Aurora PostgreSQL Serverlessエクスプレス設定にLambdaからDrizzle ORMで接続してみた

resource "aws_lambda_function" "this" {
  function_name = var.function_name
  role          = aws_iam_role.this.arn

  filename         = "${path.module}/../lambda.zip"
  source_code_hash = try(filebase64sha256("${path.module}/../lambda.zip"), null)

  # ZIP ルートに index.js が配置されるため handler は index.handler
  handler = "index.handler"
  runtime = "nodejs22.x"

  timeout       = 40          # Aurora Express コールドスタート対策
  memory_size   = 128         # このサンプル程度なら 128MB で十分
  architectures = ["arm64"]   # Graviton2。x86_64 より低コスト

  environment {
    variables = {
      DB_HOST   = var.db_host
      DB_USER   = var.db_user
      DB_NAME   = var.db_name
      LOG_LEVEL = var.log_level
      TZ        = var.tz
    }
  }
}

# CloudWatch ロググループ（保持期間を管理するため明示的に定義）
resource "aws_cloudwatch_log_group" "lambda" {
  name              = "/aws/lambda/${var.function_name}"
  retention_in_days = 14
}

# HTTP API (v2)
resource "aws_apigatewayv2_api" "this" {
  name          = var.function_name
  protocol_type = "HTTP"
}

# Lambda プロキシ統合（payload format version 2.0）
resource "aws_apigatewayv2_integration" "lambda" {
  api_id                 = aws_apigatewayv2_api.this.id
  integration_type       = "AWS_PROXY"
  integration_uri        = aws_lambda_function.this.invoke_arn
  payload_format_version = "2.0"
}

# $default ルート：全パス・全メソッドを Lambda へ転送
resource "aws_apigatewayv2_route" "this" {
  api_id    = aws_apigatewayv2_api.this.id
  route_key = "$default"
  target    = "integrations/${aws_apigatewayv2_integration.lambda.id}"
}

# $default ステージ（auto_deploy = true でデプロイ手順が不要）
resource "aws_apigatewayv2_stage" "default" {
  api_id      = aws_apigatewayv2_api.this.id
  name        = "$default"
  auto_deploy = true
}

# API Gateway から Lambda を呼び出す権限
resource "aws_lambda_permission" "apigw" {
  statement_id  = "AllowAPIGatewayInvoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.this.function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_apigatewayv2_api.this.execution_arn}/*/*"
}

# Lambda 実行ロール
resource "aws_iam_role" "this" {
  name = "${var.function_name}-lambda-exec"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "lambda.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

# CloudWatch Logs への書き込み権限
resource "aws_iam_role_policy_attachment" "basic_execution" {
  role       = aws_iam_role.this.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

# Aurora IAM 認証権限（rds-db:connect）
resource "aws_iam_role_policy" "rds_iam_connect" {
  name = "${var.function_name}-rds-iam-connect"
  role = aws_iam_role.this.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = "rds-db:connect"
      # dbuser:* でクラスター ID を固定しない。db_user のみで制限する
      Resource = "arn:aws:rds-db:${var.aws_region}:${data.aws_caller_identity.current.account_id}:dbuser:*/${var.db_user}"
    }]
  })
}

#!/bin/bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
ZIP_OUTPUT="${PROJECT_ROOT}/lambda.zip"

echo "==> TypeScript をビルドします..."
cd "${PROJECT_ROOT}"
npm run build

echo "==> 一時ディレクトリを作成します..."
TEMP_DIR=$(mktemp -d)
trap 'rm -rf "${TEMP_DIR}"' EXIT

# dist/src/ の中身をルートにコピー（Lambda ハンドラー = index.handler）
echo "==> コンパイル済みファイルをコピーします（dist/src/ → ZIP ルート）..."
cp -r "${PROJECT_ROOT}/dist/src/." "${TEMP_DIR}/"

# package.json をコピー（"type": "module" による ESM 検出に必要）
echo "==> 本番依存関係をインストールします（devDependencies を除外）..."
cp "${PROJECT_ROOT}/package.json" "${TEMP_DIR}/package.json"
cp "${PROJECT_ROOT}/package-lock.json" "${TEMP_DIR}/package-lock.json"
cd "${TEMP_DIR}"
npm ci --omit=dev

echo "==> ZIP を作成します..."
rm -f "${ZIP_OUTPUT}"
zip -r "${ZIP_OUTPUT}" . --exclude "package-lock.json"