Skip to content

Commit 93c29ff

Browse files
Hirose-Sebastian-TaikaiHirose-Sebastian-Taikai
authored
Merge pull request #1 from cloudnative-co/deploy
Deploy
2 parents 2082d3d + 0aad2cb commit 93c29ff

12 files changed

Lines changed: 3275 additions & 8 deletions

‎.gitattributes‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# シェルスクリプトは常にLFを使用
2+
*.sh text eol=lf
3+
4+
# PowerShellスクリプトは常にCRLFを使用
5+
*.ps1 text eol=crlf
6+
7+
# その他のテキストファイル
8+
*.txt text eol=lf
9+
*.md text eol=lf
10+
*.yml text eol=lf
11+
*.yaml text eol=lf
12+
*.json text eol=lf
13+
*.py text eol=lf
14+
*.js text eol=lf
15+
*.ts text eol=lf
16+
*.html text eol=lf
17+
*.css text eol=lf
18+
*.xml text eol=lf
19+
20+
# バイナリファイル
21+
*.png binary
22+
*.jpg binary
23+
*.jpeg binary
24+
*.gif binary
25+
*.ico binary
26+
*.pdf binary
27+
*.zip binary
28+
*.tar binary
29+
*.gz binary
30+
*.exe binary
31+
*.dll binary
32+
*.so binary
33+
*.dylib binary

‎.github/workflows/deploy.yml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: Deploy to AWS CloudFormation
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- deploy
8+
9+
env:
10+
AWS_REGION: ap-northeast-1
11+
PROJECT_NAME: LambdaFramework
12+
13+
permissions:
14+
id-token: write
15+
contents: read
16+
17+
jobs:
18+
deploy:
19+
runs-on: ubuntu-latest
20+
21+
steps:
22+
- name: Checkout code
23+
uses: actions/checkout@v4
24+
25+
- name: Set up Python
26+
uses: actions/setup-python@v4
27+
with:
28+
python-version: '3.10'
29+
30+
- name: Install dependencies
31+
run: |
32+
python -m pip install --upgrade pip
33+
pip install -r requirements.txt
34+
35+
- name: Debug AWS Role ARN
36+
run: |
37+
echo "Current branch: ${{ github.ref }}"
38+
echo "Branch condition: ${{ github.ref == 'refs/heads/main' }}"
39+
echo "Using role ARN: ${{ github.ref == 'refs/heads/main' && secrets.AWS_ROLE_ARN_PROD || secrets.AWS_ROLE_ARN_DEV }}"
40+
echo "AWS_ROLE_ARN_DEV exists: ${{ secrets.AWS_ROLE_ARN_DEV != '' }}"
41+
echo "AWS_ROLE_ARN_PROD exists: ${{ secrets.AWS_ROLE_ARN_PROD != '' }}"
42+
echo "AWS_ROLE_ARN_DEV length: ${{ secrets.AWS_ROLE_ARN_DEV != '' && 'non-empty' || 'empty' }}"
43+
echo "AWS_ROLE_ARN_PROD length: ${{ secrets.AWS_ROLE_ARN_PROD != '' && 'non-empty' || 'empty' }}"
44+
45+
- name: Configure AWS credentials
46+
uses: aws-actions/configure-aws-credentials@v4
47+
with:
48+
role-to-assume: ${{ github.ref == 'refs/heads/main' && secrets.AWS_ROLE_ARN_PROD || secrets.AWS_ROLE_ARN_DEV }}
49+
aws-region: ${{ env.AWS_REGION }}
50+
51+
- name: Validate SAM template
52+
run: |
53+
# AWS認証情報の確認
54+
aws sts get-caller-identity
55+
echo "AWS Region: $AWS_REGION"
56+
sam validate
57+
env:
58+
AWS_REGION: ${{ env.AWS_REGION }}
59+
60+
- name: Deploy with SAM
61+
run: |
62+
STACK_NAME="LambdaFramework"
63+
# ブランチに基づいて環境設定を決定
64+
if [ "${{ github.ref }}" = "refs/heads/main" ]; then
65+
ENVIRONMENT="production"
66+
S3_BUCKET="${{ vars.S3_BUCKET_PROD }}"
67+
else
68+
ENVIRONMENT="development"
69+
S3_BUCKET="${{ vars.S3_BUCKET_DEV }}"
70+
fi
71+
72+
echo "Deploying to environment: $ENVIRONMENT"
73+
echo "Stack name: $STACK_NAME"
74+
echo "AWS Region: $AWS_REGION"
75+
echo "S3 Bucket: $S3_BUCKET"
76+
77+
sam build
78+
sam deploy --no-confirm-changeset --no-fail-on-empty-changeset \
79+
--stack-name $STACK_NAME \
80+
--s3-bucket $S3_BUCKET \
81+
--parameter-overrides ProjectName=${{ env.PROJECT_NAME }} Environment=$ENVIRONMENT
82+
env:
83+
AWS_REGION: ${{ env.AWS_REGION }}
84+
SAM_CLI_TELEMETRY: 0
85+
86+
- name: Deploy status
87+
if: always()
88+
run: |
89+
# ブランチに基づいて環境設定を決定
90+
if [ "${{ github.ref }}" = "refs/heads/main" ]; then
91+
STACK_NAME="lambda-framework-prod"
92+
ENVIRONMENT="production"
93+
else
94+
STACK_NAME="lambda-framework-dev"
95+
ENVIRONMENT="development"
96+
fi
97+
98+
echo "Deployment completed for branch: ${{ github.ref }}"
99+
echo "Stack name: $STACK_NAME"
100+
echo "Environment: $ENVIRONMENT"
101+
echo "Commit: ${{ github.sha }}"

‎.vscode/settings.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"cfn-lint.executablePath": "cfn-lint",
3+
"cfn-lint.enable": true,
4+
"yaml.validate": true,
5+
"yaml.schemas": {
6+
"https://raw.githubusercontent.com/aws/aws-sam-cli/master/samcli/local/schema/schema.json": "template.yaml"
7+
}
8+
}

‎GITHUB_SECRETS_SETUP.md‎

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
# GitHub Secrets Setup Guide
2+
3+
## 概要
4+
このドキュメントでは、GitHub ActionsでAWS CloudFormationにデプロイするために必要なGitHub SecretsとIAMロールの設定手順を説明します。
5+
6+
## 必要なGitHub Secrets
7+
8+
### 1. AWS_ROLE_ARN_DEV (開発環境用)
9+
- **説明**: 開発環境（deployブランチ）で使用するIAMロールのARN
10+
- **例**: `arn:aws:iam::123456789012:role/LambdaFramework-github-actions-role`
11+
12+
### 2. AWS_ROLE_ARN_PROD (本番環境用)
13+
- **説明**: 本番環境（mainブランチ）で使用するIAMロールのARN
14+
- **例**: `arn:aws:iam::123456789012:role/LambdaFramework-github-actions-role`
15+
16+
## IAMロールとOIDCプロバイダーの設定
17+
18+
### 1. OIDCプロバイダーの作成
19+
20+
#### 開発環境用AWSアカウント
21+
```bash
22+
# OIDCプロバイダーの作成
23+
aws iam create-open-id-connect-provider \
24+
--url https://token.actions.githubusercontent.com \
25+
--client-id-list sts.amazonaws.com \
26+
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
27+
28+
# 作成されたOIDCプロバイダーのARNを確認
29+
aws iam list-open-id-connect-providers
30+
```
31+
32+
#### 本番環境用AWSアカウント
33+
```bash
34+
# OIDCプロバイダーの作成
35+
aws iam create-open-id-connect-provider \
36+
--url https://token.actions.githubusercontent.com \
37+
--client-id-list sts.amazonaws.com \
38+
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
39+
40+
# 作成されたOIDCプロバイダーのARNを確認
41+
aws iam list-open-id-connect-providers
42+
```
43+
44+
### 2. IAMロールの作成
45+
46+
#### 開発環境用IAMロール
47+
```json
48+
{
49+
"Version": "2012-10-17",
50+
"Statement": [
51+
{
52+
"Effect": "Allow",
53+
"Principal": {
54+
"Federated": "arn:aws:iam::YOUR_DEV_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
55+
},
56+
"Action": "sts:AssumeRoleWithWebIdentity",
57+
"Condition": {
58+
"StringEquals": {
59+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
60+
"token.actions.githubusercontent.com:sub": "repo:cloudnative-co/python-lambda-frame:ref:refs/heads/deploy"
61+
}
62+
}
63+
}
64+
]
65+
}
66+
```
67+
68+
#### 本番環境用IAMロール
69+
```json
70+
{
71+
"Version": "2012-10-17",
72+
"Statement": [
73+
{
74+
"Effect": "Allow",
75+
"Principal": {
76+
"Federated": "arn:aws:iam::YOUR_PROD_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
77+
},
78+
"Action": "sts:AssumeRoleWithWebIdentity",
79+
"Condition": {
80+
"StringEquals": {
81+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
82+
"token.actions.githubusercontent.com:sub": "repo:cloudnative-co/python-lambda-frame:ref:refs/heads/main"
83+
}
84+
}
85+
}
86+
]
87+
}
88+
```
89+
90+
### 3. IAMポリシーの作成
91+
92+
#### 開発環境用IAMポリシー
93+
```json
94+
{
95+
"Version": "2012-10-17",
96+
"Statement": [
97+
{
98+
"Effect": "Allow",
99+
"Action": [
100+
"cloudformation:*",
101+
"s3:*",
102+
"lambda:*",
103+
"iam:*",
104+
"logs:*"
105+
],
106+
"Resource": "*"
107+
}
108+
]
109+
}
110+
```
111+
112+
#### 本番環境用IAMポリシー
113+
```json
114+
{
115+
"Version": "2012-10-17",
116+
"Statement": [
117+
{
118+
"Effect": "Allow",
119+
"Action": [
120+
"cloudformation:*",
121+
"s3:*",
122+
"lambda:*",
123+
"iam:*",
124+
"logs:*"
125+
],
126+
"Resource": "*"
127+
}
128+
]
129+
}
130+
```
131+
132+
## トラブルシューティング
133+
134+
### 1. "Request ARN is invalid" エラーの解決
135+
136+
#### A. OIDCプロバイダーの確認
137+
```bash
138+
# OIDCプロバイダーが存在するか確認
139+
aws iam list-open-id-connect-providers
140+
141+
# 特定のOIDCプロバイダーの詳細を確認
142+
aws iam get-open-id-connect-provider --open-id-connect-provider-arn arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com
143+
```
144+
145+
#### B. IAMロールの信頼関係の確認
146+
```bash
147+
# IAMロールの詳細を確認
148+
aws iam get-role --role-name LambdaFramework-github-actions-role
149+
150+
# 信頼関係（Trust Policy）を確認
151+
aws iam get-role-policy --role-name LambdaFramework-github-actions-role --policy-name trust-policy
152+
```
153+
154+
#### C. 正しいロールARNの確認
155+
```bash
156+
# 利用可能なIAMロールを一覧表示
157+
aws iam list-roles --query 'Roles[?contains(RoleName, `LambdaFramework`)].RoleName' --output table
158+
```
159+
160+
### 2. よくある問題と解決方法
161+
162+
#### A. OIDCプロバイダーが存在しない
163+
```bash
164+
# OIDCプロバイダーを作成
165+
aws iam create-open-id-connect-provider \
166+
--url https://token.actions.githubusercontent.com \
167+
--client-id-list sts.amazonaws.com \
168+
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
169+
```
170+
171+
#### B. 信頼関係が正しくない
172+
- IAMロールの信頼関係で、正しいOIDCプロバイダーARNを指定
173+
- 正しいリポジトリ名とブランチ名を指定
174+
175+
#### C. GitHub Secretsが設定されていない
176+
- GitHubリポジトリのSettings → Secrets and variables → Actions
177+
- `AWS_ROLE_ARN_DEV`と`AWS_ROLE_ARN_PROD`を設定
178+
179+
## 設定手順
180+
181+
### 1. AWS CLIでOIDCプロバイダーを作成
182+
```bash
183+
# 開発環境用
184+
aws iam create-open-id-connect-provider \
185+
--url https://token.actions.githubusercontent.com \
186+
--client-id-list sts.amazonaws.com \
187+
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
188+
189+
# 本番環境用
190+
aws iam create-open-id-connect-provider \
191+
--url https://token.actions.githubusercontent.com \
192+
--client-id-list sts.amazonaws.com \
193+
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
194+
```
195+
196+
### 2. IAMロールを作成
197+
```bash
198+
# 開発環境用ロール
199+
aws iam create-role --role-name LambdaFramework-github-actions-role --assume-role-policy-document file://trust-policy-dev.json
200+
201+
# 本番環境用ロール
202+
aws iam create-role --role-name LambdaFramework-github-actions-role --assume-role-policy-document file://trust-policy-prod.json
203+
```
204+
205+
### 3. IAMポリシーをアタッチ
206+
```bash
207+
# 開発環境用ポリシー
208+
aws iam put-role-policy --role-name LambdaFramework-github-actions-role --policy-name LambdaFramework-github-actions-policy --policy-document file://policy-dev.json
209+
210+
# 本番環境用ポリシー
211+
aws iam put-role-policy --role-name LambdaFramework-github-actions-role --policy-name LambdaFramework-github-actions-policy --policy-document file://policy-prod.json
212+
```
213+
214+
### 4. GitHub Secretsを設定
215+
1. GitHubリポジトリにアクセス
216+
2. Settings → Secrets and variables → Actions
217+
3. New repository secretをクリック
218+
4. `AWS_ROLE_ARN_DEV`と`AWS_ROLE_ARN_PROD`を設定
219+
220+
## デプロイ環境マッピング
221+
222+
| ブランチ | 環境 | AWSロール | GitHub Secret |
223+
|---------|------|-----------|---------------|
224+
| main | production | LambdaFramework-github-actions-role | AWS_ROLE_ARN_PROD |
225+
| deploy | development | LambdaFramework-github-actions-role | AWS_ROLE_ARN_DEV |
226+
227+
## ローカルデプロイコマンド
228+
229+
### 開発環境
230+
```bash
231+
./deploy-env.sh development
232+
```
233+
234+
### 本番環境
235+
```bash
236+
./deploy-env.sh production
237+
```
238+
239+
### PowerShell版
240+
```powershell
241+
.\deploy-env.ps1 development
242+
.\deploy-env.ps1 production
243+
```

0 commit comments

Comments
 (0)