仮想待合室 SaaS "NetFUNNEL" に入門してみた ～CloudFront連携がとても簡単だった件～

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
+   archive = {
+     source  = "hashicorp/archive"
+     version = "~> 2.0"
+   }
+   local = {
+     source  = "hashicorp/local"
+     version = "~> 2.0"
+   }
  }
}

variable "client_id" {
  description = "NetFUNNEL Client ID"
  type        = string
}

locals {
  lambda_src_dir = "${path.root}/lambda_src"
}

data "aws_iam_policy_document" "lambda_assume_role" {
  statement {
    effect = "Allow"
    principals {
      type = "Service"
      identifiers = [
        "lambda.amazonaws.com",
        "edgelambda.amazonaws.com",
      ]
    }
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "netfunnel_agent" {
  name               = "netfunnel-cloudfront-agent"
  assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
}

resource "aws_iam_role_policy_attachment" "netfunnel_agent_logs" {
  role       = aws_iam_role.netfunnel_agent.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "terraform_data" "download_agent" {
  triggers_replace = timestamp() # Plan / Apply時に毎回ダウンロードされるので、必要に応じて改善してください。

  provisioner "local-exec" {
    command = "mkdir -p ${local.lambda_src_dir} && curl -fsSL -o ${local.lambda_src_dir}/netfunnel-cloudfront-agent.js https://agent-lib.stclab.com/agents/cdn/cloudfront/netfunnel-cloudfront-agent-latest.js"
  }
}

resource "local_file" "index_mjs" {
  filename   = "${local.lambda_src_dir}/index.mjs"
  depends_on = [terraform_data.download_agent]
  content    = <<-JS
    import handleEvent from './netfunnel-cloudfront-agent.js';
    const config = {
      clientID: "${var.client_id}",
    };
    export const handler = async (event) => {
      return await handleEvent(event, config);
    };
  JS
}

resource "local_file" "package_json" {
  filename   = "${local.lambda_src_dir}/package.json"
  depends_on = [terraform_data.download_agent]
  content    = <<-JSON
    {
      "name": "cloudfront-agent",
      "type": "module",
      "dependencies": {}
    }
  JSON
}

data "archive_file" "lambda" {
  type        = "zip"
  source_dir  = local.lambda_src_dir
  output_path = "${path.root}/lambda.zip"
  depends_on  = [terraform_data.download_agent, local_file.index_mjs, local_file.package_json]
}

resource "aws_lambda_function" "netfunnel_agent" {
  function_name    = "netfunnel-cloudfront-agent"
  role             = aws_iam_role.netfunnel_agent.arn
  filename         = data.archive_file.lambda.output_path
  source_code_hash = data.archive_file.lambda.output_base64sha256
  handler          = "index.handler"
  runtime          = "nodejs24.x"
  publish          = true
}

resource "aws_cloudfront_distribution" "distribution" {
  enabled = true

  origin {
    domain_name              = aws_s3_bucket.origin.bucket_regional_domain_name
    origin_id                = aws_s3_bucket.origin.id
    origin_access_control_id = aws_cloudfront_origin_access_control.oac.id
  }

  default_cache_behavior {
    target_origin_id       = aws_s3_bucket.origin.id
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]

    # AWSマネージドキャッシュポリシー: CachingOptimized
    cache_policy_id = "658327ea-f89d-4fab-a63d-7e88639e58f6"

+   lambda_function_association {
+     event_type   = "viewer-request"
+     lambda_arn   = aws_lambda_function.netfunnel_agent.qualified_arn
+     include_body = false
+   }
+
+   lambda_function_association {
+     event_type   = "viewer-response"
+     lambda_arn   = aws_lambda_function.netfunnel_agent.qualified_arn
+     include_body = false
+   }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}

terraform apply -var="client_id=xxxxxxxxxxxx-xxxx"