に作り、切り替え後に旧リソースを削除できる
・ACM証明書・ALBリスナーなど削除順序が危険なリソースに必須の設定
・依存関係の循環エラー（Cycle error）は参照を切ることで解決できる
・ignore_changesやprevent_destroyと組み合わせた安全なlifecycle設計パターンも解説

  # aws_acm_certificate.main must be replaced
-/+ resource "aws_acm_certificate" "main" {
    ~ domain_name = "old.example.com" -> "new.example.com" # forces replacement
    ...
}

Plan: 1 to add, 0 to change, 1 to destroy.

resource "aws_acm_certificate" "main" {
  domain_name       = "example.com"
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

# ACM証明書
resource "aws_acm_certificate" "main" {
  domain_name               = var.domain_name
  subject_alternative_names = var.san_domains
  validation_method         = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

# DNS検証レコード
resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.main.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.main.zone_id

  lifecycle {
    create_before_destroy = true
  }
}

# 証明書の発行完了を待つ
resource "aws_acm_certificate_validation" "main" {
  certificate_arn         = aws_acm_certificate.main.arn
  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]

  lifecycle {
    create_before_destroy = true
  }
}

Plan: 3 to add, 0 to change, 3 to destroy.

aws_acm_certificate.main: Creating...
aws_acm_certificate.main: Creation complete after 2s [id=arn:aws:acm:ap-northeast-1:123456789012:certificate/abc12345-1234-1234-1234-abcdef123456]
aws_route53_record.cert_validation["new.example.com"]: Creating...
aws_route53_record.cert_validation["new.example.com"]: Creation complete after 21s
aws_acm_certificate_validation.main: Creating...
aws_acm_certificate_validation.main: Still creating... [1m0s elapsed]
aws_acm_certificate_validation.main: Creation complete after 3m22s
aws_acm_certificate.main (deposed object): Destroying...
aws_acm_certificate.main (deposed object): Destruction complete after 1s
Apply complete! Resources: 3 added, 0 changed, 3 destroyed.

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = "443"
  protocol          = "HTTPS"

  # 証明書切り替え時のダウンタイムを防ぐ
  certificate_arn = aws_acm_certificate.main.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.main.arn
  }

  lifecycle {
    create_before_destroy = true
  }
}

Error: Cycle: aws_acm_certificate_validation.main, aws_lb_listener.https (destroy), aws_acm_certificate.main (expand)

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = "443"
  protocol          = "HTTPS"

  # aws_acm_certificate_validation.main.certificate_arn ではなく
  # aws_acm_certificate.main.arn を直接参照して循環を断ち切る
  certificate_arn = aws_acm_certificate.main.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.main.arn
  }

  lifecycle {
    create_before_destroy = true
  }
}

# Cycle errorが解消されてplanが正常に通った例
Plan: 4 to add, 0 to change, 4 to destroy.