Cognitoの同一ユーザープールで複数アプリケーションにシングルサインオンしてみた

##############################################
# 検証: 同一Cognitoユーザープール内で、App Clientを分けた2つの別アプリ（ECSサービス）を用意し、
# 一方でログインした状態でもう一方に再ログインなしでアクセスできるか（SSO）を確認する。
##############################################

terraform {
  required_version = ">= 1.9"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
    null = {
      source  = "hashicorp/null"
      version = "~> 3.2"
    }
  }
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      Project   = "cognito-multi-app-sso-poc"
      ManagedBy = "terraform"
    }
  }
}

##############################################
# variables
##############################################

variable "aws_region" {
  description = "検証環境をデプロイするリージョン"
  type        = string
  default     = "ap-northeast-1"
}

variable "root_domain" {
  description = "Route53ホストゾーンのドメイン名（既存ゾーンを利用）"
  type        = string
  default     = "<ドメイン>"
}

variable "subdomain" {
  description = "ALBに割り当てるサブドメインのラベル部分"
  type        = string
  default     = "multi-app-sso-poc"
}

##############################################
# data sources
##############################################

data "aws_caller_identity" "current" {}

data "aws_availability_zones" "available" {
  state = "available"
}

data "aws_route53_zone" "root" {
  name = var.root_domain
}

locals {
  name         = "multi-app-sso-poc"
  domain_name  = "${var.subdomain}.${var.root_domain}"
  azs          = slice(data.aws_availability_zones.available.names, 0, 2)
  ecr_registry = "${data.aws_caller_identity.current.account_id}.dkr.ecr.${var.aws_region}.amazonaws.com"
  app_source_hash = sha1(join("", [
    for f in sort(fileset("${path.module}/../django", "**")) : filesha1("${path.module}/../django/${f}")
  ]))
  nginx_source_hash = sha1(join("", [
    for f in sort(fileset("${path.module}/../nginx", "**")) : filesha1("${path.module}/../nginx/${f}")
  ]))
}

##############################################
# VPC（Public subnet x2のみ）
##############################################

resource "aws_vpc" "this" {
  cidr_block           = "10.91.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = { Name = "${local.name}-vpc" }
}

resource "aws_internet_gateway" "this" {
  vpc_id = aws_vpc.this.id
  tags   = { Name = "${local.name}-igw" }
}

resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.this.id
  cidr_block              = "10.91.${count.index}.0/24"
  availability_zone       = local.azs[count.index]
  map_public_ip_on_launch = true
  tags                    = { Name = "${local.name}-public-${count.index}" }
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.this.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.this.id
  }
  tags = { Name = "${local.name}-public-rt" }
}

resource "aws_route_table_association" "public" {
  count          = 2
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

##############################################
# Security Groups
##############################################

resource "aws_security_group" "alb" {
  name   = "${local.name}-alb-sg"
  vpc_id = aws_vpc.this.id
}

resource "aws_vpc_security_group_ingress_rule" "alb_https" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4          = "0.0.0.0/0"
  from_port           = 443
  to_port             = 443
  ip_protocol         = "tcp"
}

resource "aws_vpc_security_group_ingress_rule" "alb_http" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4          = "0.0.0.0/0"
  from_port           = 80
  to_port             = 80
  ip_protocol         = "tcp"
}

resource "aws_vpc_security_group_egress_rule" "alb_all" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4          = "0.0.0.0/0"
  ip_protocol         = "-1"
}

resource "aws_security_group" "ecs" {
  name   = "${local.name}-ecs-sg"
  vpc_id = aws_vpc.this.id
}

resource "aws_vpc_security_group_ingress_rule" "ecs_from_alb" {
  security_group_id           = aws_security_group.ecs.id
  referenced_security_group_id = aws_security_group.alb.id
  from_port                    = 80
  to_port                      = 80
  ip_protocol                  = "tcp"
}

resource "aws_vpc_security_group_egress_rule" "ecs_all" {
  security_group_id = aws_security_group.ecs.id
  cidr_ipv4          = "0.0.0.0/0"
  ip_protocol         = "-1"
}

##############################################
# ACM + Route53
##############################################

resource "aws_acm_certificate" "app" {
  for_each = toset(["app1", "app2"])

  domain_name       = "${each.key}.${local.domain_name}"
  validation_method = "DNS"
  lifecycle { create_before_destroy = true }
}

resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in flatten([
      for cert in aws_acm_certificate.app : cert.domain_validation_options
    ]) : dvo.domain_name => {
      name  = dvo.resource_record_name
      type  = dvo.resource_record_type
      value = dvo.resource_record_value
    }
  }
  zone_id = data.aws_route53_zone.root.zone_id
  name    = each.value.name
  type    = each.value.type
  records = [each.value.value]
  ttl     = 60
}

resource "aws_acm_certificate_validation" "app" {
  for_each = aws_acm_certificate.app

  certificate_arn = each.value.arn
  validation_record_fqdns = [
    for dvo in each.value.domain_validation_options : aws_route53_record.cert_validation[dvo.domain_name].fqdn
  ]
}

resource "aws_route53_record" "alb_alias" {
  for_each = toset(["app1", "app2"])

  zone_id = data.aws_route53_zone.root.zone_id
  name    = "${each.key}.${local.domain_name}"
  type    = "A"
  alias {
    name                   = aws_lb.this.dns_name
    zone_id                = aws_lb.this.zone_id
    evaluate_target_health = true
  }
}

##############################################
# ECR + イメージビルド（App1/App2共通の同一イメージ。表示だけ環境変数APP_LABELで分岐）
##############################################

resource "aws_ecr_repository" "app" {
  name         = "${local.name}-app"
  force_delete = true
}

resource "aws_ecr_repository" "nginx" {
  name         = "${local.name}-nginx"
  force_delete = true
}

resource "null_resource" "build_setup" {
  triggers = { always_run = timestamp() }

  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = <<-EOT
      set -euo pipefail
      docker info > /dev/null 2>&1 || { echo "Dockerデーモンに接続できません。Rancher Desktopが起動しているか確認してください。" >&2; exit 1; }
      docker buildx inspect multi-app-sso-poc-builder > /dev/null 2>&1 || docker buildx create --name multi-app-sso-poc-builder --use --bootstrap
      docker buildx use multi-app-sso-poc-builder
      aws ecr get-login-password --region ${var.aws_region} \
        | docker login --username AWS --password-stdin ${local.ecr_registry}
    EOT
  }
}

resource "null_resource" "build_push_app" {
  triggers = {
    source_hash       = local.app_source_hash
    build_script_hash = filesha1("${path.module}/main.tf")
  }
  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = "docker buildx build --platform linux/arm64 -t ${aws_ecr_repository.app.repository_url}:${local.app_source_hash} --push ${path.module}/../django"
  }
  depends_on = [null_resource.build_setup, aws_ecr_repository.app]
}

resource "null_resource" "build_push_nginx" {
  triggers = {
    source_hash       = local.nginx_source_hash
    build_script_hash = filesha1("${path.module}/main.tf")
  }
  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = "docker buildx build --platform linux/arm64 -t ${aws_ecr_repository.nginx.repository_url}:${local.nginx_source_hash} --push ${path.module}/../nginx"
  }
  depends_on = [null_resource.build_setup, aws_ecr_repository.nginx]
}

##############################################
# ECS（App1 / App2 の2サービス。同一イメージ、環境変数APP_LABELのみ違う）
##############################################

resource "aws_ecs_cluster" "this" {
  name = local.name
  setting {
    name  = "containerInsights"
    value = "enabled"
  }
}

resource "aws_iam_role" "execution" {
  name = "${local.name}-execution-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ecs-tasks.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "execution" {
  role       = aws_iam_role.execution.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_cloudwatch_log_group" "app" {
  for_each          = toset(["app1", "app2"])
  name              = "/ecs/${local.name}/${each.key}"
  retention_in_days = 7
}

resource "aws_ecs_task_definition" "app" {
  for_each = { app1 = "App1", app2 = "App2" }

  family                   = "${local.name}-${each.key}-task"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.execution.arn

  runtime_platform {
    cpu_architecture        = "ARM64"
    operating_system_family = "LINUX"
  }

  container_definitions = jsonencode([
    {
      name      = "nginx"
      image     = "${aws_ecr_repository.nginx.repository_url}:${local.nginx_source_hash}"
      essential = true
      portMappings = [{ containerPort = 80, protocol = "tcp" }]
      dependsOn = [{ containerName = "app", condition = "START" }]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.app[each.key].name
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "nginx"
        }
      }
    },
    {
      name      = "app"
      image     = "${aws_ecr_repository.app.repository_url}:${local.app_source_hash}"
      essential = true
      portMappings = [{ containerPort = 8000, protocol = "tcp" }]
      environment = [
        { name = "ALLOWED_HOSTS", value = "*" },
        { name = "APP_LABEL", value = each.value },
        { name = "COGNITO_DOMAIN", value = "${aws_cognito_user_pool_domain.this.domain}.auth.${var.aws_region}.amazoncognito.com" },
        { name = "COGNITO_CLIENT_ID", value = aws_cognito_user_pool_client.app[each.key].id },
        { name = "APP_URL", value = "https://${each.key}.${local.domain_name}/" },
        { name = "ALB_COOKIE_NAME", value = "Auth${each.value}" },
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.app[each.key].name
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "app"
        }
      }
    }
  ])

  depends_on = [null_resource.build_push_app, null_resource.build_push_nginx]
}

resource "aws_ecs_service" "app" {
  for_each = { app1 = 1, app2 = 2 }

  name            = "${local.name}-${each.key}-svc"
  cluster         = aws_ecs_cluster.this.id
  task_definition = aws_ecs_task_definition.app[each.key].arn
  desired_count   = 1
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = aws_subnet.public[*].id
    security_groups  = [aws_security_group.ecs.id]
    assign_public_ip = true
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.app[each.key].arn
    container_name   = "nginx"
    container_port   = 80
  }

  depends_on = [aws_lb_listener.https]
}

##############################################
# Cognito（同一User Pool、App1/App2それぞれ専用のApp Client）
##############################################

resource "random_string" "domain_suffix" {
  length  = 6
  special = false
  upper   = false
}

resource "aws_cognito_user_pool" "this" {
  name                      = "${local.name}-pool"
  auto_verified_attributes = ["email"]
  username_attributes       = ["email"]
}

resource "aws_cognito_user_pool_domain" "this" {
  domain       = "multi-app-sso-poc-${random_string.domain_suffix.result}"
  user_pool_id = aws_cognito_user_pool.this.id
}

resource "aws_cognito_user_pool_client" "app" {
  for_each = toset(["app1", "app2"])

  name         = "${local.name}-${each.key}-client"
  user_pool_id = aws_cognito_user_pool.this.id

  generate_secret                      = true
  allowed_oauth_flows_user_pool_client = true
  allowed_oauth_flows                  = ["code"]
  allowed_oauth_scopes                 = ["openid", "email"]
  callback_urls                        = ["https://${each.key}.${local.domain_name}/oauth2/idpresponse"]
  logout_urls                          = ["https://${each.key}.${local.domain_name}/"]
  supported_identity_providers         = ["COGNITO"]
}

##############################################
# ALB（1台、サブドメイン（ホストベース）で2アプリに分岐。App Client・Cookie名をアプリごとに分離）
##############################################

resource "aws_lb" "this" {
  name               = local.name
  load_balancer_type = "application"
  internal           = false
  security_groups    = [aws_security_group.alb.id]
  subnets            = aws_subnet.public[*].id
}

resource "aws_lb_target_group" "app" {
  for_each = toset(["app1", "app2"])

  name        = "${local.name}-${each.key}"
  port        = 80
  protocol    = "HTTP"
  vpc_id      = aws_vpc.this.id
  target_type = "ip"
  stickiness {
    type    = "lb_cookie"
    enabled = false
  }
  health_check {
    path = "/"
  }
}

resource "aws_lb_listener" "http_redirect" {
  load_balancer_arn = aws_lb.this.arn
  port              = 80
  protocol          = "HTTP"
  default_action {
    type = "redirect"
    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.this.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = aws_acm_certificate_validation.app["app1"].certificate_arn

  default_action {
    type = "fixed-response"
    fixed_response {
      content_type = "text/plain"
      status_code  = "404"
    }
  }
}

# app2用証明書はSNIで追加登録（ALBのHTTPSリスナーはデフォルト証明書1枚+SNI追加証明書の構成）
resource "aws_lb_listener_certificate" "app2" {
  listener_arn    = aws_lb_listener.https.arn
  certificate_arn = aws_acm_certificate_validation.app["app2"].certificate_arn
}

resource "aws_lb_listener_rule" "app1" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 10

  condition {
    host_header { values = ["app1.${local.domain_name}"] }
  }

  action {
    type  = "authenticate-cognito"
    order = 1
    authenticate_cognito {
      user_pool_arn              = aws_cognito_user_pool.this.arn
      user_pool_client_id        = aws_cognito_user_pool_client.app["app1"].id
      user_pool_domain           = aws_cognito_user_pool_domain.this.domain
      session_cookie_name        = "AuthApp1"
      on_unauthenticated_request = "authenticate"
    }
  }

  action {
    type             = "forward"
    order            = 2
    target_group_arn = aws_lb_target_group.app["app1"].arn
  }
}

resource "aws_lb_listener_rule" "app2" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 20

  condition {
    host_header { values = ["app2.${local.domain_name}"] }
  }

  action {
    type  = "authenticate-cognito"
    order = 1
    authenticate_cognito {
      user_pool_arn              = aws_cognito_user_pool.this.arn
      user_pool_client_id        = aws_cognito_user_pool_client.app["app2"].id
      user_pool_domain           = aws_cognito_user_pool_domain.this.domain
      session_cookie_name        = "AuthApp2"
      on_unauthenticated_request = "authenticate"
    }
  }

  action {
    type             = "forward"
    order            = 2
    target_group_arn = aws_lb_target_group.app["app2"].arn
  }
}

##############################################
# outputs
##############################################

output "app1_url" {
  value = "https://app1.${local.domain_name}/"
}

output "app2_url" {
  value = "https://app2.${local.domain_name}/"
}

output "cognito_hosted_ui_domain" {
  value = "${aws_cognito_user_pool_domain.this.domain}.auth.${var.aws_region}.amazoncognito.com"
}