[アップデート]TerraformのAWS Transfer Family用のモジュールがSFTPコネクタに対応しました。

.
└── modules
    ├── s3-storage         # 転送先バケット
    └── sftp-connector     # SFTPコネクタリソース(IAMロール含む)

module "transfer_connectors" {
  source = "aws-ia/transfer-family/aws//modules/transfer-connectors"

  url         = "sftp://${var.sftp_host}:${var.sftp_port}"
  access_role = aws_iam_role.connector_role.arn

  user_secret_id = var.user_secret_id
  trusted_host_keys = var.sftp_trusted_host_keys
  test_connector_post_deployment = true

  tags = {
    Name = var.connector_name
  }
}

resource "aws_iam_role" "connector_role" {
  name = "${var.connector_name}-connector-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "transfer.amazonaws.com"
        }
      }
    ]
  })

}

resource "aws_iam_role_policy" "connector_s3_policy" {
  name = "${var.connector_name}-s3-policy"
  role = aws_iam_role.connector_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject",
          "s3:GetObjectVersion",
          "s3:GetObjectTagging",
          "s3:PutObjectTagging"
        ]
        Resource = "${var.s3_bucket_arn}/*"
      },
      {
        Effect = "Allow"
        Action = [
          "s3:ListBucket",
          "s3:GetBucketLocation"
        ]
        Resource = var.s3_bucket_arn
      }
    ]
  })
}

resource "aws_iam_role_policy" "connector_secrets_policy" {
  name = "${var.connector_name}-secrets-policy"
  role = aws_iam_role.connector_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue",
          "secretsmanager:DescribeSecret"
        ]
        Resource = var.user_secret_id
      }
    ]
  })
}

#!/bin/sh

echo "Waiting 10 seconds for connector to be fully ready..."
sleep 10

if ! command -v aws &> /dev/null; then
  echo "AWS CLI not found - connector testing skipped"
  echo "Deployment completed successfully"
  exit 0
fi

AWS_VERSION=$(aws --version 2>&1 | cut -d'/' -f2 | cut -d' ' -f1)
if [ -n "$AWS_VERSION" ]; then
  MAJOR=$(echo "$AWS_VERSION" | cut -d'.' -f1)
  MINOR=$(echo "$AWS_VERSION" | cut -d'.' -f2)

  if [ "$MAJOR" -lt 2 ] || ([ "$MAJOR" -eq 2 ] && [ "$MINOR" -lt 28 ]); then
    echo "AWS CLI version $AWS_VERSION detected - connector testing requires version 2.28.x or above"
    echo "connector testing skipped"
    echo "Deployment completed successfully"
    exit 0
  fi
  echo "AWS CLI version $AWS_VERSION - version check passed"
else
  echo "Could not determine AWS CLI version - connector testing skipped"
  echo "Deployment completed successfully"
  exit 0
fi

if ! command -v jq &> /dev/null; then
  echo "jq not found - connector testing skipped"
  echo "Deployment completed successfully"
  exit 0
fi

echo "Testing connection to discover host key..."

MAX_RETRIES=3
RETRY_COUNT=0
HOST_KEY=""

while [ $RETRY_COUNT -lt $MAX_RETRIES ] && [ -z "$HOST_KEY" ]; do
  RETRY_COUNT=$((RETRY_COUNT + 1))
  echo "Attempt $RETRY_COUNT/$MAX_RETRIES: Testing connection..."

  DISCOVERY_RESULT=$(aws transfer test-connection \
    --connector-id c-xxxxx \
    --region ap-northeast-1 \
    --output json 2>/dev/null || echo '{}')

  echo "DEBUG - Discovery Result: $DISCOVERY_RESULT"

  STATUS=$(echo "$DISCOVERY_RESULT" | jq -r '.Status // empty')
  echo "DEBUG - Status: $STATUS"

  if [ "$STATUS" = "ERROR" ]; then
    ERROR_MSG=$(echo "$DISCOVERY_RESULT" | jq -r '.StatusMessage // empty')
    echo "Connection test failed: $ERROR_MSG"
    echo "DEBUG - Full error response: $DISCOVERY_RESULT"

    if echo "$ERROR_MSG" | grep -q "Cannot access secret manager"; then
      echo "Secret manager not ready, waiting 10 seconds..."
      sleep 10
      continue
    fi
  elif [ "$STATUS" = "OK" ]; then
    echo "Connection test successful - connector is properly configured"
    echo "Deployment completed successfully"
    exit 0
  fi

  HOST_KEY=$(echo "$DISCOVERY_RESULT" | jq -r '.SftpConnectionDetails.HostKey // empty')
  echo "DEBUG - Host Key: $HOST_KEY"

  if [ -n "$HOST_KEY" ] && [ "$HOST_KEY" != "null" ]; then
    echo "Host key discovered: $HOST_KEY"
    break
  else
    echo "Host key not found, retrying in 10s..."
    sleep 10
  fi
done

if [ -n "$HOST_KEY" ] && [ "$HOST_KEY" != "null" ]; then
  echo "Updating connector with discovered host key..."
  UPDATE_RESULT=$(aws transfer update-connector \
    --connector-id c-xxxxx \
    --region ap-northeast-1 \
    --url "sftp://sftp.example.com:22" \
    --access-role "arn:aws:iam::111122223333:role/dev-sftp-connector-connector-role" \
    --logging-role "arn:aws:iam::111122223333:role/transfer-connector-logging-role-sftp-connector" \
    --sftp-config "UserSecretId=arn:aws:secretsmanager:ap-northeast-1:111122223333:secret:aws/transfer/sftp-connector-bw-bastion-xxxxx,TrustedHostKeys=$HOST_KEY" \
    --output json)

  echo "DEBUG - Update Result: $UPDATE_RESULT"

  echo "Testing final connection with trusted host key..."
  FINAL_TEST=$(aws transfer test-connection \
    --connector-id c-xxxxx \
    --region ap-northeast-1 \
    --output json)

  echo "DEBUG - Final Test Result: $FINAL_TEST"

  FINAL_STATUS=$(echo "$FINAL_TEST" | jq -r '.Status')
  echo "Final connection status: $FINAL_STATUS"

  if [ "$FINAL_STATUS" = "OK" ]; then
    echo "Connector configured and tested successfully"
  else
    echo "Final test failed: $FINAL_STATUS"
  fi
fi