【2026年版】Terraform × AWS IaC入門ガイド

brew install tfenv
tfenv install 1.14.0
tfenv use 1.14.0
terraform --version
# Terraform v1.14.0

git clone --depth=1 https://github.com/tfutils/tfenv.git ~/.tfenv
echo 'export PATH="$HOME/.tfenv/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
tfenv install 1.14.0
tfenv use 1.14.0

1.14.0

terraform {
  required_version = ">= 1.9"
 
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
 
provider "aws" {
  region = var.aws_region
}

variable "aws_region" {
  description = "AWSリージョン"
  type        = string
  default     = "ap-northeast-1"
}

aws configure
# AWS Access Key ID: ...
# AWS Secret Access Key: ...
# Default region name: ap-northeast-1

# 初期化（初回またはprovider追加後）
terraform init
 
# 実行計画の確認（必ずapply前に実行する）
terraform plan
 
# インフラの構築
terraform apply
 
# コードのフォーマット整形
terraform fmt
 
# 構文チェック
terraform validate
 
# リソースの削除（学習後は忘れずに）
terraform destroy

terraform-aws-sample/
├── provider.tf        # プロバイダー設定
├── variables.tf       # 変数定義
├── outputs.tf         # 出力値
├── vpc.tf             # VPC・サブネット・IGW
├── security_group.tf  # セキュリティグループ
└── ec2.tf             # EC2インスタンス

resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
 
  tags = {
    Name = "${var.project_name}-vpc"
  }
}
 
resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "ap-northeast-1a"
  map_public_ip_on_launch = true
 
  tags = {
    Name = "${var.project_name}-public-subnet"
  }
}
 
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
 
  tags = {
    Name = "${var.project_name}-igw"
  }
}
 
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
 
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
 
  tags = {
    Name = "${var.project_name}-rtb-public"
  }
}
 
resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

resource "aws_security_group" "web" {
  name        = "${var.project_name}-web-sg"
  description = "Web server security group"
  vpc_id      = aws_vpc.main.id
 
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.my_ip]
  }
 
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  tags = {
    Name = "${var.project_name}-web-sg"
  }
}

data "aws_ami" "amazon_linux_2023" {
  most_recent = true
  owners      = ["amazon"]
 
  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
}
 
resource "aws_instance" "web" {
  ami                    = data.aws_ami.amazon_linux_2023.id
  instance_type          = var.instance_type
  subnet_id              = aws_subnet.public.id
  vpc_security_group_ids = [aws_security_group.web.id]
  key_name               = var.key_pair_name
 
  tags = {
    Name = "${var.project_name}-web"
  }
}

variable "aws_region" {
  description = "AWSリージョン"
  type        = string
  default     = "ap-northeast-1"
}
 
variable "project_name" {
  description = "プロジェクト名（リソース名のプレフィックスに使用）"
  type        = string
  default     = "myapp"
}
 
variable "instance_type" {
  description = "EC2インスタンスタイプ"
  type        = string
  default     = "t3.micro"
}
 
variable "key_pair_name" {
  description = "EC2キーペア名"
  type        = string
}
 
variable "my_ip" {
  description = "SSH接続を許可するIPアドレス（/32形式）"
  type        = string
}

output "instance_public_ip" {
  description = "EC2パブリックIPアドレス"
  value       = aws_instance.web.public_ip
}
 
output "vpc_id" {
  description = "VPC ID"
  value       = aws_vpc.main.id
}

resource "aws_s3_bucket" "tfstate" {
  bucket = "myapp-tfstate-${data.aws_caller_identity.current.account_id}"
}
 
resource "aws_s3_bucket_versioning" "tfstate" {
  bucket = aws_s3_bucket.tfstate.id
 
  versioning_configuration {
    status = "Enabled"
  }
}
 
resource "aws_s3_bucket_server_side_encryption_configuration" "tfstate" {
  bucket = aws_s3_bucket.tfstate.id
 
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}
 
resource "aws_dynamodb_table" "tfstate_lock" {
  name         = "myapp-tfstate-lock"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"
 
  attribute {
    name = "LockID"
    type = "S"
  }
}
 
data "aws_caller_identity" "current" {}

terraform {
  backend "s3" {
    bucket         = "myapp-tfstate-123456789012"
    key            = "prod/terraform.tfstate"
    region         = "ap-northeast-1"
    encrypt        = true
    dynamodb_table = "myapp-tfstate-lock"
  }
}

terraform/
├── modules/
│   ├── vpc/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   └── ec2/
│       ├── main.tf
│       ├── variables.tf
│       └── outputs.tf
└── environments/
    ├── prod/
    │   ├── main.tf
    │   └── terraform.tfvars
    └── staging/
        ├── main.tf
        └── terraform.tfvars

module "vpc" {
  source = "../../modules/vpc"
 
  project_name = "myapp"
  vpc_cidr     = "10.0.0.0/16"
  environment  = "prod"
}
 
module "web" {
  source = "../../modules/ec2"
 
  project_name    = "myapp"
  subnet_id       = module.vpc.public_subnet_id
  security_groups = [module.vpc.web_sg_id]
  environment     = "prod"
}

module "vpc" {
  source = "../../modules/vpc"
 
  project_name = "myapp"
  vpc_cidr     = "172.16.0.0/16"
  environment  = "staging"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"
 
  name = "myapp-vpc"
  cidr = "10.0.0.0/16"
 
  azs             = ["ap-northeast-1a", "ap-northeast-1c"]
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]
  private_subnets = ["10.0.11.0/24", "10.0.12.0/24"]
 
  enable_nat_gateway = true
}

name: Terraform CI
 
on:
  pull_request:
    branches: [main]
    paths:
      - 'terraform/**'
 
jobs:
  plan:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write
 
    steps:
      - uses: actions/checkout@v4
 
      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ap-northeast-1
 
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.14.0
 
      - name: Terraform Init
        run: terraform init
        working-directory: terraform/environments/prod
 
      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color 2>&1
        working-directory: terraform/environments/prod
 
      - name: Comment Plan Result on PR
        uses: actions/github-script@v7
        if: always()
        with:
          script: |
            const output = `#### Terraform Plan 📋
            \`\`\`
            ${{ steps.plan.outputs.stdout }}
            \`\`\``;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            });

【PHASE 1: 基礎固め（2〜3週間）】
  HCLの文法・基本コマンドを理解する
  ローカルtfstateでVPC・EC2を動かしてみる
  terraform destroyまで通しで体験する
 
【PHASE 2: 実践（1〜2ヶ月）】
  remote backend（S3 + DynamoDB）を設定する
  モジュール化でコードを整理する
  本記事のサンプルを自分の環境で再現する
 
【PHASE 3: チーム開発対応（継続）】
  GitHub ActionsでCI/CDを組む
  コードレビューの観点を身につける
  Terraform Associate資格を取得する

resource "aws_rds_cluster" "main" {
  # ...省略
  lifecycle {
    prevent_destroy = true
  }
}