【CI/CD編】プロフィールサイトAWS移行メモ 〜インフラ初心者を添えて〜

My_profile-cdk/
...
├── lib/
│   ...
│   └── stacks/
│   │   ...
│   │   └── cicd-oidc-role-stack.ts
│   ...
├── parameters/
│   ...
│   └── oidc-parameter.ts
...

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as iam from "aws-cdk-lib/aws-iam";
import { CicdOidcRoleStackProperty } from "@/parameters/oidc-parameter";
 
export interface CicdOidcRoleStackProps
  extends cdk.StackProps,
    Omit<CicdOidcRoleStackProperty, "env"> {
  bucketName: string;
  distributionId: string;
}
 
export class CicdOidcRoleStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CicdOidcRoleStackProps) {
    super(scope, id, props);
 
    const branch = props.props.gitHub.branch ?? "main"; // 未指定なら main 限定
 
    // GitHub OIDC Provider（既存再利用 or 新規作成）
    const provider = props.props.useExistingProviderArn
      ? iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
          this,
          "GithubOidcProviderImported",
          props.props.useExistingProviderArn
        )
      : new iam.OpenIdConnectProvider(this, "GithubOidcProvider", {
          url: "https://token.actions.githubusercontent.com",
          clientIds: ["sts.amazonaws.com"],
        });
 
    // OIDC 信頼条件（repo/branch を厳密化）
    const principal = new iam.OpenIdConnectPrincipal(provider).withConditions({
      StringEquals: {
        "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
      },
      StringLike: {
        "token.actions.githubusercontent.com:sub": `repo:${props.props.gitHub.owner}/${props.props.gitHub.repo}:ref:refs/heads/${branch}`,
      },
    });
 
    // IAM Role（GitHub Actions 用）
    const role = new iam.Role(this, "GithubActionsDeployerRole", {
      assumedBy: principal,
      description:
        "OIDC for GitHub Actions: least-privilege deploy to S3 + CloudFront invalidation",
      roleName: "github-actions-oidc-deployer",
    });
 
    // S3 最小権限（対象バケット限定）
    role.addToPolicy(
      new iam.PolicyStatement({
        actions: ["s3:ListBucket"],
        resources: [`arn:aws:s3:::${props.bucketName}`],
      })
    );
    role.addToPolicy(
      new iam.PolicyStatement({
        actions: ["s3:PutObject", "s3:DeleteObject"],
        resources: [`arn:aws:s3:::${props.bucketName}/*`],
      })
    );
 
    // CloudFront 無効化（Distribution 限定）
    role.addToPolicy(
      new iam.PolicyStatement({
        actions: ["cloudfront:CreateInvalidation"],
        resources: [
          `arn:aws:cloudfront::${cdk.Stack.of(this).account}:distribution/${
            props.distributionId
          }`,
        ],
      })
    );
 
    // 出力（GitHub Actions 側で使う Assume Role ARN）
    new cdk.CfnOutput(this, "DeployerRoleArn", {
      value: role.roleArn,
      description: "AssumeRole ARN for GitHub Actions (role-to-assume)",
    });
 
    // OIDC Provider の ARN を出力
    new cdk.CfnOutput(this, "OidcProviderArn", {
      value: provider.openIdConnectProviderArn,
      description: "GitHub OIDC Provider ARN referenced by this stack",
    });
  }
}

$ cdk synth
$ cdk diff MyProfileCdkStage/*
$ cdk deploy MyProfileCdkStage/DnsStack \
             MyProfileCdkStage/EdgeCertStack \
             MyProfileCdkStage/MailApiStack \
             MyProfileCdkStage/WebsiteStack \
             MyProfileCdkStage/CicdOidcRoleStack \
             --concurrency 1

name: Deploy static site to S3
 
on:
  push:
    branches: [main]
 
  workflow_dispatch:
 
permissions:
  id-token: write
  contents: read
 
defaults:
  run:
    working-directory: my_profile
 
concurrency:
  group: deploy-static
  cancel-in-progress: true
 
env:
  AWS_REGION: ${{ secrets.AWS_REGION }}
  S3_BUCKET: ${{ secrets.S3_BUCKET }}
  CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
  MICROCMS_SERVICE_DOMAIN: ${{ secrets.MICROCMS_SERVICE_DOMAIN }}
  MICROCMS_API_KEY: ${{ secrets.MICROCMS_API_KEY }}
  MICROCMS_PREVIEW_SECRET: ${{ secrets.MICROCMS_PREVIEW_SECRET }}
  NEXT_PUBLIC_CONTACT_API_ENDPOINT: ${{ secrets.NEXT_PUBLIC_CONTACT_API_ENDPOINT }}
  NEXT_TELEMETRY_DISABLED: "1"
 
jobs:
  deploy:
    runs-on: ubuntu-latest
 
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: "npm"
          cache-dependency-path: "my_profile/package-lock.json"
 
      - name: Install deps
        run: npm ci
 
      - name: Build (static export via script)
        run: npm run build:static
 
      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}
 
      - name: Sync to S3
        run: |
          aws s3 sync ./out s3://$S3_BUCKET --delete --exact-timestamps
 
      - name: Invalidate CloudFront
        run: |
          aws cloudfront create-invalidation \
            --distribution-id "${CLOUDFRONT_DISTRIBUTION_ID}" \
            --paths "/*"

name: Deploy static site to S3
 
on:
  push:
    branches: [main]
 
  repository_dispatch: 
    types: [microcms_build] 
 
  workflow_dispatch:
...