TerraformでAWS S3バケットを作成・削除する

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

flowchart LR
    subgraph Local[ローカル環境]
        Config[Terraform設定ファイル<br/>main.tf]
        CLI[Terraform CLI<br/>plan / apply / destroy]
        State[Terraform state<br/>terraform.tfstate]
        AWSCLI[AWS CLI<br/>SSO login]
    end

    subgraph AWS[AWSアカウント]
        IDC[IAM Identity Center<br/>ユーザー / Permission set]
        API[AWS API]
        S3[S3バケット]
    end

    Config -->|読み込み| CLI
    CLI <-->|現在の状態を記録・参照| State
    AWSCLI -->|SSO認証| IDC
    IDC -->|一時認証情報| CLI
    CLI -->|AWS Provider経由でAPIを呼び出す| API
    API -->|作成・変更・削除| S3

    CLI -.->|plan：差分を確認| API
    CLI -.->|apply：差分を反映| API
    CLI -.->|destroy：管理対象を削除| API

1

aws-cli/2.33.17 Python/3.13.11 Darwin/25.5.0 exe/arm64

1

eval "$(/opt/homebrew/bin/brew shellenv)"

1

echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> "$HOME/.zprofile"

1
2
3

arch
which brew
brew --prefix

1
2
3

arm64
/opt/homebrew/bin/brew
/opt/homebrew

1
2
3

brew update
brew tap hashicorp/tap
brew install hashicorp/tap/terraform

1

terraform version

1
2

Terraform v1.16.3
on darwin_arm64

1

Your Command Line Tools are too outdated.

1
2

sudo rm -rf /Library/Developer/CommandLineTools
xcode-select --install

1

brew install awscli

1

aws --version

1

aws-cli/2.x Python/3.x Darwin/xx.x exe/arm64

1

aws sts get-caller-identity

1
2

echo "$AWS_PROFILE"
aws sts get-caller-identity

1

terraform plan -destroy

1

terraform destroy

1
2

AWS_PROFILE=YOUR_PROFILE_NAME terraform plan -destroy
AWS_PROFILE=YOUR_PROFILE_NAME terraform destroy

1
2
3

Error: Duplicate required providers configuration
Error: Duplicate provider configuration
Error: Duplicate resource configuration

1
2

main.tf
bk_main.tf

1

mv bk_main.tf bk_main.tf.bak

1
2
3

terraform validate
terraform plan -destroy
terraform destroy

1

export AWS_PROFILE=YOUR_PROFILE_NAME

1
2
3
4

s3-security-lab/
├ main.tf
├ outputs.tf
└ variables.tf

1
2

cd s3-security-lab
terraform plan

1
2
3

main.tf
outputs.tf
variables.tf

1

terraform plan

1
2
3
4

main.tf
s3.tf
provider.tf
banana.tf

1
2
3
4
5

terraform.tf   # TerraformとProviderのバージョン
provider.tf    # AWS Providerの設定
main.tf        # 中心となるリソース
variables.tf   # 入力値
outputs.tf     # 実行後に表示する値

1
2
3
4
5
6
7
8
9

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
  }
}

1

required_version = ">= 1.5.0"

1
2
3
4
5

required_providers {
  aws = {
    source = "hashicorp/aws"
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

provider "aws" {
  region = "ap-northeast-1"

  default_tags {
    tags = {
      Project   = "s3-security-lab"
      ManagedBy = "Terraform"
    }
  }
}

1

region = "ap-northeast-1"

1
2

Project   = s3-security-lab
ManagedBy = Terraform

1

export AWS_PROFILE=YOUR_PROFILE_NAME

1
2
3

resource "aws_s3_bucket" "lab" {
  bucket_prefix = "makiharu-s3-security-lab-"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

resource
└ AWS上のリソースを管理する宣言

aws_s3_bucket
└ 作成するAWSリソースの種類

lab
└ Terraform内部で使う名前

bucket_prefix
└ 実際のS3バケット名の接頭辞

1

aws_s3_bucket.lab.id

1

makiharu-s3-security-lab-abc123xyz

1
2
3
4
5
6
7
8

resource "aws_s3_bucket_public_access_block" "lab" {
  bucket = aws_s3_bucket.lab.id

  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

1

bucket = aws_s3_bucket.lab.id

1
2
3

S3バケットを作る
        ↓
そのバケットにPublic Access Blockを設定する

1
2
3
4

output "bucket_name" {
  description = "Terraformで作成したS3バケット名"
  value       = aws_s3_bucket.lab.bucket
}

1

terraform apply

1
2
3

Outputs:

bucket_name = "makiharu-s3-security-lab-abc123xyz"

1

terraform output bucket_name

1
2
3
4
5
6
7
8

main.tfを保存
→ AWSには何も起きない

terraform plan
→ 変更予定を計算するだけ

terraform apply
→ AWS APIを呼び出して実際に作成する

1
2
3
4
5
6
7

main.tf
  ↓ 読み込み
Terraform
  ↓ AWS Provider
AWS API
  ↓
S3バケット作成

1
2
3
4

s3-security-lab/  ← ルートモジュール
├ main.tf
├ variables.tf
└ outputs.tf

1
2

cd s3-security-lab
terraform plan

1
2
3
4
5

Terraform本体
「設定を読み、差分を計算する仕組み」

AWS Provider
「S3やEC2をAWS APIで操作する仕組み」

1
2
3
4
5
6
7
8
9

main.tf
  ↓ 読み込む
Terraform本体
  ↓ AWS Providerへ指示
AWS Provider
  ↓ AWS APIを呼び出す
AWS
  ↓
S3バケット作成

1
2
3
4
5
6
7

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
  }
}

1

terraform init

1
2
3
4
5
6
7
8

s3-security-lab/
├ .terraform/
│  └ providers/
│     └ registry.terraform.io/
│        └ hashicorp/
│           └ aws/
├ .terraform.lock.hcl
└ main.tf

1
2
3

resource "aws_s3_bucket" "lab" {
  bucket_prefix = "makiharu-s3-security-lab-"
}

1
2
3
4
5
6
7
8

provider "registry.terraform.io/hashicorp/aws" {
  version = "6.x.x"

  hashes = [
    "h1:...",
    "zh:..."
  ]
}

1

version = "~> 6.0"

1
2
3
4
5

main.tf
「6系を使用してよい」

.terraform.lock.hcl
「今回は具体的に6.x.xを使用した」

1
2
3
4
5
6
7
8
9

terraform init
→ AWS Providerを用意する
→ S3はまだ作られない

terraform plan
→ AWSの現在状態とコードを比較する

terraform apply
→ ProviderがAWS APIを呼び、S3を作る

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

terraform init
Initializing the backend...

Initializing provider plugins...
- Finding latest version of hashicorp/aws...
- Installing hashicorp/aws v6.65.0...
- Installed hashicorp/aws v6.65.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

1
2
3
4
5
6
7
8

s3-security-lab/
├ .terraform/
│  └ providers/
│     └ registry.terraform.io/
│        └ hashicorp/
│           └ aws/
├ .terraform.lock.hcl
└ main.tf

1
2

terraform plan
terraform apply

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

YOUR_USER@YOUR_HOST s3-security-lab % AWS_PROFILE=YOUR_PROFILE_NAME terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_s3_bucket.lab will be created
  + resource "aws_s3_bucket" "lab" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = (known after apply)
      + bucket_domain_name          = (known after apply)
      + bucket_namespace            = (known after apply)
      + bucket_prefix               = "makiharu-s3-security-lab-"
      + bucket_region               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = "ap-northeast-1"
      + request_payer               = (known after apply)
      + tags_all                    = {
          + "ManagedBy" = "Terraform"
          + "Project"   = "s3-security-lab"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket_public_access_block.lab will be created
  + resource "aws_s3_bucket_public_access_block" "lab" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + region                  = "ap-northeast-1"
      + restrict_public_buckets = true
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + bucket_name = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_s3_bucket.lab: Creating...
aws_s3_bucket.lab: Creation complete after 1s [id=makiharu-s3-security-lab-c4fe4545a78e64ed34b2027d4c]
aws_s3_bucket_public_access_block.lab: Creating...
aws_s3_bucket_public_access_block.lab: Creation complete after 0s [id=makiharu-s3-security-lab-c4fe4545a78e64ed34b2027d4c]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

bucket_name = "makiharu-s3-security-lab-c4fe4545a78e64ed34b2027d4c"

1

terraform destroy

1

terraform state list

1
2
3

resource "aws_s3_bucket" "lab" {
  bucket_prefix = "makiharu-s3-security-lab-"
}