Next.jsのISRをEFSを用いてECSデプロイ環境で動作するようにしてみた

#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import { DemoEcsPlatformStack } from '../lib/demo-ecs-platform-stack';
import { DemoEcsServiceStack } from '../lib/demo-ecs-service-stack';

const app = new cdk.App();

// プラットフォームスタック
const platformStack = new DemoEcsPlatformStack(app, 'DemoEcsPlatformStack', {
  /* If you don't specify 'env', this stack will be environment-agnostic.
   * Account/Region-dependent features and context lookups will not work,
   * but a single synthesized template can be deployed anywhere. */

  /* Uncomment the next line to specialize this stack for the AWS Account
   * and Region that are implied by the current CLI configuration. */
  // env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION },

  /* Uncomment the next line if you know exactly what Account and Region you
   * want to deploy the stack to. */
  // env: { account: '123456789012', region: 'us-east-1' },

  /* For more information, see https://docs.aws.amazon.com/cdk/latest/guide/environments.html */
});

// サービススタック
const serviceStack = new DemoEcsServiceStack(app, 'DemoEcsServiceStack', {
  vpc: platformStack.vpc,
  cluster: platformStack.cluster,
  alb: platformStack.alb,
  nextjsRepo: platformStack.nextjsRepo.repositoryName,
  nextjsSecurityGroup: platformStack.nextjsSecurityGroup,
  nextjsTargetGroup: platformStack.nextjsTargetGroup,
  nextjsLogGroup: platformStack.nextjsLogGroup,
  fileSystem: platformStack.fileSystem,
  accessPoint: platformStack.accessPoint
});

// スタック依存関係を明示
serviceStack.addDependency(platformStack);

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecr from 'aws-cdk-lib/aws-ecr';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as efs from 'aws-cdk-lib/aws-efs';
import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
import * as logs from 'aws-cdk-lib/aws-logs';

export class DemoEcsPlatformStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // ECRリポジトリ - Next.js用
    const nextjsRepo = new ecr.Repository(this, 'NextjsRepository', {
      repositoryName: 'demo-ecs-nextjs-repository',
      removalPolicy: cdk.RemovalPolicy.DESTROY
    });

    // VPC（NAT Gateway構成）
    const vpc = new ec2.Vpc(this, 'DemoVpc', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',
          subnetType: ec2.SubnetType.PUBLIC,
        },
        {
          cidrMask: 24,
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
        }
      ]
    });

    // セキュリティグループ - ALB用
    const albSecurityGroup = new ec2.SecurityGroup(this, 'AlbSecurityGroup', {
      vpc: vpc,
      description: 'Security Group for Application Load Balancer',
      allowAllOutbound: true
    });

    // ALB用セキュリティグループルール
    albSecurityGroup.addIngressRule(
      ec2.Peer.anyIpv4(),
      ec2.Port.tcp(80),
      'HTTP traffic from anywhere'
    );

    // セキュリティグループ - Next.js用
    const nextjsSecurityGroup = new ec2.SecurityGroup(this, 'NextjsSecurityGroup', {
      vpc: vpc,
      description: 'Security Group for Next.js ECS Tasks',
      allowAllOutbound: true
    });

    // Next.js用セキュリティグループルール（ALBからのトラフィック）
    nextjsSecurityGroup.addIngressRule(
      albSecurityGroup,
      ec2.Port.tcp(3000),
      'HTTP traffic from ALB'
    );

    // セキュリティグループ - EFS用
    const efsSecurityGroup = new ec2.SecurityGroup(this, 'EfsSecurityGroup', {
      vpc: vpc,
      description: 'Security Group for EFS',
      allowAllOutbound: true
    });

    // EFS用セキュリティグループルール（ECSタスクからのNFS通信許可）
    efsSecurityGroup.addIngressRule(
      nextjsSecurityGroup,
      ec2.Port.tcp(2049),
      'NFS traffic from ECS Tasks'
    );

    // EFSファイルシステム
    const fileSystem = new efs.FileSystem(this, 'NextjsCacheFileSystem', {
      vpc: vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
      securityGroup: efsSecurityGroup,
      performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,
      throughputMode: efs.ThroughputMode.BURSTING,
      encrypted: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY
    });

    // EFSアクセスポイント
    const accessPoint = new efs.AccessPoint(this, 'NextjsCacheAccessPoint', {
      fileSystem: fileSystem,
      path: '/nextjs-cache',
      posixUser: {
        uid: '1000',
        gid: '1000'
      },
      createAcl: {
        ownerUid: '1000',
        ownerGid: '1000',
        permissions: '755'
      }
    });

    // CloudWatch Logs グループ - Next.js用
    const nextjsLogGroup = new logs.LogGroup(this, 'NextjsLogGroup', {
      logGroupName: '/ecs/demo-nextjs',
      retention: logs.RetentionDays.ONE_WEEK,
      removalPolicy: cdk.RemovalPolicy.DESTROY
    });

    // ECSクラスター
    const cluster = new ecs.Cluster(this, 'DemoCluster', {
      clusterName: 'demo-ecs-platform-cluster',
      vpc: vpc
    });

    // ALB
    const alb = new elbv2.ApplicationLoadBalancer(this, 'DemoAlb', {
      vpc: vpc,
      internetFacing: true,
      vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
      securityGroup: albSecurityGroup
    });

    // ALBターゲットグループ - Next.js
    const nextjsTargetGroup = new elbv2.ApplicationTargetGroup(this, 'NextjsTargetGroup', {
      vpc: vpc,
      port: 3000,
      protocol: elbv2.ApplicationProtocol.HTTP,
      targetType: elbv2.TargetType.IP,
      healthCheck: {
        path: '/',
        healthyHttpCodes: '200'
      }
    });

    // ALBリスナー
    alb.addListener('NextjsListener', {
      port: 80,
      defaultTargetGroups: [nextjsTargetGroup]
    });

    // エクスポート用のプロパティ
    this.vpc = vpc;
    this.cluster = cluster;
    this.alb = alb;
    this.nextjsRepo = nextjsRepo;
    this.nextjsSecurityGroup = nextjsSecurityGroup;
    this.nextjsTargetGroup = nextjsTargetGroup;
    this.nextjsLogGroup = nextjsLogGroup;
    this.fileSystem = fileSystem;
    this.accessPoint = accessPoint;
  }

  public readonly vpc: ec2.Vpc;
  public readonly cluster: ecs.Cluster;
  public readonly alb: elbv2.ApplicationLoadBalancer;
  public readonly nextjsRepo: ecr.Repository;
  public readonly nextjsSecurityGroup: ec2.SecurityGroup;
  public readonly nextjsTargetGroup: elbv2.ApplicationTargetGroup;
  public readonly nextjsLogGroup: logs.LogGroup;
  public readonly fileSystem: efs.FileSystem;
  public readonly accessPoint: efs.AccessPoint;
}

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as efs from 'aws-cdk-lib/aws-efs';
import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as logs from 'aws-cdk-lib/aws-logs';

export interface DemoEcsServiceStackProps extends cdk.StackProps {
  vpc: ec2.IVpc;
  cluster: ecs.ICluster;
  alb: elbv2.IApplicationLoadBalancer;
  nextjsRepo: string;
  nextjsSecurityGroup: ec2.ISecurityGroup;
  nextjsTargetGroup: elbv2.IApplicationTargetGroup;
  nextjsLogGroup: logs.ILogGroup;
  fileSystem: efs.IFileSystem;
  accessPoint: efs.IAccessPoint;
}

export class DemoEcsServiceStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: DemoEcsServiceStackProps) {
    super(scope, id, props);

    // タスク実行ロール
    const taskExecutionRole = new iam.Role(this, 'TaskExecutionRole', {
      assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
      description: 'ECS Task Execution Role',
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonECSTaskExecutionRolePolicy')
      ]
    });

    // タスクロール（executeCommand用 + EFSアクセス用）
    const taskRole = new iam.Role(this, 'TaskRole', {
      assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
      description: 'ECS Task Role for execute command and EFS access',
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore')
      ]
    });

    // EFSアクセス用IAMポリシー
    taskRole.addToPolicy(new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      actions: [
        'elasticfilesystem:ClientMount',
        'elasticfilesystem:ClientWrite',
        'elasticfilesystem:ClientRootAccess'
      ],
      resources: [props.fileSystem.fileSystemArn],
      conditions: {
        StringEquals: {
          'elasticfilesystem:AccessPointArn': props.accessPoint.accessPointArn
        }
      }
    }));

    // タスク定義 - Next.js 15向け
    const nextjsTaskDef = new ecs.FargateTaskDefinition(this, 'NextjsTaskDef', {
      memoryLimitMiB: 1024,
      cpu: 512,
      executionRole: taskExecutionRole,
      taskRole: taskRole
    });

    // EFSボリュームをタスク定義に追加
    nextjsTaskDef.addVolume({
      name: 'nextjs-cache',
      efsVolumeConfiguration: {
        fileSystemId: props.fileSystem.fileSystemId,
        transitEncryption: 'ENABLED',
        authorizationConfig: {
          accessPointId: props.accessPoint.accessPointId,
          iam: 'ENABLED'
        }
      }
    });

    const container = nextjsTaskDef.addContainer('nextjs-container', {
      image: ecs.ContainerImage.fromRegistry(`${cdk.Aws.ACCOUNT_ID}.dkr.ecr.${cdk.Aws.REGION}.amazonaws.com/${props.nextjsRepo}:latest`),
      memoryLimitMiB: 1024,
      portMappings: [
        {
          containerPort: 3000,
          protocol: ecs.Protocol.TCP
        }
      ],
      environment: {
        'NODE_ENV': 'production',
        'PORT': '3000',
        'HOSTNAME': '0.0.0.0',
        'CACHE_DIR': '/cache-data'
      },
      logging: ecs.LogDrivers.awsLogs({
        logGroup: props.nextjsLogGroup,
        streamPrefix: 'nextjs'
      })
    });

    // コンテナにEFSマウントポイントを追加（カスタムキャッシュハンドラー用）
    container.addMountPoints({
      sourceVolume: 'nextjs-cache',
      containerPath: '/cache-data',
      readOnly: false
    });

    // ECSサービス - Next.js（2タスク、AZ分散）
    const nextjsService = new ecs.FargateService(this, 'NextjsService', {
      cluster: props.cluster,
      taskDefinition: nextjsTaskDef,
      desiredCount: 2,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
      securityGroups: [props.nextjsSecurityGroup],
      serviceName: 'demo-nextjs-service',
      enableExecuteCommand: true,
      minHealthyPercent: 100,
      maxHealthyPercent: 200,
      // EFSマウントにはplatformVersion 1.4.0以上が必要
      platformVersion: ecs.FargatePlatformVersion.LATEST
    });

    // Next.jsサービスをターゲットグループに登録
    nextjsService.attachToApplicationTargetGroup(props.nextjsTargetGroup);
  }
}