GitHub Actions と Terraform で構築する ECR + Lambda コンテナデプロイ環境

github_actions_repo = "<repo-org>/<repo-name>"
lambda_image_tag = ""

1
# ECR Repository for Lambda container images
2
resource "aws_ecr_repository" "lambda_repo" {
3
  name                 = "lambda-container-app"
4
  image_tag_mutability = "MUTABLE"
5

6
  image_scanning_configuration {
7
    scan_on_push = true
8
  }
9

10
  encryption_configuration {
11
    encryption_type = "AES256"
12
  }
13
}

16
resource "aws_ecr_lifecycle_policy" "lambda_repo_policy" {
17
  repository = aws_ecr_repository.lambda_repo.name
18

19
  policy = jsonencode({
20
    rules = [
21
      {
22
        rulePriority = 1
23
        description  = "Keep last 2 images"
24
        selection = {
25
          tagStatus   = "any"
26
          countType   = "imageCountMoreThan"
27
          countNumber = 2
28
        }
29
        action = {
30
          type = "expire"
31
        }
32
      }
33
    ]
34
  })
35
}

9
data "aws_iam_policy_document" "github_actions_assume_role" {
10
  statement {
11
    effect = "Allow"
12

13
    actions = [
14
      "sts:AssumeRoleWithWebIdentity"
15
    ]
16

17
    principals {
18
      type        = "Federated"
19
      identifiers = [aws_iam_openid_connect_provider.github_actions.arn]
20
    }
21

22
    condition {
23
      test     = "StringLike"
24
      variable = "token.actions.githubusercontent.com:sub"
25
      values   = ["repo:${var.github_actions_repo}:*"]
26
    }
27

28
    condition {
29
      test     = "StringEquals"
30
      variable = "token.actions.githubusercontent.com:aud"
31
      values   = ["sts.amazonaws.com"]
32
    }
33
  }
34
}
35

36
# GitHub Actions用のIAM roleとポリシーを作成
37
resource "aws_iam_role" "github_actions" {
38
  name = "github-actions-ecr-lambda-deploy"
39
  assume_role_policy = data.aws_iam_policy_document.github_actions_assume_role.json
40
}
41

42
data "aws_iam_policy_document" "push_ecr" {
43
  statement {
44
    effect = "Allow"
45

46
    actions = [
47
      "ecr:BatchCheckLayerAvailability",
48
      "ecr:GetDownloadUrlForLayer",
49
      "ecr:BatchGetImage",
50
      "ecr:PutImage",
51
      "ecr:InitiateLayerUpload",
52
      "ecr:UploadLayerPart",
53
      "ecr:CompleteLayerUpload",
54
    ]
55

56
    resources = [
57
      aws_ecr_repository.lambda_repo.arn
58
    ]
59
  }
60

61
  // https://github.com/aws-actions/amazon-ecr-login?tab=readme-ov-file#ecr-private
62
  statement {
63
    effect = "Allow"
64

65
    actions = [
66
      "ecr:GetAuthorizationToken"
67
    ]
68

69
    resources = [
70
      "*"
71
    ]
72
  }
73
}
74

75
# GitHub ActionsでECRにアクセスするためのポリシー
76
resource "aws_iam_role_policy" "github_actions_policy" {
77
  name   = "github-actions-ecr-policy"
78
  role   = aws_iam_role.github_actions.id
79
  policy = data.aws_iam_policy_document.push_ecr.json
80
}

1
resource "aws_iam_openid_connect_provider" "github_actions" {
2
  url = "https://token.actions.githubusercontent.com"
3

4
  client_id_list = [
5
    "sts.amazonaws.com",
6
  ]
7
}

1
data "aws_iam_policy_document" "lambda_assume_role" {
2
  statement {
3
    effect = "Allow"
4

5
    principals {
6
      type = "Service"
7
      identifiers = ["lambda.amazonaws.com"]
8
    }
9

10
    actions = [
11
      "sts:AssumeRole"
12
    ]
13
  }
14
}
15

16
# IAM role for Lambda function
17
resource "aws_iam_role" "lambda_execution_role" {
18
  name = "lambda-container-execution-role"
19
  assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
20
}
21

22
# Attach basic Lambda execution policy
23
resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
24
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
25
  role       = aws_iam_role.lambda_execution_role.name
26
}
27

28
# Lambda function using container image
29
resource "aws_lambda_function" "container_lambda" {
30
  count = var.create_lambda_function ? 1 : 0
31
  # ...省略
32
}

1
name: Deploy ECR from GitHub Action
2

3
on:
4
  workflow_dispatch:
5

6
permissions:
7
  id-token: write
8
  contents: read
9

10
jobs:
11
  deploy-container:
12
    runs-on: ubuntu-latest
13
    steps:
14
      - name: Checkout
15
        uses: actions/checkout@v4
16

17
      - name: Configure AWS credentials
18
        uses: aws-actions/configure-aws-credentials@v4
19
        with:
20
          role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ECR }}
21
          aws-region: ap-northeast-1
22
          role-session-name: github-actions-session
23

24
      - name: Log in to Amazon ECR
25
        id: login-ecr
26
        uses: aws-actions/amazon-ecr-login@v2
27

28
      - name: Build, tag, and push docker image to Amazon ECR
29
        env:
30
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
31
          REPOSITORY: lambda-container-app
32
          IMAGE_TAG: ${{ github.sha }}
33
        run: |
34
          cd github-actions-ecr-lambda-container-deploy
35
          docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG .
36
          docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG

17
- name: Configure AWS credentials
18
  uses: aws-actions/configure-aws-credentials@v4
19
  with:
20
    role-to-assume: ${{ vars.AWS_ASSUME_ROLE_ECR }}
21
    aws-region: ap-northeast-1
22
    role-session-name: github-actions-session

24
- name: Log in to Amazon ECR
25
  id: login-ecr
26
  uses: aws-actions/amazon-ecr-login@v2
27

28
- name: Build, tag, and push docker image to Amazon ECR
29
  env:
30
    REGISTRY: ${{ steps.login-ecr.outputs.registry }}
31
    REPOSITORY: lambda-container-app
32
    IMAGE_TAG: ${{ github.sha }}
33
  run: |
34
    cd github-actions-ecr-lambda-container-deploy
35
    docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG .
36
    docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG

1
FROM golang:1.24.6-alpine3.22 AS build
2

3
WORKDIR /go/src/app
4
COPY src/ .
5

6
RUN go mod download
7

8
RUN CGO_ENABLED=0 go build -o /go/bin/app
9

10
FROM gcr.io/distroless/static-debian12
11

12
COPY --from=build /go/bin/app /
13
CMD ["/app"]

1
package main
2

3
import (
4
  "context"
5
  "fmt"
6

7
  "github.com/aws/aws-lambda-go/lambda"
8
)
9

10
func main() {
11
  lambda.Start(Handler)
12
}
13

14
func Handler(ctx context.Context, request any) error {
15
  fmt.Println("Request received:", request)
16
  return nil
17
}

3
on:
4
  workflow_dispatch:

1
name: Assume Role and Check Identity
2

3
on:
4
  workflow_dispatch:
5

6
permissions:
7
  id-token: write
8
  contents: read
9

10
jobs:
11
  assume-role-and-check:
12
    runs-on: ubuntu-latest
13
    steps:
14
      - name: Checkout
15
        uses: actions/checkout@v4
16

17
      - name: Configure AWS credentials
18
        uses: aws-actions/configure-aws-credentials@v4
19
        with:
20
          role-to-assume: arn:aws:iam::<account-id>:role/github-actions-ecr-lambda-deploy
21
          aws-region: ap-northeast-1
22
          role-session-name: github-actions-session
23

24
      - name: Check identity
25
        run: |
26
          aws sts get-caller-identity

28
# Lambda function using container image
29
resource "aws_lambda_function" "container_lambda" {
30
  count = var.create_lambda_function ? 1 : 0
31

32
  function_name = "container-lambda-function"
33
  role          = aws_iam_role.lambda_execution_role.arn
34

35
  # Use container image from ECR
36
  package_type = "Image"
37
  image_uri    = "${aws_ecr_repository.lambda_repo.repository_url}:${var.lambda_image_tag}"
38

39
  # Container configuration
40
  timeout     = 30
41
  memory_size = 128
42

43
  # Environment variables (optional)
44
  environment {
45
    variables = {
46
      ENV = "dev"
47
    }
48
  }
49

50
  # Ensure the image exists before creating the function
51
  depends_on = [
52
    aws_ecr_repository.lambda_repo,
53
    aws_cloudwatch_log_group.lambda_logs,
54
  ]
55
}

57
resource "aws_lambda_function_url" "container_lambda" {
58
  # 設定内容
59
}

64
# CloudWatch Log Group for Lambda
65
resource "aws_cloudwatch_log_group" "lambda_logs" {
66
  name              = "/aws/lambda/container-lambda-function"
67
  retention_in_days = 14
68
}

1
FROM golang:1.24.6-alpine3.22 AS build
2

3
WORKDIR /go/src/app
4
COPY src/ .
5

6
RUN go mod download
7

8
RUN CGO_ENABLED=0 go build -o bootstrap .
9

10
FROM public.ecr.aws/lambda/provided:al2023
11

12
COPY --from=build /go/src/app/bootstrap ${LAMBDA_TASK_ROOT}
13
CMD ["bootstrap"]

1
FROM golang:1.24.6-alpine3.22 AS build
2

3
WORKDIR /go/src/app
4
COPY src/ .
5

6
RUN go mod download
7

8
RUN CGO_ENABLED=0 go build -o /go/bin/app
9

10
FROM gcr.io/distroless/static-debian12:debug
11

12
COPY --from=build /go/bin/app /
13
CMD ["/app"]

1
FROM gcr.io/distroless/static-debian12:debug
2

3
COPY --from=build /go/bin/app /
4
ENTRYPOINT ["/app"]