GitHub Actions × ecspresso × CDK で ECS Fargate デプロイを高速化 - デプロイ時間 5分→3分の改善

.
├── .github/
│   └── workflows/
│       └── deploy.yml         # GitHub Actions ワークフロー
├── backend/
│   ├── src/
│   │   └── index.ts           # Express アプリケーション
│   ├── Dockerfile
│   └── package.json
├── ecspresso/
│   ├── ecspresso.yml          # ecspresso 設定
│   ├── ecs-service-def.json   # ECS サービス定義
│   └── ecs-task-def.json      # ECS タスク定義
├── lib/
│   ├── constructs/            # CDK Constructs
│   └── stack.ts               # CDK スタック
└── bin/
    └── app.ts                 # CDK エントリーポイント

import * as ecs from "aws-cdk-lib/aws-ecs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as iam from "aws-cdk-lib/aws-iam";
import * as logs from "aws-cdk-lib/aws-logs";
import { Construct } from "constructs";

export interface EcsConstructProps {
  readonly vpc: ec2.IVpc;
}

/**
 * ECS Construct
 * ECSクラスター、IAMロール、CloudWatch Logsグループを作成する
 * タスク定義とサービスは ecspresso で管理するため、ここでは作成しない
 */
export class EcsConstruct extends Construct {
  public readonly cluster: ecs.Cluster;
  public readonly taskExecutionRole: iam.Role;
  public readonly taskRole: iam.Role;
  public readonly logGroup: logs.LogGroup;

  constructor(scope: Construct, id: string, props: EcsConstructProps) {
    super(scope, id);

    /**
     * ECSクラスターの作成
     * コンテナを実行する論理的なグループ
     */
    const cluster = new ecs.Cluster(this, "Cluster", {
      vpc: props.vpc,
      clusterName: "ecs-cluster",
      containerInsightsV2: ecs.ContainerInsights.ENABLED,
    });
    this.cluster = cluster;

    /**
     * タスク実行ロール
     * ECSがタスクを起動する際に使用するロール
     * - ECRからコンテナイメージをpull
     * - CloudWatch Logsへログを書き込み
     */
    const taskExecutionRole = new iam.Role(this, "TaskExecutionRole", {
      roleName: "ecsTaskExecutionRole",
      assumedBy: new iam.ServicePrincipal("ecs-tasks.amazonaws.com"),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          "service-role/AmazonECSTaskExecutionRolePolicy"
        ),
      ],
    });
    this.taskExecutionRole = taskExecutionRole;

    /**
     * タスクロール
     * コンテナ内のアプリケーションが使用するロール
     */
    const taskRole = new iam.Role(this, "TaskRole", {
      roleName: "ecsTaskRole",
      assumedBy: new iam.ServicePrincipal("ecs-tasks.amazonaws.com"),
    });
    this.taskRole = taskRole;

    /**
     * CloudWatch Logsグループ: コンテナのログを保存（7日間保持）
     */
    const logGroup = new logs.LogGroup(this, "LogGroup", {
      logGroupName: "/ecs/backend",
      retention: logs.RetentionDays.ONE_WEEK,
    });
    this.logGroup = logGroup;
  }
}

CDK（インフラ構築）
  ↓ リソース作成
  ↓ ARN・IDを取得
  ↓ SSMに保存
SSM パラメータストア（データの橋渡し）
  ↓ デプロイ時に参照
ecspresso（アプリデプロイ）

/**
 * SSMパラメータストアにリソース情報を保存（ecspressoから参照）
 **/
new ssm.StringParameter(this, "TaskExecutionRoleArnParam", {
  parameterName: "/ecs-app/task-execution-role-arn",
  stringValue: ecsCluster.taskExecutionRole.roleArn,
  description: "ECS Task Execution Role ARN",
});

new ssm.StringParameter(this, "TaskRoleArnParam", {
  parameterName: "/ecs-app/task-role-arn",
  stringValue: ecsCluster.taskRole.roleArn,
  description: "ECS Task Role ARN",
});

new ssm.StringParameter(this, "SubnetIdsParam", {
  parameterName: "/ecs-app/subnet-ids",
  stringValue: network.vpc.privateSubnets.map((s) => s.subnetId).join(","),
  description: "Private Subnet IDs",
});

new ssm.StringParameter(this, "SecurityGroupIdParam", {
  parameterName: "/ecs-app/security-group-id",
  stringValue: network.ecsSecurityGroup.securityGroupId,
  description: "ECS Security Group ID",
});

new ssm.StringParameter(this, "TargetGroupArnParam", {
  parameterName: "/ecs-app/target-group-arn",
  stringValue: alb.backendTargetGroup.targetGroupArn,
  description: "ALB Target Group ARN",
});

# インフラをデプロイ
npx cdk deploy

region: ap-northeast-1
cluster: ecs-cluster
service: backend-service
task_definition: ecs-task-def.json
service_definition: ecs-service-def.json
timeout: 10m

{
  "family": "backend-task",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "256",
  "memory": "512",
  "runtimePlatform": {
    "cpuArchitecture": "ARM64",
    "operatingSystemFamily": "LINUX"
  },
  "executionRoleArn": "{{ ssm `/ecs-app/task-execution-role-arn` }}",
  "taskRoleArn": "{{ ssm `/ecs-app/task-role-arn` }}",
  "containerDefinitions": [
    {
      "name": "backend",
      "image": "{{ must_env `ECR_REGISTRY` }}/{{ must_env `ECR_REPOSITORY` }}:{{ must_env `IMAGE_TAG` }}",
      "portMappings": [
        {
          "containerPort": 4000,
          "protocol": "tcp"
        }
      ],
      "essential": true,
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/backend",
          "awslogs-region": "ap-northeast-1",
          "awslogs-stream-prefix": "backend"
        }
      },
      "environment": [
        {
          "name": "NODE_ENV",
          "value": "production"
        },
        {
          "name": "PORT",
          "value": "4000"
        }
      ]
    }
  ]
}

{
  "serviceName": "backend-service",
  "desiredCount": 2,
  "launchType": "FARGATE",
  "networkConfiguration": {
    "awsvpcConfiguration": {
      "subnets": {{ ssm `/ecs-app/subnet-ids` | fromJSON }},
      "securityGroups": ["{{ ssm `/ecs-app/security-group-id` }}"],
      "assignPublicIp": "DISABLED"
    }
  },
  "loadBalancers": [
    {
      "targetGroupArn": "{{ ssm `/ecs-app/target-group-arn` }}",
      "containerName": "backend",
      "containerPort": 4000
    }
  ],
  "healthCheckGracePeriodSeconds": 60,
  "deploymentConfiguration": {
    "maximumPercent": 200,
    "minimumHealthyPercent": 100,
    "deploymentCircuitBreaker": {
      "enable": true,
      "rollback": true
    }
  },
  "enableExecuteCommand": true
}

name: Deploy Infrastructure and Application

on: workflow_dispatch

# OIDC認証に必要な権限
permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: dev

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      # 変更されたファイルを検出して、インフラとアプリのどちらをデプロイするか判断
      - name: Detect changed files
        id: changed-files
        uses: step-security/changed-files@v46
        with:
          files_yaml: |
            infrastructure:
              - lib/**
              - bin/**
              - cdk.json
              - package.json
              - pnpm-lock.yaml
              - tsconfig.json
            application:
              - backend/**
              - ecspresso/**

      # OIDC認証でAWSにログイン
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: ap-northeast-1

      # ===== インフラデプロイ（CDK）=====

      # Node.js のセットアップ
      - name: Setup Node.js
        if: steps.changed-files.outputs.infrastructure_any_changed == 'true'
        uses: actions/setup-node@v4
        with:
          node-version: "22.x"

      # pnpm のセットアップ
      - name: Setup pnpm
        if: steps.changed-files.outputs.infrastructure_any_changed == 'true'
        uses: pnpm/action-setup@v4
        with:
          version: 9

      # 依存関係のインストール
      - name: Install dependencies
        if: steps.changed-files.outputs.infrastructure_any_changed == 'true'
        run: pnpm install --frozen-lockfile

      # CDK でインフラをデプロイ
      - name: CDK Deploy
        if: steps.changed-files.outputs.infrastructure_any_changed == 'true'
        run: npx cdk deploy --require-approval never

      # ===== アプリデプロイ（ecspresso）=====

      # ecspresso のインストール
      - name: Setup ecspresso
        if: steps.changed-files.outputs.application_any_changed == 'true'
        uses: kayac/ecspresso@v2
        with:
          version: v2.7.1

      # ECR へのログイン
      - name: Login to Amazon ECR
        if: steps.changed-files.outputs.application_any_changed == 'true'
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      # Docker Buildx のセットアップ
      - name: Set up Docker Buildx
        if: steps.changed-files.outputs.application_any_changed == 'true'
        uses: docker/setup-buildx-action@v3

      # Docker イメージをビルドして ECR にプッシュ（GitHub Actionsキャッシュで高速化）
      - name: Build and push Backend image
        if: steps.changed-files.outputs.application_any_changed == 'true'
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          platforms: linux/arm64
          push: true
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/${{ vars.ECR_REPOSITORY }}:${{ github.sha }}
            ${{ steps.login-ecr.outputs.registry }}/${{ vars.ECR_REPOSITORY }}:latest
          cache-from: type=gha # 前回のビルドキャッシュを読み込み
          cache-to: type=gha,mode=max # 今回のビルドキャッシュを保存（全レイヤー）

      # ecspresso で ECS にデプロイ実行
      - name: Deploy to ECS with ecspresso
        if: steps.changed-files.outputs.application_any_changed == 'true'
        working-directory: ecspresso
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
          IMAGE_TAG: ${{ github.sha }}
        run: ecspresso deploy

      # デプロイ結果の確認
      - name: Verify deployment
        if: steps.changed-files.outputs.application_any_changed == 'true'
        working-directory: ecspresso
        run: ecspresso status

- name: Detect changed files
  id: changed-files
  uses: step-security/changed-files@v46
  with:
    files_yaml: |
      infrastructure:
        - lib/**
        - bin/**
        - cdk.json
        - package.json
      application:
        - backend/**
        - ecspresso/**

# CDK は infrastructure が変更された時のみ実行
- name: CDK Deploy
  if: steps.changed-files.outputs.infrastructure_any_changed == 'true'
  run: npx cdk deploy --require-approval never

# ecspresso は application が変更された時のみ実行
- name: Deploy to ECS with ecspresso
  if: steps.changed-files.outputs.application_any_changed == 'true'
  run: ecspresso deploy

Run ecspresso deploy --config ecspresso.yml
2026-02-11T08:33:08.301Z [INFO] ecspresso version: v2.7.1
2026-02-11T08:33:08.302Z [INFO] [backend-service/ecs-cluster] Starting deploy
2026-02-11T08:33:08.801Z [INFO] [backend-service/ecs-cluster] Service backend-service not found. Creating a new service
2026-02-11T08:33:08.801Z [INFO] [backend-service/ecs-cluster] Starting create service
2026-02-11T08:33:09.950Z [INFO] [backend-service/ecs-cluster] Registering a new task definition...
2026-02-11T08:33:10.114Z [INFO] [backend-service/ecs-cluster] Task definition is registered backend-task:1
2026-02-11T08:33:11.358Z [INFO] [backend-service/ecs-cluster] Service is created
2026-02-11T08:33:14.528Z [INFO] [backend-service/ecs-cluster] Waiting for service stable...(it will take a few minutes)

2026-02-11T08:33:25.065Z [INFO] [backend-service/ecs-cluster]  PRIMARY backend-task:1 desired:0 pending:0 running:0 IN_PROGRESS(ECS deployment ecs-svc/6372757946953777653 in progress.)
2026-02-11T08:33:37.091Z (service backend-service) has started 1 tasks: (task e752a5cf79b24cee9c2d34de3b9b7b35).
2026-02-11T08:33:45.042Z [INFO] [backend-service/ecs-cluster]  PRIMARY backend-task:1 desired:1 pending:1 running:0 IN_PROGRESS(ECS deployment ecs-svc/6372757946953777653 in progress.)

2026-02-11T08:34:07.628Z (service backend-service) registered 1 targets in (target-group arn:aws:elasticloadbalancing:ap-northeast-1:395663595720:targetgroup/EcsEcs-AlbBa-MFGUPGHW4OPN/6272bb5c2405e114)
2026-02-11T08:34:15.049Z [INFO] [backend-service/ecs-cluster]  PRIMARY backend-task:1 desired:1 pending:0 running:1 IN_PROGRESS(ECS deployment ecs-svc/6372757946953777653 in progress.)

2026-02-11T08:34:18.165Z (service backend-service) has started 1 tasks: (task 47d9d8e19245469daf4b1879f4e6ab42).
2026-02-11T08:34:25.036Z [INFO] [backend-service/ecs-cluster]  PRIMARY backend-task:1 desired:2 pending:1 running:1 IN_PROGRESS(ECS deployment ecs-svc/6372757946953777653 in progress.)
2026-02-11T08:34:49.183Z (service backend-service) registered 1 targets in (target-group arn:aws:elasticloadbalancing:ap-northeast-1:395663595720:targetgroup/EcsEcs-AlbBa-MFGUPGHW4OPN/6272bb5c2405e114)

2026-02-11T08:35:04.249Z [INFO] [backend-service/ecs-cluster]  PRIMARY backend-task:1 desired:2 pending:0 running:2 COMPLETED(ECS deployment ecs-svc/6372757946953777653 completed.)
2026-02-11T08:34:58.667Z (service backend-service) (deployment ecs-svc/6372757946953777653) deployment completed.
2026-02-11T08:34:58.668Z (service backend-service) has reached a steady state.
2026-02-11T08:35:04.249Z [INFO] [backend-service/ecs-cluster] Service is stable now. Completed!