Deploy

.gitattributes

@@ -0,0 +1,33 @@
+# シェルスクリプトは常にLFを使用
+*.sh text eol=lf
+
+# PowerShellスクリプトは常にCRLFを使用
+*.ps1 text eol=crlf
+
+# その他のテキストファイル
+*.txt text eol=lf
+*.md text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.json text eol=lf
+*.py text eol=lf
+*.js text eol=lf
+*.ts text eol=lf
+*.html text eol=lf
+*.css text eol=lf
+*.xml text eol=lf
+
+# バイナリファイル
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.pdf binary
+*.zip binary
+*.tar binary
+*.gz binary
+*.exe binary
+*.dll binary
+*.so binary
+*.dylib binary 

.github/workflows/deploy.yml

@@ -0,0 +1,101 @@
+name: Deploy to AWS CloudFormation
+
+on:
+  push:
+    branches:
+      - main
+      - deploy
+
+env:
+  AWS_REGION: ap-northeast-1
+  PROJECT_NAME: LambdaFramework
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.10'
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt
+
+    - name: Debug AWS Role ARN
+      run: |
+        echo "Current branch: ${{ github.ref }}"
+        echo "Branch condition: ${{ github.ref == 'refs/heads/main' }}"
+        echo "Using role ARN: ${{ github.ref == 'refs/heads/main' && secrets.AWS_ROLE_ARN_PROD || secrets.AWS_ROLE_ARN_DEV }}"
+        echo "AWS_ROLE_ARN_DEV exists: ${{ secrets.AWS_ROLE_ARN_DEV != '' }}"
+        echo "AWS_ROLE_ARN_PROD exists: ${{ secrets.AWS_ROLE_ARN_PROD != '' }}"
+        echo "AWS_ROLE_ARN_DEV length: ${{ secrets.AWS_ROLE_ARN_DEV != '' && 'non-empty' || 'empty' }}"
+        echo "AWS_ROLE_ARN_PROD length: ${{ secrets.AWS_ROLE_ARN_PROD != '' && 'non-empty' || 'empty' }}"
+
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ github.ref == 'refs/heads/main' && secrets.AWS_ROLE_ARN_PROD || secrets.AWS_ROLE_ARN_DEV }}
+        aws-region: ${{ env.AWS_REGION }}
+
+    - name: Validate SAM template
+      run: |
+        # AWS認証情報の確認
+        aws sts get-caller-identity
+        echo "AWS Region: $AWS_REGION"
+        sam validate
+      env:
+        AWS_REGION: ${{ env.AWS_REGION }}
+
+    - name: Deploy with SAM
+      run: |
+        STACK_NAME="LambdaFramework"
+        # ブランチに基づいて環境設定を決定
+        if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          ENVIRONMENT="production"
+          S3_BUCKET="${{ vars.S3_BUCKET_PROD }}"
+        else
+          ENVIRONMENT="development"
+          S3_BUCKET="${{ vars.S3_BUCKET_DEV }}"
+        fi
+
+        echo "Deploying to environment: $ENVIRONMENT"
+        echo "Stack name: $STACK_NAME"
+        echo "AWS Region: $AWS_REGION"
+        echo "S3 Bucket: $S3_BUCKET"
+
+        sam build
+        sam deploy --no-confirm-changeset --no-fail-on-empty-changeset \
+          --stack-name $STACK_NAME \
+          --s3-bucket $S3_BUCKET \
+          --parameter-overrides ProjectName=${{ env.PROJECT_NAME }} Environment=$ENVIRONMENT
+      env:
+        AWS_REGION: ${{ env.AWS_REGION }}
+        SAM_CLI_TELEMETRY: 0
+
+    - name: Deploy status
+      if: always()
+      run: |
+        # ブランチに基づいて環境設定を決定
+        if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          STACK_NAME="lambda-framework-prod"
+          ENVIRONMENT="production"
+        else
+          STACK_NAME="lambda-framework-dev"
+          ENVIRONMENT="development"
+        fi
+
+        echo "Deployment completed for branch: ${{ github.ref }}"
+        echo "Stack name: $STACK_NAME"
+        echo "Environment: $ENVIRONMENT"
+        echo "Commit: ${{ github.sha }}" 

.vscode/settings.json

@@ -0,0 +1,8 @@
+{
+    "cfn-lint.executablePath": "cfn-lint",
+    "cfn-lint.enable": true,
+    "yaml.validate": true,
+    "yaml.schemas": {
+        "https://raw.githubusercontent.com/aws/aws-sam-cli/master/samcli/local/schema/schema.json": "template.yaml"
+    }
+} 

GITHUB_SECRETS_SETUP.md

@@ -0,0 +1,243 @@
+# GitHub Secrets Setup Guide
+
+## 概要
+このドキュメントでは、GitHub ActionsでAWS CloudFormationにデプロイするために必要なGitHub SecretsとIAMロールの設定手順を説明します。
+
+## 必要なGitHub Secrets
+
+### 1. AWS_ROLE_ARN_DEV (開発環境用)
+- **説明**: 開発環境（deployブランチ）で使用するIAMロールのARN
+- **例**: `arn:aws:iam::123456789012:role/LambdaFramework-github-actions-role`
+
+### 2. AWS_ROLE_ARN_PROD (本番環境用)
+- **説明**: 本番環境（mainブランチ）で使用するIAMロールのARN
+- **例**: `arn:aws:iam::123456789012:role/LambdaFramework-github-actions-role`
+
+## IAMロールとOIDCプロバイダーの設定
+
+### 1. OIDCプロバイダーの作成
+
+#### 開発環境用AWSアカウント
+```bash
+# OIDCプロバイダーの作成
+aws iam create-open-id-connect-provider \
+  --url https://token.actions.githubusercontent.com \
+  --client-id-list sts.amazonaws.com \
+  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
+
+# 作成されたOIDCプロバイダーのARNを確認
+aws iam list-open-id-connect-providers
+```
+
+#### 本番環境用AWSアカウント
+```bash
+# OIDCプロバイダーの作成
+aws iam create-open-id-connect-provider \
+  --url https://token.actions.githubusercontent.com \
+  --client-id-list sts.amazonaws.com \
+  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
+
+# 作成されたOIDCプロバイダーのARNを確認
+aws iam list-open-id-connect-providers
+```
+
+### 2. IAMロールの作成
+
+#### 開発環境用IAMロール
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Federated": "arn:aws:iam::YOUR_DEV_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
+      },
+      "Action": "sts:AssumeRoleWithWebIdentity",
+      "Condition": {
+        "StringEquals": {
+          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+          "token.actions.githubusercontent.com:sub": "repo:cloudnative-co/python-lambda-frame:ref:refs/heads/deploy"
+        }
+      }
+    }
+  ]
+}
+```
+
+#### 本番環境用IAMロール
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Federated": "arn:aws:iam::YOUR_PROD_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
+      },
+      "Action": "sts:AssumeRoleWithWebIdentity",
+      "Condition": {
+        "StringEquals": {
+          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+          "token.actions.githubusercontent.com:sub": "repo:cloudnative-co/python-lambda-frame:ref:refs/heads/main"
+        }
+      }
+    }
+  ]
+}
+```
+
+### 3. IAMポリシーの作成
+
+#### 開発環境用IAMポリシー
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:*",
+        "s3:*",
+        "lambda:*",
+        "iam:*",
+        "logs:*"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+#### 本番環境用IAMポリシー
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:*",
+        "s3:*",
+        "lambda:*",
+        "iam:*",
+        "logs:*"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+## トラブルシューティング
+
+### 1. "Request ARN is invalid" エラーの解決
+
+#### A. OIDCプロバイダーの確認
+```bash
+# OIDCプロバイダーが存在するか確認
+aws iam list-open-id-connect-providers
+
+# 特定のOIDCプロバイダーの詳細を確認
+aws iam get-open-id-connect-provider --open-id-connect-provider-arn arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com
+```
+
+#### B. IAMロールの信頼関係の確認
+```bash
+# IAMロールの詳細を確認
+aws iam get-role --role-name LambdaFramework-github-actions-role
+
+# 信頼関係（Trust Policy）を確認
+aws iam get-role-policy --role-name LambdaFramework-github-actions-role --policy-name trust-policy
+```
+
+#### C. 正しいロールARNの確認
+```bash
+# 利用可能なIAMロールを一覧表示
+aws iam list-roles --query 'Roles[?contains(RoleName, `LambdaFramework`)].RoleName' --output table
+```
+
+### 2. よくある問題と解決方法
+
+#### A. OIDCプロバイダーが存在しない
+```bash
+# OIDCプロバイダーを作成
+aws iam create-open-id-connect-provider \
+  --url https://token.actions.githubusercontent.com \
+  --client-id-list sts.amazonaws.com \
+  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
+```
+
+#### B. 信頼関係が正しくない
+- IAMロールの信頼関係で、正しいOIDCプロバイダーARNを指定
+- 正しいリポジトリ名とブランチ名を指定
+
+#### C. GitHub Secretsが設定されていない
+- GitHubリポジトリのSettings → Secrets and variables → Actions
+- `AWS_ROLE_ARN_DEV`と`AWS_ROLE_ARN_PROD`を設定
+
+## 設定手順
+
+### 1. AWS CLIでOIDCプロバイダーを作成
+```bash
+# 開発環境用
+aws iam create-open-id-connect-provider \
+  --url https://token.actions.githubusercontent.com \
+  --client-id-list sts.amazonaws.com \
+  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
+
+# 本番環境用
+aws iam create-open-id-connect-provider \
+  --url https://token.actions.githubusercontent.com \
+  --client-id-list sts.amazonaws.com \
+  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
+```
+
+### 2. IAMロールを作成
+```bash
+# 開発環境用ロール
+aws iam create-role --role-name LambdaFramework-github-actions-role --assume-role-policy-document file://trust-policy-dev.json
+
+# 本番環境用ロール
+aws iam create-role --role-name LambdaFramework-github-actions-role --assume-role-policy-document file://trust-policy-prod.json
+```
+
+### 3. IAMポリシーをアタッチ
+```bash
+# 開発環境用ポリシー
+aws iam put-role-policy --role-name LambdaFramework-github-actions-role --policy-name LambdaFramework-github-actions-policy --policy-document file://policy-dev.json
+
+# 本番環境用ポリシー
+aws iam put-role-policy --role-name LambdaFramework-github-actions-role --policy-name LambdaFramework-github-actions-policy --policy-document file://policy-prod.json
+```
+
+### 4. GitHub Secretsを設定
+1. GitHubリポジトリにアクセス
+2. Settings → Secrets and variables → Actions
+3. New repository secretをクリック
+4. `AWS_ROLE_ARN_DEV`と`AWS_ROLE_ARN_PROD`を設定
+
+## デプロイ環境マッピング
+
+| ブランチ | 環境 | AWSロール | GitHub Secret |
+|---------|------|-----------|---------------|
+| main | production | LambdaFramework-github-actions-role | AWS_ROLE_ARN_PROD |
+| deploy | development | LambdaFramework-github-actions-role | AWS_ROLE_ARN_DEV |
+
+## ローカルデプロイコマンド
+
+### 開発環境
+```bash
+./deploy-env.sh development
+```
+
+### 本番環境
+```bash
+./deploy-env.sh production
+```
+
+### PowerShell版
+```powershell
+.\deploy-env.ps1 development
+.\deploy-env.ps1 production
+```