ステップ4：環境分離とベストプラクティス

cdk ls --region us-east-1

CdkIacProjectStack

cdk destroy --region us-east-1

Are you sure you want to delete: CdkIacProjectStack (y/n)? y
CdkIacProjectStack: destroying... [1/1]
...
✅  CdkIacProjectStack: destroyed

 
# プロジェクト構造を確認
tree -L 2 -I node_modules

.
├── bin
│   └── cdk-iac-project.ts
├── cdk.json
├── lib
│   └── cdk-iac-project-stack.ts
├── nextjs-app
│   └── // 省略
├── package-lock.json
├── package.json
├── README.md
└── //省略

{
  "app": "npx ts-node --prefer-ts-exts bin/cdk-iac-project.ts",
  "context": {
    "@aws-cdk/aws-lambda:recognizeLayerVersion": true,
    "@aws-cdk/core:checkSecretUsage": true,
    // ... 既存の設定 ...
 
    // 環境設定を追加
    "environments": [
      {
        "name": "dev",
        "desiredCount": 1,
        "cpu": 256,
        "memory": 512
      },
      {
        "name": "staging",
        "desiredCount": 2,
        "cpu": 256,
        "memory": 512
      },
      {
        "name": "production",
        "desiredCount": 3,
        "cpu": 512,
        "memory": 1024
      }
    ]
  }
}

cdk deploy --region us-east-1

cdk deploy --context env=dev --region us-east-1

cdk deploy --context env=staging --region us-east-1

cdk deploy --context env=production --region us-east-1

# dev環境（デフォルト）
cdk ls --region us-east-1
 
# staging環境
cdk ls --context env=staging --region us-east-1

IacStack-dev

npm install cdk-nag

#!/usr/bin/env node
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { CdkIacProjectStack } from '../lib/cdk-iac-project-stack';
import { AwsSolutionsChecks } from 'cdk-nag';
import { Aspects } from 'aws-cdk-lib';
 
const app = new cdk.App();
 
// cdk-nagのAWS Solutions Checksを追加
Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));
 
// 省略

cdk synth --context env=dev --region us-east-1

[Warning at /IacStack-dev/AlbSecurityGroup] AwsSolutions-EC23: The Security Group allows for 0.0.0.0/0 or ::/0 inbound access.
 
[Warning at /IacStack-dev/MyAlb] AwsSolutions-ELB2: The ALB is not configured with access logs.

import * as ssm from 'aws-cdk-lib/aws-ssm';
 
export class CdkIacProjectStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CdkIacProjectStackProps) {
    super(scope, id, props);
 
    const envName = props.tags?.Environment || 'dev';
 
    // ... 省略（前述のコード） ...
 
    // Systems Manager Parameter Storeに環境変数を保存
    const nodeEnvParameter = new ssm.StringParameter(this, 'NodeEnvParameter', {
      parameterName: `/iac-learning/${envName}/NODE_ENV`,
      stringValue: 'production',
      description: 'NODE_ENV environment variable for Next.js application',
    });
 
    // ECSタスク実行ロールにParameter Storeへのアクセス権限を付与
    taskExecutionRole.addToPolicy(
      new iam.PolicyStatement({
        effect: iam.Effect.ALLOW,
        actions: [
          'ssm:GetParameters',
          'ssm:GetParameter',
          'ssm:GetParametersByPath',
        ],
        resources: [
          nodeEnvParameter.parameterArn,
        ],
      })
    );
 
// ... 省略（前述のコード） ...
 
    // コンテナの追加（環境変数をParameter Storeから取得）
    const container = taskDefinition.addContainer('NextjsContainer', {
      image: ecs.ContainerImage.fromAsset('./nextjs-app', {}),
      logging: ecs.LogDrivers.awsLogs({
        streamPrefix: 'nextjs-app',
        logRetention: 7,
      }),
      secrets: {
        NODE_ENV: ecs.Secret.fromSsmParameter(nodeEnvParameter),
      },
    });
 
    // ... 省略（以降のコード） ...
  }
}

cdk synth --context env=dev --region us-east-1

[Error at /IacStack-dev/MyTaskDef/Resource] AwsSolutions-ECS2: The ECS Task Definition includes a container definition that directly specifies environment variables. Use secrets to inject environment variables during container startup from AWS Systems Manager Parameter Store or Secrets Manager instead of directly specifying plaintext environment variables. Updates to direct environment variables require operators to change task definitions and perform new deployments.

import { NagSuppressions } from 'cdk-nag';
 
export class CdkIacProjectStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CdkIacProjectStackProps) {
    super(scope, id, props);
 
    const envName = props.tags?.Environment || 'dev';
    const isProduction = envName === 'prod';
 
    // ... 省略（VPC、セキュリティグループ、ALB、ECS等のリソース定義） ...
 
    // VPC Flow Logの警告を抑制（開発環境では不要）
    NagSuppressions.addResourceSuppressions(vpc, [
      {
        id: 'AwsSolutions-VPC7',
        reason: 'VPC Flow Logs are not required for development environment',
      },
    ], true); // applyToChildrenをtrueにして、VPCの全リソースに適用
 
    // タスク実行ロールのAWS管理ポリシー使用の警告を抑制
    NagSuppressions.addResourceSuppressions(taskExecutionRole, [
      {
        id: 'AwsSolutions-IAM4',
        reason: 'AmazonECSTaskExecutionRolePolicy is AWS managed policy required for ECS task execution',
        appliesTo: ['Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'],
      },
    ]);
 
    // タスク実行ロールとタスクロールのワイルドカード権限の警告を抑制
    NagSuppressions.addResourceSuppressions(taskExecutionRole, [
      {
        id: 'AwsSolutions-IAM5',
        reason: 'ECR and CloudWatch Logs require wildcard permissions for resource access',
        appliesTo: ['Resource::*'],
      },
    ], true); // DefaultPolicyにも適用
 
    NagSuppressions.addResourceSuppressions(taskRole, [
      {
        id: 'AwsSolutions-IAM5',
        reason: 'Task role requires wildcard permissions for dynamic resource access',
        appliesTo: ['Resource::*'],
      },
    ], true); // DefaultPolicyにも適用
 
    // ALBセキュリティグループの0.0.0.0/0アクセス許可の警告を抑制
    NagSuppressions.addResourceSuppressions(albSecurityGroup, [
      {
        id: 'AwsSolutions-EC23',
        reason: 'ALB needs to accept traffic from the internet on ports 80 and 443',
      },
    ], true); // DefaultPolicyにも適用
 
    // ALBのアクセスログ無効化の警告を抑制
    NagSuppressions.addResourceSuppressions(alb, [
      {
        id: 'AwsSolutions-ELB2',
        reason: 'Access logs are not required for development environment',
      },
    ], true); // DefaultPolicyにも適用
 
    // ... 省略（以降のコード） ...
  }
}

#!/usr/bin/env node
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { CdkIacProjectStack } from '../lib/cdk-iac-project-stack';
import { AwsSolutionsChecks } from 'cdk-nag';
import { Aspects } from 'aws-cdk-lib';
 
const app = new cdk.App();
 
// cdk-nagのAWS Solutions Checksを追加
Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));
 
// アプリ全体に共通タグを付ける
cdk.Tags.of(app).add('Project', 'IaC-Learning');
cdk.Tags.of(app).add('ManagedBy', 'AWS-CDK');
cdk.Tags.of(app).add('CostCenter', 'Engineering');
 
// 省略
 

export class CdkIacProjectStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CdkIacProjectStackProps) {
    super(scope, id, props);
 
    const envName = props.tags?.Environment || 'dev';
 
    // VPCの作成（環境名を含める）
    const vpc = new ec2.Vpc(this, 'MyVpc', {
      vpcName: `iac-learning-vpc-${envName}`,
      maxAzs: 2,
      natGateways: 1,
      // ... 省略 ...
    });
 
    // ECSクラスターの作成（環境名を含める）
    const cluster = new ecs.Cluster(this, 'MyCluster', {
      vpc: vpc,
      clusterName: `iac-learning-cluster-${envName}`,
      containerInsightsV2: ecs.ContainerInsights.ENABLED,
    });
 
    // ECRリポジトリの作成（環境名は含めない、共通リポジトリとして使用）
    const repository = new ecr.Repository(this, 'MyRepository', {
      repositoryName: 'iac-learning-nextjs-app',
      // ... 省略 ...
    });
 
    // ALBの作成（環境名を含める）
    const alb = new elbv2.ApplicationLoadBalancer(this, 'MyAlb', {
      vpc: vpc,
      internetFacing: true,
      loadBalancerName: `iac-alb-${envName}`,
      securityGroup: albSecurityGroup,
      // ... 省略 ...
    });
 
    // ... 省略（以降のリソース定義） ...
  }
}

export class CdkIacProjectStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CdkIacProjectStackProps) {
    super(scope, id, props);
 
    const envName = props.tags?.Environment || 'dev';
    const isProduction = envName === 'prod';
 
    // ... 省略（前述のリソース定義） ...
 
    // ECRリポジトリの作成（本番環境では削除保護）
    const repository = new ecr.Repository(this, 'MyRepository', {
      repositoryName: 'iac-learning-nextjs-app',
      removalPolicy: isProduction ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
      emptyOnDelete: !isProduction,
      imageScanOnPush: true,
    });
 
    // ALBの削除保護（本番環境のみ）
    const alb = new elbv2.ApplicationLoadBalancer(this, 'MyAlb', {
      vpc: vpc,
      internetFacing: true,
      loadBalancerName: `iac-alb-${envName}`,
      securityGroup: albSecurityGroup,
      deletionProtection: isProduction, // 本番環境では削除保護を有効化
      // ... 省略 ...
    });
 
    // ... 省略（以降のリソース定義） ...
  }
}

export class CdkIacProjectStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CdkIacProjectStackProps) {
    super(scope, id, props);
 
    // ... 省略（前述のコード） ...
 
    // VPC IDをエクスポート
    new cdk.CfnOutput(this, 'VpcId', {
      value: vpc.vpcId,
      description: 'VPC ID',
      exportName: `IacStack-${envName}-VpcId`,
    });
 
    // ECSクラスター名をエクスポート
    new cdk.CfnOutput(this, 'ClusterName', {
      value: cluster.clusterName,
      description: 'ECS Cluster Name',
      exportName: `IacStack-${envName}-ClusterName`,
    });
 
    // ECSクラスターARNをエクスポート
    new cdk.CfnOutput(this, 'ClusterArn', {
      value: cluster.clusterArn,
      description: 'ECS Cluster ARN',
      exportName: `IacStack-${envName}-ClusterArn`,
    });
 
    // ALB DNSをエクスポート
    new cdk.CfnOutput(this, 'AlbDnsName', {
      value: alb.loadBalancerDnsName,
      description: 'ALB DNS Name',
      exportName: `IacStack-${envName}-AlbDnsName`,
    });
 
    // ALB ARNをエクスポート
    new cdk.CfnOutput(this, 'AlbArn', {
      value: alb.loadBalancerArn,
      description: 'ALB ARN',
      exportName: `IacStack-${envName}-AlbArn`,
    });
 
    // ターゲットグループARNをエクスポート
    new cdk.CfnOutput(this, 'TargetGroupArn', {
      value: targetGroup.targetGroupArn,
      description: 'Target Group ARN',
      exportName: `IacStack-${envName}-TargetGroupArn`,
    });
 
    // ECSサービス名をエクスポート
    new cdk.CfnOutput(this, 'ServiceName', {
      value: service.serviceName,
      description: 'ECS Service Name',
      exportName: `IacStack-${envName}-ServiceName`,
    });
  }
}

cdk deploy --context env=dev --region us-east-1

Outputs:
IacStack-dev.VpcId = vpc-0123456789abcdef0 (IacStack-dev-VpcId)
IacStack-dev.ClusterName = iac-learning-cluster-dev (IacStack-dev-ClusterName)
IacStack-dev.AlbDnsName = iac-alb-dev-XXXXXXXXXXXX.us-east-1.elb.amazonaws.com (IacStack-dev-AlbDnsName)
...