1つのCognitoユーザープールに認証方式の違うユーザーを集約し、同じログイン画面から受け入れてみた

##############################################
# Cognito User PoolにGoogleを外部IdPとしてフェデレーションし、
# 同一App ClientでCognitoネイティブユーザーとGoogle経由ユーザーの両方を受け入れる構成。
# 全リソースを本ファイルに集約している。
##############################################

terraform {
  required_version = ">= 1.9"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    null = {
      source  = "hashicorp/null"
      version = "~> 3.2"
    }
  }
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      Project   = "cognito-idp-federation-poc"
      ManagedBy = "terraform"
    }
  }
}

##############################################
# variables
##############################################

variable "aws_region" {
  description = "検証環境をデプロイするリージョン"
  type        = string
  default     = "ap-northeast-1"
}

variable "root_domain" {
  description = "Route53ホストゾーンのドメイン名（既存ゾーンを利用）"
  type        = string
  default     = "<ドメイン>"
}

variable "google_client_id" {
  description = "CognitoにフェデレーションするGoogle OAuthクライアントID（Google Cloud Consoleで事前作成）"
  type        = string
  sensitive   = true
}

variable "google_client_secret" {
  description = "GoogleのOAuthクライアントシークレット"
  type        = string
  sensitive   = true
}

##############################################
# data sources
##############################################

data "aws_caller_identity" "current" {}

data "aws_availability_zones" "available" {
  state = "available"
}

data "aws_route53_zone" "root" {
  name = var.root_domain
}

locals {
  name        = "cognito-idp-federation-poc"
  domain_name = "idp-federation-poc.${var.root_domain}"
  # Cognito Hosted UIのドメインプレフィックス
  cognito_domain_prefix = "idp-federation-poc-fed001"
  # ALBが発行する認証セッションCookieの名前
  session_cookie_name = "AuthFederatedRoute"
  # ログアウト後のランディングURL
  logout_uri = "https://idp-federation-poc.${var.root_domain}/logged-out"
  azs         = slice(data.aws_availability_zones.available.names, 0, 2)
  ecr_registry = "${data.aws_caller_identity.current.account_id}.dkr.ecr.${var.aws_region}.amazonaws.com"
  app_source_hash = sha1(join("", [
    for f in sort(fileset("${path.module}/../django", "**")) : filesha1("${path.module}/../django/${f}")
  ]))
  nginx_source_hash = sha1(join("", [
    for f in sort(fileset("${path.module}/../nginx", "**")) : filesha1("${path.module}/../nginx/${f}")
  ]))
}

##############################################
# VPC（Public subnet x2、ECSサービス/タスクは1つ）
##############################################

resource "aws_vpc" "this" {
  cidr_block           = "10.92.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = { Name = "${local.name}-vpc" }
}

resource "aws_internet_gateway" "this" {
  vpc_id = aws_vpc.this.id
  tags   = { Name = "${local.name}-igw" }
}

resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.this.id
  cidr_block              = "10.92.${count.index}.0/24"
  availability_zone       = local.azs[count.index]
  map_public_ip_on_launch = true
  tags                    = { Name = "${local.name}-public-${count.index}" }
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.this.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.this.id
  }
  tags = { Name = "${local.name}-public-rt" }
}

resource "aws_route_table_association" "public" {
  count          = 2
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

##############################################
# Security Groups
##############################################

resource "aws_security_group" "alb" {
  name   = "${local.name}-alb-sg"
  vpc_id = aws_vpc.this.id
}

resource "aws_vpc_security_group_ingress_rule" "alb_https" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4          = "0.0.0.0/0"
  from_port           = 443
  to_port             = 443
  ip_protocol         = "tcp"
}

resource "aws_vpc_security_group_ingress_rule" "alb_http" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4          = "0.0.0.0/0"
  from_port           = 80
  to_port             = 80
  ip_protocol         = "tcp"
}

resource "aws_vpc_security_group_egress_rule" "alb_all" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4          = "0.0.0.0/0"
  ip_protocol         = "-1"
}

resource "aws_security_group" "ecs" {
  name   = "${local.name}-ecs-sg"
  vpc_id = aws_vpc.this.id
}

resource "aws_vpc_security_group_ingress_rule" "ecs_from_alb" {
  security_group_id           = aws_security_group.ecs.id
  referenced_security_group_id = aws_security_group.alb.id
  from_port                    = 80
  to_port                      = 80
  ip_protocol                  = "tcp"
}

resource "aws_vpc_security_group_egress_rule" "ecs_all" {
  security_group_id = aws_security_group.ecs.id
  cidr_ipv4          = "0.0.0.0/0"
  ip_protocol         = "-1"
}

##############################################
# ACM + Route53
##############################################

resource "aws_acm_certificate" "this" {
  domain_name       = local.domain_name
  validation_method = "DNS"
  lifecycle { create_before_destroy = true }
}

resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.this.domain_validation_options : dvo.domain_name => {
      name  = dvo.resource_record_name
      type  = dvo.resource_record_type
      value = dvo.resource_record_value
    }
  }
  zone_id = data.aws_route53_zone.root.zone_id
  name    = each.value.name
  type    = each.value.type
  records = [each.value.value]
  ttl     = 60
}

resource "aws_acm_certificate_validation" "this" {
  certificate_arn         = aws_acm_certificate.this.arn
  validation_record_fqdns = [for r in aws_route53_record.cert_validation : r.fqdn]
}

resource "aws_route53_record" "alb_alias" {
  zone_id = data.aws_route53_zone.root.zone_id
  name    = local.domain_name
  type    = "A"
  alias {
    name                   = aws_lb.this.dns_name
    zone_id                = aws_lb.this.zone_id
    evaluate_target_health = true
  }
}

##############################################
# ECR + イメージビルド
##############################################

resource "aws_ecr_repository" "app" {
  name         = "${local.name}-app"
  force_delete = true
}

resource "aws_ecr_repository" "nginx" {
  name         = "${local.name}-nginx"
  force_delete = true
}

resource "null_resource" "build_setup" {
  triggers = { always_run = timestamp() }

  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = <<-EOT
      set -euo pipefail
      docker info > /dev/null 2>&1 || { echo "Dockerデーモンに接続できません。Rancher Desktopが起動しているか確認してください。" >&2; exit 1; }
      docker buildx inspect idp-federation-poc-builder > /dev/null 2>&1 || docker buildx create --name idp-federation-poc-builder --use --bootstrap
      docker buildx use idp-federation-poc-builder
      aws ecr get-login-password --region ${var.aws_region} \
        | docker login --username AWS --password-stdin ${local.ecr_registry}
    EOT
  }
}

resource "null_resource" "build_push_app" {
  triggers = {
    source_hash       = local.app_source_hash
    build_script_hash = filesha1("${path.module}/main.tf")
  }
  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = "docker buildx build --platform linux/arm64 -t ${aws_ecr_repository.app.repository_url}:${local.app_source_hash} --push ${path.module}/../django"
  }
  depends_on = [null_resource.build_setup, aws_ecr_repository.app]
}

resource "null_resource" "build_push_nginx" {
  triggers = {
    source_hash       = local.nginx_source_hash
    build_script_hash = filesha1("${path.module}/main.tf")
  }
  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = "docker buildx build --platform linux/arm64 -t ${aws_ecr_repository.nginx.repository_url}:${local.nginx_source_hash} --push ${path.module}/../nginx"
  }
  depends_on = [null_resource.build_setup, aws_ecr_repository.nginx]
}

##############################################
# ECS
##############################################

resource "aws_ecs_cluster" "this" {
  name = local.name
  setting {
    name  = "containerInsights"
    value = "enabled"
  }
}

resource "aws_cloudwatch_log_group" "app" {
  name              = "/ecs/${local.name}/app"
  retention_in_days = 7
}

resource "aws_cloudwatch_log_group" "nginx" {
  name              = "/ecs/${local.name}/nginx"
  retention_in_days = 7
}

resource "aws_iam_role" "execution" {
  name = "${local.name}-execution-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ecs-tasks.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "execution" {
  role       = aws_iam_role.execution.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_ecs_task_definition" "app" {
  family                   = "${local.name}-task"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.execution.arn

  runtime_platform {
    cpu_architecture        = "ARM64"
    operating_system_family = "LINUX"
  }

  container_definitions = jsonencode([
    {
      name      = "nginx"
      image     = "${aws_ecr_repository.nginx.repository_url}:${local.nginx_source_hash}"
      essential = true
      portMappings = [{ containerPort = 80, protocol = "tcp" }]
      dependsOn = [{ containerName = "app", condition = "START" }]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.nginx.name
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "nginx"
        }
      }
    },
    {
      name      = "app"
      image     = "${aws_ecr_repository.app.repository_url}:${local.app_source_hash}"
      essential = true
      portMappings = [{ containerPort = 8000, protocol = "tcp" }]
      environment = [
        { name = "ALLOWED_HOSTS", value = "*" },
        # アプリがCognitoのLOGOUTエンドポイントURLを組み立てるために使う
        { name = "COGNITO_DOMAIN", value = "${aws_cognito_user_pool_domain.this.domain}.auth.${var.aws_region}.amazoncognito.com" },
        { name = "COGNITO_CLIENT_ID", value = aws_cognito_user_pool_client.alb.id },
        { name = "LOGOUT_URI", value = local.logout_uri },
        { name = "SESSION_COOKIE_NAME", value = local.session_cookie_name },
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.app.name
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "app"
        }
      }
    }
  ])

  depends_on = [null_resource.build_push_app, null_resource.build_push_nginx]
}

resource "aws_ecs_service" "this" {
  name            = "${local.name}-svc"
  cluster         = aws_ecs_cluster.this.id
  task_definition = aws_ecs_task_definition.app.arn
  desired_count   = 1
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = aws_subnet.public[*].id
    security_groups  = [aws_security_group.ecs.id]
    assign_public_ip = true
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.app.arn
    container_name   = "nginx"
    container_port   = 80
  }

  depends_on = [aws_lb_listener.https]
}

##############################################
# Cognito（User Pool 1つに Google をIdPとしてフェデレーション。App Clientは1つだけ）
##############################################

resource "aws_cognito_user_pool" "this" {
  name                      = "${local.name}-pool"
  auto_verified_attributes = ["email"]
  username_attributes       = ["email"]
}

# Hosted UIのドメイン。プレフィックスはリージョン内で一意である必要がある
resource "aws_cognito_user_pool_domain" "this" {
  domain       = local.cognito_domain_prefix
  user_pool_id = aws_cognito_user_pool.this.id
}

# GoogleをUser PoolのIdPとして登録する。
# Google Cloud Console側には output google_oauth_redirect_uri_to_register の値を
# 承認済みのリダイレクトURIとして登録しておく
resource "aws_cognito_identity_provider" "google" {
  user_pool_id  = aws_cognito_user_pool.this.id
  provider_name = "Google"
  provider_type = "Google"

  provider_details = {
    client_id        = var.google_client_id
    client_secret     = var.google_client_secret
    authorize_scopes  = "openid email profile"
  }

  attribute_mapping = {
    email    = "email"
    username = "sub"
  }
}

resource "aws_cognito_user_pool_client" "alb" {
  name         = "${local.name}-alb-client"
  user_pool_id = aws_cognito_user_pool.this.id

  generate_secret                     = true
  allowed_oauth_flows_user_pool_client = true
  allowed_oauth_flows                  = ["code"]
  allowed_oauth_scopes                 = ["openid", "email"]
  callback_urls                        = ["https://${local.domain_name}/oauth2/idpresponse"]
  # CognitoのLOGOUTエンドポイントにlogout_uriとして渡せるURL
  logout_urls = [local.logout_uri]
  # Cognitoネイティブアカウントと、Googleフェデレーションの両方を同一App Clientで許可する
  supported_identity_providers = ["COGNITO", "Google"]

  depends_on = [aws_cognito_identity_provider.google]
}

##############################################
# ALB（1台・1ドメイン・1リスナー。リスナールールはログアウト後のランディング用の1本だけ）
##############################################

resource "aws_lb" "this" {
  name               = local.name
  load_balancer_type = "application"
  internal           = false
  security_groups    = [aws_security_group.alb.id]
  subnets            = aws_subnet.public[*].id
}

resource "aws_lb_target_group" "app" {
  name        = local.name
  port        = 80
  protocol    = "HTTP"
  vpc_id      = aws_vpc.this.id
  target_type = "ip"
  stickiness {
    type    = "lb_cookie"
    enabled = false
  }
  health_check {
    path = "/"
  }
}

resource "aws_lb_listener" "http_redirect" {
  load_balancer_arn = aws_lb.this.arn
  port              = 80
  protocol          = "HTTP"
  default_action {
    type = "redirect"
    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.this.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = aws_acm_certificate_validation.this.certificate_arn

  default_action {
    type  = "authenticate-cognito"
    order = 1
    authenticate_cognito {
      user_pool_arn              = aws_cognito_user_pool.this.arn
      user_pool_client_id        = aws_cognito_user_pool_client.alb.id
      user_pool_domain           = aws_cognito_user_pool_domain.this.domain
      session_cookie_name        = local.session_cookie_name
      on_unauthenticated_request = "authenticate"
    }
  }

  default_action {
    type             = "forward"
    order            = 2
    target_group_arn = aws_lb_target_group.app.arn
  }
}

# ログアウト後のランディングページは認証をかけずにターゲットへ転送する
resource "aws_lb_listener_rule" "logged_out" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 10

  condition {
    path_pattern {
      values = ["/logged-out"]
    }
  }

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}

##############################################
# outputs
##############################################

output "app_url" {
  value = "https://${local.domain_name}/"
}

output "cognito_hosted_ui_domain" {
  value = "${aws_cognito_user_pool_domain.this.domain}.auth.${var.aws_region}.amazoncognito.com"
}

output "google_oauth_redirect_uri_to_register" {
  description = "Google Cloud ConsoleのOAuthクライアントに追加登録する承認済みリダイレクトURI（Cognito Hosted UI宛）"
  value       = "https://${aws_cognito_user_pool_domain.this.domain}.auth.${var.aws_region}.amazoncognito.com/oauth2/idpresponse"
}