API Gateway(REST) + Lambda を「追加が冗長にならない」Terraform 構成にする

resource "aws_api_gateway_resource" "this" {
  for_each  = local.resources
  parent_id = each.value.parent == "" ? aws_api_gateway_rest_api.this.root_resource_id : aws_api_gateway_resource.this[each.value.parent].id
  #                                                                                       ^^^ 同じ resource の別インスタンスを参照
}

openapi: "3.0.1"
info:
  title: "${name}"
  version: "1.0"
paths:
  /health:
    get:
      x-amazon-apigateway-integration:
        type: aws_proxy
        httpMethod: POST # Lambda 統合は常に POST（REST v1 も）
        uri: ${invoke_arns["health"]}
        passthroughBehavior: when_no_match
      responses:
        "200":
          description: OK

resource "aws_api_gateway_rest_api" "this" {
  name = local.name
 
  body = templatefile("${path.module}/openapi.yml", {
    name        = local.name
    invoke_arns = var.lambda_invoke_arns # ← マップごと渡す
  })
 
  endpoint_configuration {
    types = ["REGIONAL"]
  }
}
 
resource "aws_api_gateway_deployment" "this" {
  rest_api_id = aws_api_gateway_rest_api.this.id
 
  # body(=OpenAPI)が変われば再デプロイ
  triggers = {
    redeploy = sha1(jsonencode(aws_api_gateway_rest_api.this.body))
  }
 
  lifecycle {
    create_before_destroy = true
  }
}
 
resource "aws_api_gateway_stage" "this" {
  rest_api_id   = aws_api_gateway_rest_api.this.id
  deployment_id = aws_api_gateway_deployment.this.id
  stage_name    = var.stage_name
}
 
# Lambda ごとに invoke 許可(増えても for_each で自動追従)
resource "aws_lambda_permission" "this" {
  for_each      = var.lambda_function_names
  statement_id  = "AllowAPIGatewayInvoke-${each.key}"
  action        = "lambda:InvokeFunction"
  function_name = each.value
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_api_gateway_rest_api.this.execution_arn}/*/*"
}

locals {
  # Lambda はここだけに増やす(キー=論理名, handler=エントリ)
  lambdas = {
    health = { handler = "health.handler" }
    # items  = { handler = "items.handler" }  ← 増やすときはここに1行
  }
}

module "lambda" {
  source      = "../../modules/lambda"
  for_each    = local.lambdas
  project     = var.project
  env         = var.env
  zip_path    = "${path.root}/../../../backend/dist/function.zip"
  handler     = each.value.handler
  name_suffix = each.key
}
 
module "api" {
  source     = "../../modules/api"
  project    = var.project
  env        = var.env
  stage_name = var.env
 
  # module.lambda(for_each)から自動生成する。手で増やさない
  lambda_invoke_arns    = { for k, m in module.lambda : k => m.invoke_arn }
  lambda_function_names = { for k, m in module.lambda : k => m.function_name }
}

# modules/lambda/locals.tf
locals {
  function_name = "${var.project}-${var.env}-${var.name_suffix}"
  log_group     = "/aws/lambda/${var.project}-${var.env}-${var.name_suffix}"
}

back-build: ## backend を zip 化(backend/dist/function.zip)
	rm -rf backend/build backend/dist
	mkdir -p backend/build backend/dist
	pip install -r backend/requirements.txt -t backend/build
	cp backend/src/*.py backend/build/
	cd backend/build && zip -qr ../dist/function.zip .

resource "aws_lambda_function" "this" {
  function_name    = local.function_name
  role             = aws_iam_role.this.arn
  runtime          = var.runtime
  handler          = var.handler
  architectures    = [var.architecture]
  filename         = var.zip_path
  source_code_hash = filebase64sha256(var.zip_path) # zip が変われば更新
}

- uses: actions/setup-python@v5
  with:
    python-version: "3.13"
 
# 0) backend を zip 化(terraform が source_code_hash で参照するので apply の前に必須)
- name: Build backend
  run: make back-build
 
# 1) インフラ(Lambda / API Gateway / S3 / CloudFront ...)
- name: Terraform apply
  env:
    ENV: ${{ steps.env.outputs.name }}
  run: |
    terraform -chdir=infra/envs/$ENV init
    terraform -chdir=infra/envs/$ENV apply -auto-approve

on:
  pull_request:
    paths:
      - "backend/**"
      - ".github/workflows/backend.yml"
 
jobs:
  check:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - run: pip install ruff pytest
      - run: ruff check .
      - run: ruff format --check .
      - run: pytest -q