Cognitoユーザープールを社内用・社外用に分割して、MFA・パスワードポリシー・権限を分離してみた

##############################################
# 1アプリ（VPC / ALB / Fargate 各1）＋ Cognitoユーザープール2つの構成。
# - internal: Google(OIDC)フェデレーション専用。MFAなし
# - partner : ローカルユーザーのみ。MFA必須(TOTP)・パスワード最小12文字
# ALBはホスト名別のリスナールールで、それぞれ別プールのauthenticate-cognitoを実行する。
# 全リソースを本ファイルに集約している。
##############################################

terraform {
  required_version = ">= 1.9"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.57"
    }
    null = {
      source  = "hashicorp/null"
      version = "~> 3.2"
    }
  }
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      Project   = "cognito-idp-pool-isolation-poc"
      ManagedBy = "terraform"
    }
  }
}

##############################################
# variables
##############################################

variable "aws_region" {
  description = "検証環境をデプロイするリージョン"
  type        = string
  default     = "ap-northeast-1"
}

variable "root_domain" {
  description = "Route53ホストゾーンのドメイン名（既存ゾーンを利用）"
  type        = string
  default     = "<ドメイン>"
}

variable "google_client_id" {
  description = "internalプールにフェデレーションするGoogle OAuthクライアントID（Google Cloud Consoleで事前作成）"
  type        = string
  sensitive   = true
}

variable "google_client_secret" {
  description = "GoogleのOAuthクライアントシークレット"
  type        = string
  sensitive   = true
}

##############################################
# data sources
##############################################

data "aws_caller_identity" "current" {}

data "aws_availability_zones" "available" {
  state = "available"
}

data "aws_route53_zone" "root" {
  name = var.root_domain
}

locals {
  name = "cognito-idp-pool-isolation-poc"

  # internal / partner の2系統の定義。各リソースへfor_eachで展開する
  realms = {
    internal = {
      host                   = "internal.pool-isolation-poc.${var.root_domain}"
      cognito_domain_prefix  = "pool-isolation-poc-int001" # リージョン内で一意である必要がある
      session_cookie_name    = "AuthInternal"
      listener_rule_priority = 10
    }
    partner = {
      host                   = "partner.pool-isolation-poc.${var.root_domain}"
      cognito_domain_prefix  = "pool-isolation-poc-ptr001"
      session_cookie_name    = "AuthPartner"
      listener_rule_priority = 20
    }
  }

  azs          = slice(data.aws_availability_zones.available.names, 0, 2)
  ecr_registry = "${data.aws_caller_identity.current.account_id}.dkr.ecr.${var.aws_region}.amazonaws.com"
  app_source_hash = sha1(join("", [
    for f in sort(fileset("${path.module}/../django", "**")) : filesha1("${path.module}/../django/${f}")
  ]))
  nginx_source_hash = sha1(join("", [
    for f in sort(fileset("${path.module}/../nginx", "**")) : filesha1("${path.module}/../nginx/${f}")
  ]))
}

##############################################
# VPC（Public subnet x2、ECSサービス/タスクは1つ）
##############################################

resource "aws_vpc" "this" {
  cidr_block           = "10.92.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags                 = { Name = "${local.name}-vpc" }
}

resource "aws_internet_gateway" "this" {
  vpc_id = aws_vpc.this.id
  tags   = { Name = "${local.name}-igw" }
}

resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.this.id
  cidr_block              = "10.92.${count.index}.0/24"
  availability_zone       = local.azs[count.index]
  map_public_ip_on_launch = true
  tags                    = { Name = "${local.name}-public-${count.index}" }
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.this.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.this.id
  }
  tags = { Name = "${local.name}-public-rt" }
}

resource "aws_route_table_association" "public" {
  count          = 2
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

##############################################
# Security Groups
##############################################

resource "aws_security_group" "alb" {
  name   = "${local.name}-alb-sg"
  vpc_id = aws_vpc.this.id
}

resource "aws_vpc_security_group_ingress_rule" "alb_https" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4         = "0.0.0.0/0"
  from_port         = 443
  to_port           = 443
  ip_protocol       = "tcp"
}

resource "aws_vpc_security_group_ingress_rule" "alb_http" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4         = "0.0.0.0/0"
  from_port         = 80
  to_port           = 80
  ip_protocol       = "tcp"
}

resource "aws_vpc_security_group_egress_rule" "alb_all" {
  security_group_id = aws_security_group.alb.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

resource "aws_security_group" "ecs" {
  name   = "${local.name}-ecs-sg"
  vpc_id = aws_vpc.this.id
}

resource "aws_vpc_security_group_ingress_rule" "ecs_from_alb" {
  security_group_id            = aws_security_group.ecs.id
  referenced_security_group_id = aws_security_group.alb.id
  from_port                    = 80
  to_port                      = 80
  ip_protocol                  = "tcp"
}

resource "aws_vpc_security_group_egress_rule" "ecs_all" {
  security_group_id = aws_security_group.ecs.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

##############################################
# ACM + Route53
# 証明書は1枚にSANで2ホストをまとめる（internal./partner.）
##############################################

resource "aws_acm_certificate" "this" {
  domain_name               = local.realms.internal.host
  subject_alternative_names = [local.realms.partner.host]
  validation_method         = "DNS"
  lifecycle { create_before_destroy = true }
}

resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.this.domain_validation_options : dvo.domain_name => {
      name  = dvo.resource_record_name
      type  = dvo.resource_record_type
      value = dvo.resource_record_value
    }
  }
  zone_id = data.aws_route53_zone.root.zone_id
  name    = each.value.name
  type    = each.value.type
  records = [each.value.value]
  ttl     = 60
}

resource "aws_acm_certificate_validation" "this" {
  certificate_arn         = aws_acm_certificate.this.arn
  validation_record_fqdns = [for r in aws_route53_record.cert_validation : r.fqdn]
}

# 2ホストとも同じALBへ向ける
resource "aws_route53_record" "alb_alias" {
  for_each = local.realms
  zone_id  = data.aws_route53_zone.root.zone_id
  name     = each.value.host
  type     = "A"
  alias {
    name                   = aws_lb.this.dns_name
    zone_id                = aws_lb.this.zone_id
    evaluate_target_health = true
  }
}

##############################################
# ECR + イメージビルド
##############################################

resource "aws_ecr_repository" "app" {
  name         = "${local.name}-app"
  force_delete = true
}

resource "aws_ecr_repository" "nginx" {
  name         = "${local.name}-nginx"
  force_delete = true
}

resource "null_resource" "build_setup" {
  triggers = { always_run = timestamp() }

  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = "aws ecr get-login-password --region ${var.aws_region} | docker login --username AWS --password-stdin ${local.ecr_registry}"
  }
}

resource "null_resource" "build_push_app" {
  triggers = {
    source_hash       = local.app_source_hash
    build_script_hash = filesha1("${path.module}/main.tf")
  }
  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = "docker build --platform linux/arm64 -t ${aws_ecr_repository.app.repository_url}:${local.app_source_hash} ${path.module}/../django && docker push ${aws_ecr_repository.app.repository_url}:${local.app_source_hash}"
  }
  depends_on = [null_resource.build_setup, aws_ecr_repository.app]
}

resource "null_resource" "build_push_nginx" {
  triggers = {
    source_hash       = local.nginx_source_hash
    build_script_hash = filesha1("${path.module}/main.tf")
  }
  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command     = "docker build --platform linux/arm64 -t ${aws_ecr_repository.nginx.repository_url}:${local.nginx_source_hash} ${path.module}/../nginx && docker push ${aws_ecr_repository.nginx.repository_url}:${local.nginx_source_hash}"
  }
  depends_on = [null_resource.build_setup, aws_ecr_repository.nginx]
}

##############################################
# Cognito User Pool ×2（internal / partner）
##############################################

# 社内用プール（Googleフェデレーション専用、MFAなし）
resource "aws_cognito_user_pool" "internal" {
  name                     = "${local.name}-internal-pool"
  user_pool_tier           = "LITE"
  auto_verified_attributes = ["email"]
  username_attributes      = ["email"]
}

# 社外用プール（ローカルユーザー、MFA必須(TOTP)、パスワード最小12文字）
resource "aws_cognito_user_pool" "partner" {
  name                     = "${local.name}-partner-pool"
  user_pool_tier           = "LITE"
  auto_verified_attributes = ["email"]
  username_attributes      = ["email"]

  mfa_configuration = "ON"
  software_token_mfa_configuration {
    enabled = true
  }

  password_policy {
    minimum_length    = 12
    require_lowercase = true
    require_uppercase = true
    require_numbers   = true
    require_symbols   = true
  }
}

locals {
  pools = {
    internal = aws_cognito_user_pool.internal
    partner  = aws_cognito_user_pool.partner
  }
}

# Hosted UI（クラシック）のドメイン
resource "aws_cognito_user_pool_domain" "this" {
  for_each              = local.realms
  domain                = each.value.cognito_domain_prefix
  user_pool_id          = local.pools[each.key].id
  managed_login_version = 1
}

# internalプールのGoogle IdP。Google Cloud Console側に
# output google_oauth_redirect_uri_to_register の値を承認済みリダイレクトURIとして登録する
resource "aws_cognito_identity_provider" "google" {
  user_pool_id  = aws_cognito_user_pool.internal.id
  provider_name = "Google"
  provider_type = "Google"

  provider_details = {
    client_id        = var.google_client_id
    client_secret    = var.google_client_secret
    authorize_scopes = "openid email profile"
  }

  attribute_mapping = {
    email    = "email"
    username = "sub"
  }
}

resource "aws_cognito_user_pool_client" "this" {
  for_each     = local.realms
  name         = "${local.name}-${each.key}-client"
  user_pool_id = local.pools[each.key].id

  generate_secret                      = true
  allowed_oauth_flows_user_pool_client = true
  allowed_oauth_flows                  = ["code"]
  allowed_oauth_scopes                 = ["openid", "email"]
  callback_urls                        = ["https://${each.value.host}/oauth2/idpresponse"]
  logout_urls                          = ["https://${each.value.host}/logged-out"]

  # internalはGoogleのみ、partnerはCognitoローカルのみを許可する
  supported_identity_providers = each.key == "internal" ? ["Google"] : ["COGNITO"]

  depends_on = [aws_cognito_identity_provider.google]
}

# 管理者グループ（両プールに同名で作成）
resource "aws_cognito_user_group" "admin" {
  for_each     = local.realms
  name         = "admin-users"
  user_pool_id = local.pools[each.key].id
}

##############################################
# ECS
##############################################

resource "aws_ecs_cluster" "this" {
  name = local.name
  setting {
    name  = "containerInsights"
    value = "enabled"
  }
}

resource "aws_cloudwatch_log_group" "app" {
  name              = "/ecs/${local.name}/app"
  retention_in_days = 7
}

resource "aws_cloudwatch_log_group" "nginx" {
  name              = "/ecs/${local.name}/nginx"
  retention_in_days = 7
}

resource "aws_iam_role" "execution" {
  name = "${local.name}-execution-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ecs-tasks.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "execution" {
  role       = aws_iam_role.execution.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_ecs_task_definition" "app" {
  family                   = "${local.name}-task"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.execution.arn

  runtime_platform {
    cpu_architecture        = "ARM64"
    operating_system_family = "LINUX"
  }

  container_definitions = jsonencode([
    {
      name         = "nginx"
      image        = "${aws_ecr_repository.nginx.repository_url}:${local.nginx_source_hash}"
      essential    = true
      portMappings = [{ containerPort = 80, protocol = "tcp" }]
      dependsOn    = [{ containerName = "app", condition = "START" }]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.nginx.name
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "nginx"
        }
      }
    },
    {
      name         = "app"
      image        = "${aws_ecr_repository.app.repository_url}:${local.app_source_hash}"
      essential    = true
      portMappings = [{ containerPort = 8000, protocol = "tcp" }]
      environment = [
        { name = "ALLOWED_HOSTS", value = "*" },
        # アプリがホスト名からApp Client・Cookie名・ログアウト先を引くためのマップ
        {
          name = "CLIENT_MAP"
          value = jsonencode({
            for k, r in local.realms : r.host => {
              realm          = k
              cognito_domain = "${aws_cognito_user_pool_domain.this[k].domain}.auth.${var.aws_region}.amazoncognito.com"
              client_id      = aws_cognito_user_pool_client.this[k].id
              cookie         = r.session_cookie_name
              logout_uri     = "https://${r.host}/logged-out"
              issuer         = "https://${local.pools[k].endpoint}"
            }
          })
        },
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.app.name
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "app"
        }
      }
    }
  ])

  depends_on = [null_resource.build_push_app, null_resource.build_push_nginx]
}

resource "aws_ecs_service" "this" {
  name            = "${local.name}-svc"
  cluster         = aws_ecs_cluster.this.id
  task_definition = aws_ecs_task_definition.app.arn
  desired_count   = 1
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = aws_subnet.public[*].id
    security_groups  = [aws_security_group.ecs.id]
    assign_public_ip = true
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.app.arn
    container_name   = "nginx"
    container_port   = 80
  }

  depends_on = [aws_lb_listener.https]
}

##############################################
# ALB（1台・1リスナー、ホスト名別ルールで認証を振り分け）
##############################################

resource "aws_lb" "this" {
  name               = "pool-isolation-poc"
  load_balancer_type = "application"
  internal           = false
  security_groups    = [aws_security_group.alb.id]
  subnets            = aws_subnet.public[*].id
}

resource "aws_lb_target_group" "app" {
  name        = "pool-isolation-poc"
  port        = 80
  protocol    = "HTTP"
  vpc_id      = aws_vpc.this.id
  target_type = "ip"
  stickiness {
    type    = "lb_cookie"
    enabled = false
  }
  health_check {
    path = "/"
  }
}

resource "aws_lb_listener" "http_redirect" {
  load_balancer_arn = aws_lb.this.arn
  port              = 80
  protocol          = "HTTP"
  default_action {
    type = "redirect"
    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.this.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = aws_acm_certificate_validation.this.certificate_arn

  default_action {
    type = "fixed-response"
    fixed_response {
      content_type = "text/plain"
      message_body = "Not Found"
      status_code  = "404"
    }
  }
}

# 非認証で転送するパス（トップページとログアウト後ページ）
resource "aws_lb_listener_rule" "public" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 5

  condition {
    host_header {
      values = [for r in local.realms : r.host]
    }
  }

  condition {
    path_pattern {
      values = ["/", "/logged-out"]
    }
  }

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}

# ホスト名別の認証ルール（それぞれ別プールのauthenticate-cognitoを実行）
resource "aws_lb_listener_rule" "realm_auth" {
  for_each     = local.realms
  listener_arn = aws_lb_listener.https.arn
  priority     = each.value.listener_rule_priority

  condition {
    host_header {
      values = [each.value.host]
    }
  }

  action {
    type  = "authenticate-cognito"
    order = 1
    authenticate_cognito {
      user_pool_arn              = local.pools[each.key].arn
      user_pool_client_id        = aws_cognito_user_pool_client.this[each.key].id
      user_pool_domain           = aws_cognito_user_pool_domain.this[each.key].domain
      session_cookie_name        = each.value.session_cookie_name
      on_unauthenticated_request = "authenticate"
    }
  }

  action {
    type             = "forward"
    order            = 2
    target_group_arn = aws_lb_target_group.app.arn
  }
}

##############################################
# outputs
##############################################

output "app_urls" {
  value = { for k, r in local.realms : k => "https://${r.host}/" }
}

output "cognito_hosted_ui_domains" {
  value = {
    for k in keys(local.realms) :
    k => "${aws_cognito_user_pool_domain.this[k].domain}.auth.${var.aws_region}.amazoncognito.com"
  }
}

output "google_oauth_redirect_uri_to_register" {
  description = "Google Cloud ConsoleのOAuthクライアントに登録する承認済みリダイレクトURI（internalプールのHosted UI宛）"
  value       = "https://${aws_cognito_user_pool_domain.this["internal"].domain}.auth.${var.aws_region}.amazoncognito.com/oauth2/idpresponse"
}