services:
  terraform:
    image: hashicorp/terraform:1.6.2
    volumes:
      - ./setup:/tf/setup
      - ./deploy:/tf/deploy
    working_dir: /tf
    environment:
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
      - AWS_DEFAULT_REGION=ap-northeast-1
      - TF_WORKSPACE=${TF_WORKSPACE}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.23.0"
    }
  }

  backend "s3" {
    bucket         = "devops-practice-terraform-state-2503"
    key            = "tf-state-setup"
    region         = "ap-northeast-1"
    encrypt        = true
    dynamodb_table = "devops-practice-terraform-lock"
  }
}

provider "aws" {
  region = "ap-northeast-1"

  default_tags {
    tags = {
      Environment = terraform.workspace
      Project     = var.project
      Contact     = var.contact
      ManageBy    = "Terraform/setup"
    }
  }
}

variable "tf_state_bucket" {
  description = "Name of S3 bucket in AWS for storing TF state"
  default     = "devops-practice-terraform-state-2503"
}

variable "tf_state_lock_table" {
  description = "Name of DynamoDB table for TF state locking"
  default     = "devops-practice-terraform-lock"
}

variable "project" {
  description = "Project name for tagging resources"
  default     = "devops-practice-terraform"
}

variable "contact" {
  description = "Contact name for tagging resources"
  default     = "xxx"
}

% docker compose run --rm terraform -chdir=setup init
WARN[0000] The "TF_WORKSPACE" variable is not set. Defaulting to a blank string.

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding hashicorp/aws versions matching "5.23.0"...
- Installing hashicorp/aws v5.23.0...
- Installed hashicorp/aws v5.23.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

required_providers {
  aws = {
    source  = "hashicorp/aws"
    version = "5.23.0"
  }
}

backend "s3" {
  bucket         = "DevOps-Recipe-App-TF-State"
  key            = "tfstate-setup"
  region         = "us-east-1"
  encrypt        = true
  dynamodb_table = "DevOps-Recipe-App-API-TF-Lock"
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = {
      environment = terraform.workspace
      project     = var.project
      contact     = var.contact
      managed_by  = "terraform/setup"
    }
  }

#######################################################################
# Create IAM user and policies for Continuous Deployment (CD) account #
#######################################################################

resource "aws_iam_user" "cd" {
  name = "app-api-cd"
}

resource "aws_iam_access_key" "cd" {
  user = aws_iam_user.cd.name
}

#########################################################
# Policy for Teraform backend to S3 and DynamoDB access #
#########################################################

data "aws_iam_policy_document" "tf_backend" {
  statement {
    effect    = "Allow"
    actions   = ["s3:ListBucket"]
    resources = ["arn:aws:s3:::${var.tf_state_bucket}"]
  }

  statement {
    effect  = "Allow"
    actions = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
    resources = [
      "arn:aws:s3:::${var.tf_state_bucket}/tf-state-deploy/*",
      "arn:aws:s3:::${var.tf_state_bucket}/tf-state-deploy-env/*"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:DeleteItem"
    ]
    resources = ["arn:aws:dynamodb:*:*:table/${var.tf_state_lock_table}"]
  }
}


resource "aws_iam_policy" "tf_backend" {
  name        = "${aws_iam_user.cd.name}-tf-s3-dynamodb"
  description = "Allow user to use S3 and DynamoDB for TF backend resources"
  policy      = data.aws_iam_policy_document.tf_backend.json
}

resource "aws_iam_user_policy_attachment" "tf_backend" {
  user       = aws_iam_user.cd.name
  policy_arn = aws_iam_policy.tf_backend.arn
}

resource "aws_iam_user" "cd" {
  name = "app-api-cd"
}

resource "aws_iam_access_key" "cd" {
  user = aws_iam_user.cd.name
}

data "aws_iam_policy_document" "tf_backend" {

statement {
  effect    = "Allow"
  actions   = ["s3:ListBucket"]
  resources = ["arn:aws:s3:::${var.tf_state_bucket}"]
}

statement {
  effect  = "Allow"
  actions = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
  resources = [
    "arn:aws:s3:::${var.tf_state_bucket}/tf-state-deploy/*",
    "arn:aws:s3:::${var.tf_state_bucket}/tf-state-deploy-env/*"
  ]
}

statement {
  effect = "Allow"
  actions = [
    "dynamodb:DescribeTable",
    "dynamodb:GetItem",
    "dynamodb:PutItem",
    "dynamodb:DeleteItem"
  ]
  resources = ["arn:aws:dynamodb:*:*:table/${var.tf_state_lock_table}"]
}

resource "aws_iam_policy" "tf_backend" {
  name        = "${aws_iam_user.cd.name}-tf-s3-dynamodb"
  description = "Allow user to use S3 and DynamoDB for TF backend resources"
  policy      = data.aws_iam_policy_document.tf_backend.json
}

resource "aws_iam_user_policy_attachment" "tf_backend" {
  user       = aws_iam_user.cd.name
  policy_arn = aws_iam_policy.tf_backend.arn
}

resource "aws_iam_user" "cd" {
  name = "app-api-cd"
}

resource "aws_iam_access_key" "cd" {
  user = aws_iam_user.cd.name
}

data "aws_iam_policy_document" "tf_backend" {
  ...
}

actions   = ["s3:ListBucket"]
resources = ["arn:aws:s3:::${var.tf_state_bucket}"]

actions = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
resources = [
  "arn:aws:s3:::${var.tf_state_bucket}/tf-state-deploy/*",
  "arn:aws:s3:::${var.tf_state_bucket}/tf-state-deploy-env/*"
]

actions = [
  "dynamodb:DescribeTable",
  "dynamodb:GetItem",
  "dynamodb:PutItem",
  "dynamodb:DeleteItem"
]
resources = ["arn:aws:dynamodb:*:*:table/${var.tf_state_lock_table}"]

resource "aws_iam_policy" "tf_backend" {
  name        = "${aws_iam_user.cd.name}-tf-s3-dynamodb"
  ...
}

resource "aws_iam_user_policy_attachment" "tf_backend" {
  user       = aws_iam_user.cd.name
  policy_arn = aws_iam_policy.tf_backend.arn
}

resource "<プロバイダ名>_<リソース種別>" "<ローカル名>" {
  ...
}

resource "aws_iam_policy" "my_rule" {
  ...
}

resource "aws_iam_policy_my_rule" "cd" {
  ...
}

resource "aws_iam_policy" "tf_backend" {

resource "aws_iam_policy" "main_policy_for_ci_user" {

% docker compose run --rm terraform -chdir=setup apply
WARN[0000] The "TF_WORKSPACE" variable is not set. Defaulting to a blank string.
data.aws_iam_policy_document.tf_backend: Reading...
data.aws_iam_policy_document.tf_backend: Read complete after 0s [id=3858198220]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # aws_iam_access_key.cd will be created
  + resource "aws_iam_access_key" "cd" {
      + create_date                    = (known after apply)
      + encrypted_secret               = (known after apply)
      + encrypted_ses_smtp_password_v4 = (known after apply)
      + id                             = (known after apply)
      + key_fingerprint                = (known after apply)
      + secret                         = (sensitive value)
      + ses_smtp_password_v4           = (sensitive value)
      + status                         = "Active"
      + user                           = "app-api-cd"
    }

  # aws_iam_policy.tf_backend will be created
  + resource "aws_iam_policy" "tf_backend" {
      + arn         = (known after apply)
      + description = "Allow user to use S3 and DynamoDB for TF backend resources"
      + id          = (known after apply)
      + name        = "app-api-cd-tf-s3-dynamodb"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = "s3:ListBucket"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::devops-practice-terraform-state-2503"
                    },
                  + {
                      + Action   = [
                          + "s3:PutObject",
                          + "s3:GetObject",
                          + "s3:DeleteObject",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::devops-practice-terraform-state-2503/tf-state-deploy/*",
                          + "arn:aws:s3:::devops-practice-terraform-state-2503/tf-state-deploy-env/*",
                        ]
                    },
                  + {
                      + Action   = [
                          + "dynamodb:PutItem",
                          + "dynamodb:GetItem",
                          + "dynamodb:DescribeTable",
                          + "dynamodb:DeleteItem",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:dynamodb:*:*:table/devops-practice-terraform-lock"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = {
          + "Contact"     = "xxx@gmail.com"
          + "Environment" = "default"
          + "ManageBy"    = "Terraform/setup"
          + "Project"     = "devops-practice-terraform"
        }
    }

  # aws_iam_user.cd will be created
  + resource "aws_iam_user" "cd" {
      + arn           = (known after apply)
      + force_destroy = false
      + id            = (known after apply)
      + name          = "app-api-cd"
      + path          = "/"
      + tags_all      = {
          + "Contact"     = "xxx@gmail.com"
          + "Environment" = "default"
          + "ManageBy"    = "Terraform/setup"
          + "Project"     = "devops-practice-terraform"
        }
      + unique_id     = (known after apply)
    }

  # aws_iam_user_policy_attachment.tf_backend will be created
  + resource "aws_iam_user_policy_attachment" "tf_backend" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + user       = "app-api-cd"
    }

Plan: 4 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + cd_user_access_key_id     = (known after apply)
  + cd_user_access_key_secret = (sensitive value)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_iam_user.cd: Creating...
aws_iam_user.cd: Creation complete after 1s [id=app-api-cd]
aws_iam_access_key.cd: Creating...
aws_iam_policy.tf_backend: Creating...
aws_iam_access_key.cd: Creation complete after 0s [id=xxx]
aws_iam_policy.tf_backend: Creation complete after 1s [id=arn:aws:iam::xxx:policy/app-api-cd-tf-s3-dynamodb]
aws_iam_user_policy_attachment.tf_backend: Creating...
aws_iam_user_policy_attachment.tf_backend: Creation complete after 0s [id=app-api-cd-20250327013316978000000001]

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Outputs:

cd_user_access_key_id = "xxx"
cd_user_access_key_secret = <sensitive>
 %

# main.tf
provider "aws" {
  region = "ap-northeast-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "my-example-bucket"
}

# backend.tf
terraform {
  backend "s3" {
    bucket = "my-terraform-state-bucket"
    key    = "env/dev/terraform.tfstate"
    region = "ap-northeast-1"
  }
}

Initializing the backend...
Do you want to copy existing state to the new backend?

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  dynamic "route" {
    for_each = var.enable_nat_gateway ? [1] : []
    content {
      cidr_block     = "0.0.0.0/0"
      nat_gateway_id = aws_nat_gateway.main[0].id
    }
  }

  tags = {
    Name        = "${var.project}-private-rt"
    Environment = var.environment
  }
}

for_each = var.enable_nat_gateway ? [1] : []

route {
  cidr_block     = "0.0.0.0/0"
  nat_gateway_id = aws_nat_gateway.main[0].id
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  dynamic "route" {
    for_each = var.enable_nat_gateway ? [1] : []
    content {
      cidr_block     = "0.0.0.0/0"
      nat_gateway_id = aws_nat_gateway.main[0].id
    }
  }

  tags = {
    Name        = "${var.project}-private-rt"
    Environment = var.environment
  }
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name        = "${var.project}-private-rt"
    Environment = var.environment
  }
}

resource "aws_route" "private_nat" {
  count = var.enable_nat_gateway ? 1 : 0

  route_table_id         = aws_route_table.private.id
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.main[0].id
}

resource "aws_route_table" "example" {
  vpc_id = "vpc-123456"

  dynamic "route" {
    for_each = [1]
    content {
      cidr_block = "0.0.0.0/0"
      gateway_id = "igw-123456"
    }
  }
}

resource "aws_route_table" "example" {
  vpc_id = "vpc-123456"

  dynamic "foo" {
    for_each = [1]
    content {
      cidr_block = "0.0.0.0/0"
      gateway_id = "igw-123456"
    }
  }
}

output "nat_gateway_id" {
  description = "NAT Gateway ID"
  # NAT Gatewayは条件付きで作成されるため、存在しない場合はnullを返す
  value       = var.enable_nat_gateway ? aws_nat_gateway.main[0].id : null
}

aws_nat_gateway.main[0].id

resource "aws_nat_gateway" "main" {
  count = var.enable_nat_gateway ? 1 : 0
  ...
}

resource "aws_nat_gateway" "main" {
  allocation_id = ...
  subnet_id     = ...
}
# アクセス方法：
aws_nat_gateway.main.id

resource "aws_nat_gateway" "main" {
  count = 1
  allocation_id = ...
  subnet_id     = ...
}
# アクセス方法：
aws_nat_gateway.main[0].id

resource "aws_nat_gateway" "main" {
  for_each = var.enable_nat_gateway ? { "main" = 1 } : {}

  allocation_id = aws_eip.nat[each.key].id
  subnet_id     = aws_subnet.public[0].id
}

aws_nat_gateway.main["main"].id

# ❌ エラーになる
output "nat_id" {
  value = aws_nat_gateway.main.id
}

│ The given "count" argument references the index of a list of resources. To reference individual resources use: aws_nat_gateway.main[0]