Infrastructure as Code (IaC) 徹底解説：Terraform/PulumiによるDXインフラ管理

# AWS EC2インスタンスを定義するTerraformコード例
provider "aws" {
  region = "ap-northeast-1"
}

resource "aws_instance" "web_server" {
  ami           = "ami-0c3fd0f5d33134a76"
  instance_type = "t3.micro"
  tags = {
    Name = "WebServer"
    Environment = "Production"
  }
}

// AWSのS3バケットを定義するPulumiコード例（TypeScript）
import * as aws from "@pulumi/aws";

const bucket = new aws.s3.Bucket("my-website-bucket", {
    website: {
        indexDocument: "index.html",
    },
    tags: {
        Environment: "Production",
        Project: "WebsiteHosting"
    }
});

export const bucketName = bucket.id;

# モジュールの定義（modules/vpc/main.tf）
variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
}

resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr
  tags = {
    Name = "main-vpc"
  }
}

output "vpc_id" {
  value = aws_vpc.main.id
}

# モジュールの使用（main.tf）
module "vpc" {
  source   = "./modules/vpc"
  vpc_cidr = "10.0.0.0/16"
}

// インフラコンポーネント（components/database.ts）
import * as aws from "@pulumi/aws";

export class Database {
    public readonly instance: aws.rds.Instance;
    
    constructor(name: string, dbConfig: any) {
        this.instance = new aws.rds.Instance(name, {
            engine: "mysql",
            instanceClass: dbConfig.instanceClass,
            allocatedStorage: dbConfig.storage,
            username: dbConfig.username,
            password: dbConfig.password,
            skipFinalSnapshot: true,
        });
    }
}

// コンポーネントの使用（index.ts）
import { Database } from "./components/database";

const db = new Database("app-database", {
    instanceClass: "db.t3.micro",
    storage: 20,
    username: "admin",
    password: "securePassword123"  // 本番では変数や秘密管理サービスを使用
});

infrastructure/
  ├── modules/
  │   ├── vpc/
  │   ├── database/
  │   └── compute/
  ├── environments/
  │   ├── dev/
  │   ├── staging/
  │   └── production/
  └── shared/

# Terraform環境別変数（environments/dev/terraform.tfvars）
environment = "dev"
instance_type = "t3.micro"
instance_count = 1

# Terraform環境別変数（environments/production/terraform.tfvars）
environment = "production"
instance_type = "t3.large"
instance_count = 3

# .github/workflows/terraform.yml
name: 'Terraform CI/CD'

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v1
      
    - name: Terraform Init
      run: terraform init
      
    - name: Terraform Format
      run: terraform fmt -check
      
    - name: Terraform Plan
      run: terraform plan
      
    - name: Terraform Apply
      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
      run: terraform apply -auto-approve

# Terraformでのセキュリティベストプラクティス適用例
resource "aws_s3_bucket" "data_bucket" {
  bucket = "my-secure-data-bucket"
  
  # 暗号化を有効化
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
  
  # パブリックアクセスをブロック
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
  
  # バージョニングを有効化
  versioning {
    enabled = true
  }
  
  # アクセスログ記録
  logging {
    target_bucket = aws_s3_bucket.log_bucket.id
    target_prefix = "log/"
  }
}