CloudFront マルチテナントディストリビューションを Terraform で構築してみた

terraform {
  required_version = ">= 1.6"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 6.28"
    }
  }
}

provider "aws" {
  region = var.region # ap-northeast-1
}

# CloudFront 用 ACM・ログ配信は us-east-1 必須
provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}

resource "aws_s3_bucket" "content" {
  bucket        = "${var.project}-content-${data.aws_caller_identity.current.account_id}"
  force_destroy = true
}

resource "aws_s3_object" "lp" {
  for_each     = var.distributions
  bucket       = aws_s3_bucket.content.id
  key          = "${each.key}/index.html" # テナントキーごとに prefix を分ける
  content_type = "text/html"
  content = templatefile("${path.module}/templates/index.html.tftpl", {
    site_key = each.key
    domain   = each.value.domain
  })
}

resource "aws_acm_certificate" "this" {
  for_each                  = var.certificates
  domain_name               = each.value.domain_name              # apex
  subject_alternative_names = each.value.subject_alternative_names # ["*.apex"]
  validation_method         = "DNS"
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "validation" {
  for_each = merge([
    for k, cert in aws_acm_certificate.this : {
      for dvo in cert.domain_validation_options :
      "${k}:${dvo.domain_name}" => {
        zone_id = var.certificates[k].zone_id
        name    = dvo.resource_record_name
        type    = dvo.resource_record_type
        value   = dvo.resource_record_value
      }
    }
  ]...)

  zone_id         = each.value.zone_id
  name            = each.value.name
  type            = each.value.type
  records         = [each.value.value]
  ttl             = 60
  allow_overwrite = true # apex/wildcard が同名レコードを指すため
}

resource "aws_acm_certificate_validation" "this" {
  for_each        = var.certificates
  certificate_arn = aws_acm_certificate.this[each.key].arn
  validation_record_fqdns = distinct([
    for dvo in aws_acm_certificate.this[each.key].domain_validation_options :
    aws_route53_record.validation["${each.key}:${dvo.domain_name}"].fqdn
  ])
}

resource "aws_cloudfront_multitenant_distribution" "this" {
  comment             = "${var.project} multi-tenant template"
  enabled             = true
  default_root_object = "index.html"

  origin {
    domain_name              = var.bucket_regional_domain_name
    id                       = "s3-shared" # ← origin_id ではなく id
    origin_path              = "/{{prefix}}"
    origin_access_control_id = aws_cloudfront_origin_access_control.this.id
  }

  default_cache_behavior {
    target_origin_id       = "s3-shared"
    viewer_protocol_policy = "redirect-to-https"
    cache_policy_id        = var.cache_policy_id # TTL 直指定は不可 → ポリシー必須
    allowed_methods {
      items          = ["GET", "HEAD"]
      cached_methods = ["GET", "HEAD"]
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true # 実証明書はテナント側で指定
  }

  tenant_config {
    parameter_definition {
      name = "prefix"
      definition {
        string_schema {
          required = true
        }
      }
    }
  }
}

resource "aws_cloudfront_connection_group" "this" {
  name         = "${var.project}-cg"
  enabled      = true
  ipv6_enabled = true
}

resource "aws_cloudfront_distribution_tenant" "this" {
  for_each            = var.tenants
  name                = each.key
  distribution_id     = aws_cloudfront_multitenant_distribution.this.id
  connection_group_id = aws_cloudfront_connection_group.this.id
  enabled             = true

  domain {
    domain = each.value.domain # 例: www.example.com
  }

  parameter {
    name  = "prefix"
    value = each.key
  }

  customizations {
    certificate {
      arn = var.certificate_arns[each.key]
    }
  }
}

# テナントドメイン → connection group の routing endpoint へ CNAME
resource "aws_route53_record" "tenant" {
  for_each        = var.tenants
  zone_id         = each.value.zone_id
  name            = each.value.domain
  type            = "CNAME"
  ttl             = 300
  records         = [aws_cloudfront_connection_group.this.routing_endpoint]
  allow_overwrite = true # 既存レコードを引き取れるように
}

terraform apply

Apply complete! Resources: 1 added, 1 changed, 0 destroyed.

Outputs:

connection_group_endpoint = "d6xxxxxxxxxxx.cloudfront.net"
content_bucket = "cf-multi-content-xxxxxxxxxxxx"
multitenant_distribution_arn = "arn:aws:cloudfront::xxxxxxxxxxxx:distribution/Exxxxxxxxxxxxx"
tenants = {
  "example" = {
    "status" = "Deployed"
    "url"    = "https://www.example.com"
  }
}

curl -sS -o /dev/null -w 'HTTP %{http_code}\n' https://www.example.com/
# => HTTP 200

www.example.com
  → (Route53 CNAME) dxxxx.cloudfront.net   ← connection group
  → (Host ヘッダでテナント振り分け) tenant
  → (parameter prefix) origin_path = /<key>
  → S3: bucket/<key>/index.html            ← OAC