Terraform MCP ServerをAmazon ECSにデプロイしてみた

docker_image = "1234567890.dkr.ecr.us-east-1.amazonaws.com/hashicorp/terraform-mcp-server:0.2.0" # mcp serverコンテナイメージURI

variable "aws_region" {
  description = "AWS region where resources will be created"
  type        = string
  default     = "ap-northeast-1"
}

variable "docker_image" {
  description = "Docker image for the container"
  type        = string
}

terraform {
  required_version = ">= 1.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

# Local values
locals {
  prefix = "tf-mcp-remote-ecs"
}

# Data sources
data "aws_availability_zones" "available" {
  state = "available"
}
data "aws_caller_identity" "current" {}

# VPC Module
module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = local.prefix
  cidr = "10.0.0.0/16"

  azs            = data.aws_availability_zones.available.names
  public_subnets = ["10.0.1.0/24", "10.0.2.0/24"]

  enable_nat_gateway   = false
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Terraform = "true"
    Name      = "${local.prefix}"
  }
}

# Security Group
resource "aws_security_group" "ecs_tasks" {
  name_prefix = "${local.prefix}-ecs-tasks"
  vpc_id      = module.vpc.vpc_id

  ingress {
    description = "MCP Server Port"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "All outbound traffic"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${local.prefix}-ecs-tasks"
  }
}

# IAM Roles
resource "aws_iam_role" "ecs_execution_role" {
  name = "${local.prefix}-ecs-execution"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name = "${local.prefix}-ecs-execution"
  }
}

resource "aws_iam_role_policy_attachment" "ecs_execution_role_policy" {
  role       = aws_iam_role.ecs_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role" "ecs_task_role" {
  name = "${local.prefix}-ecs-task"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name = "${local.prefix}-ecs-task"
  }
}

# ECS Resources
resource "aws_ecs_cluster" "main" {
  name = local.prefix

  setting {
    name  = "containerInsights"
    value = "enabled"
  }

  tags = {
    Name = "${local.prefix}"
  }
}

resource "aws_ecs_task_definition" "main" {
  family                   = local.prefix
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = 512
  memory                   = 1024
  execution_role_arn       = aws_iam_role.ecs_execution_role.arn
  task_role_arn            = aws_iam_role.ecs_task_role.arn

  container_definitions = jsonencode([
    {
      name      = "terraform-mcp-server"
      image     = var.docker_image
      cpu       = 512
      memory    = 1024
      essential = true
      portMappings = [
        {
          containerPort = 80
          protocol      = "tcp"
        }
      ]
      environment = [
        {
          name  = "MCP_SESSION_MODE"
          value = "stateless"
        },
        {
          name  = "MCP_CORS_MODE"
          value = "strict"
        },
        {
          name  = "MCP_ALLOWED_ORIGINS"
          value = "http://127.0.0.1"
        },
        {
          name  = "TRANSPORT_MODE"
          value = "streamable-http"
        },
        {
          name  = "TRANSPORT_HOST"
          value = "0.0.0.0"
        },
        {
          name  = "TRANSPORT_PORT"
          value = "80"
        }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = "/ecs/${local.prefix}"
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "ecs"
        }
      }
    }
  ])

  tags = {
    Name = "${local.prefix}"
  }
}

resource "aws_ecs_service" "main" {
  name            = local.prefix
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.main.arn
  desired_count   = 1
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = module.vpc.public_subnets
    security_groups  = [aws_security_group.ecs_tasks.id]
    assign_public_ip = true
  }

  depends_on = [aws_iam_role_policy_attachment.ecs_execution_role_policy]

  tags = {
    Name = "${local.prefix}"
  }
}

resource "aws_cloudwatch_log_group" "ecs" {
  name              = "/ecs/${local.prefix}"
  retention_in_days = 7

  tags = {
    Name = "${local.prefix}"
  }
}

terraform init
terraform plan
terraform apply

curl http://<ECSタスクのパブリックIP>/health

{"status":"ok","service":"terraform-mcp-server","transport":"streamable-http"}%

      "mcpServers": {
        "terraform-mcp-server-ecs": {
          "type": "http",
          "url": "http://<ECSタスクのパブリックIP>/mcp"
        }

claude
/mcp

I need help understanding what resources are available in the Google provider that are for AI