Kong Gatewayを使ったマイクロサービスAPI基盤の一例

curl -X POST http://localhost:8000/v1/auth/guest \
  -H "Content-Type: application/json" \
  -d '{
    "device_id": "test-device-001",
    "device_type": "ios",
    "device_name": "iPhone 15"
  }'

{
  "success": true,
  "data": {
    "user_id": "uuid",
    "player_id": "PLY123456",
    "access_token": "eyJhbG...",
    "refresh_token": "dGhpcyBpcy...",
    "is_guest": true
  }
}

routes:
  # Guest authentication (NO JWT required)
  - name: auth-guest-route
    paths:
      - ~/v1/auth/guest$
    methods:
      - POST
    strip_path: false
    preserve_host: false

  # User routes (JWT required)
  - name: users-route
    paths:
      - /v1/users
    methods:
      - GET
      - PUT
    strip_path: false
    preserve_host: false
    plugins:
      - name: jwt
        config:
          claims_to_verify:
            - exp
          key_claim_name: iss
          header_names:
            - Authorization

type SagaStatus string

const (
	StatusStarted          SagaStatus = "STARTED"
	StatusCurrencyReserved SagaStatus = "CURRENCY_RESERVED"
	StatusDrawCompleted    SagaStatus = "DRAW_COMPLETED"
	StatusItemGranted      SagaStatus = "ITEM_GRANTED"
	StatusCompleted        SagaStatus = "COMPLETED"
	StatusCompensating     SagaStatus = "COMPENSATING"
	StatusCurrencyRefunded SagaStatus = "CURRENCY_REFUNDED"
	StatusFailed           SagaStatus = "FAILED"
)

curl -X POST http://localhost:8000/v1/gacha/draw \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {access_token}" \
  -d '{
    "pool_id": "pool-standard",
    "draw_count": 10
  }'

{
  "success": true,
  "data": {
    "saga_id": "uuid",
    "status": "COMPLETED",
    "results": [
      {
        "item_master_id": "char-ssr-001",
        "rarity": "SSR",
        "is_new": true,
        "is_pickup": false
      }
    ],
    "cost": {
      "currency_type": "free_gem",
      "amount": 3000
    },
    "pity": {
      "count": 10,
      "max_count": 90
    }
  }
}

services:
  - name: user-service
    plugins:
      - name: rate-limiting
        config:
          minute: 30
          policy: local
          fault_tolerant: true

  - name: gacha-service
    plugins:
      - name: rate-limiting
        config:
          minute: 10
          policy: local
          fault_tolerant: true

  - name: inventory-service
    plugins:
      - name: rate-limiting
        config:
          minute: 60
          policy: local
          fault_tolerant: true

plugins:
  - name: oas-validation
    config:
      api_spec: "${OAS_API_SPEC}"
      api_spec_encoded: false
      validate_request_body: true
      validate_request_header_params: true
      validate_request_query_params: true
      validate_request_uri_params: true
      validate_response_body: false
      verbose_response: true

plugins:
  - name: correlation-id
    config:
      header_name: X-Request-ID
      generator: uuid
      echo_downstream: true

terraform/
├── main.tf              # モジュール呼び出し
├── variables.tf         # 変数定義
├── outputs.tf           # 出力定義
├── versions.tf          # バージョン指定
└── modules/
    ├── vpc/             # VPC・サブネット
    ├── security_groups/ # セキュリティグループ
    ├── alb/             # ALB・ターゲットグループ
    ├── cloudmap/        # Cloud Map（サービスディスカバリ）
    ├── ecr/             # ECRリポジトリ
    ├── ecs/             # ECSクラスター・タスク定義・サービス
    ├── ssm/             # SSM Parameter Store
    └── github_oidc/     # GitHub Actions用OIDC

module "vpc" {
  source = "./modules/vpc"
  project_name = var.project_name
  vpc_cidr     = var.vpc_cidr
}

module "cloudmap" {
  source = "./modules/cloudmap"
  project_name   = var.project_name
  vpc_id         = module.vpc.vpc_id
  namespace_name = "game.local"
}

module "ecs" {
  source = "./modules/ecs"
  project_name                        = var.project_name
  private_subnet_ids                  = module.vpc.private_subnet_ids
  kong_security_group_id              = module.security_groups.kong_security_group_id
  kong_konnect_control_plane_endpoint = var.kong_konnect_control_plane_endpoint
  # ...
}

resource "aws_ecs_task_definition" "kong" {
  family                   = "${var.project_name}-kong"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.ecs_task_execution.arn
  task_role_arn            = aws_iam_role.ecs_task.arn

  container_definitions = jsonencode([
    {
      name      = "kong"
      image     = "kong/kong-gateway:3.12"
      essential = true

      environment = [
        { name = "KONG_ROLE", value = "data_plane" },
        { name = "KONG_DATABASE", value = "off" },
        { name = "KONG_CLUSTER_MTLS", value = "pki" },
        { name = "KONG_CLUSTER_CONTROL_PLANE", value = var.kong_konnect_control_plane_endpoint }
        # ...
      ]

      secrets = [
        { name = "KONG_CLUSTER_CERT_DATA", valueFrom = var.kong_cluster_cert_arn },
        { name = "KONG_CLUSTER_CERT_KEY_DATA", valueFrom = var.kong_cluster_cert_key_arn }
      ]
    }
  ])
}

resource "aws_ecs_service" "user" {
  name            = "${var.project_name}-user"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.user.arn
  # ...

  service_registries {
    registry_arn   = var.user_service_registry_arn
    container_name = "user"
  }
}

kong/
└── kong.yaml    # Kong設定ファイル

jobs:
  sync:
    name: Kong Config Sync
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'

    steps:
      - name: Inject OpenAPI spec into Kong config
        run: |
          yq -o=json '.' openapi.yaml | jq -c '.' > /tmp/oas-spec.json
          cp kong/kong.yaml kong/kong-with-oas.yaml
          export OAS_SPEC=$(cat /tmp/oas-spec.json)
          yq -i '
            (.plugins[] | select(.name == "oas-validation") | .config.api_spec) = strenv(OAS_SPEC)
          ' kong/kong-with-oas.yaml

      - name: Sync to Kong Konnect
        run: |
          deck gateway sync kong/kong-with-oas.yaml \
            --konnect-addr $KONG_ADDR \
            --konnect-token $KONG_TOKEN \
            --konnect-control-plane-name $KONG_CP_NAME

cd terraform

# 変数ファイルを作成
cp terraform.tfvars.example terraform.tfvars
# terraform.tfvarsを編集し、各種シークレットを設定

# 初期化
terraform init

# 実行計画を確認
terraform plan

# インフラを構築
terraform apply

# ECRにログイン
aws ecr get-login-password --region ap-northeast-1 | \
  docker login --username AWS --password-stdin <ACCOUNT_ID>.dkr.ecr.ap-northeast-1.amazonaws.com

# 各サービスをビルド・プッシュ
cd backend

# User Service
docker build -t <ACCOUNT_ID>.dkr.ecr.ap-northeast-1.amazonaws.com/kong-game/user-service:latest \
  -f docker/user-service/Dockerfile .
docker push <ACCOUNT_ID>.dkr.ecr.ap-northeast-1.amazonaws.com/kong-game/user-service:latest

# Gacha Service
docker build -t <ACCOUNT_ID>.dkr.ecr.ap-northeast-1.amazonaws.com/kong-game/gacha-service:latest \
  -f docker/gacha-service/Dockerfile .
docker push <ACCOUNT_ID>.dkr.ecr.ap-northeast-1.amazonaws.com/kong-game/gacha-service:latest

# Inventory Service
docker build -t <ACCOUNT_ID>.dkr.ecr.ap-northeast-1.amazonaws.com/kong-game/inventory-service:latest \
  -f docker/inventory-service/Dockerfile .
docker push <ACCOUNT_ID>.dkr.ecr.ap-northeast-1.amazonaws.com/kong-game/inventory-service:latest

cd backend
docker-compose up -d