【Hugo×AWS】GitHub_Actions+OIDCで自動デプロイ

cd hugo-s3-demo-infra/prod
terraform output

s3_bucket_name = "hugo-s3-demo-content-xxxxxxxx"
cloudfront_distribution_id = "E2XXXXXXXXXX"

hugo-s3-demo-infra/
└── prod/
    ├── versions.tf
    ├── backend.tf
    ├── variables.tf
    ├── main.tf
    ├── outputs.tf
    └── iam.tf      ← 新規作成

# ===========================================
# GitHub OIDC Provider
# ===========================================
resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["ffffffffffffffffffffffffffffffffffffffff"]

  tags = {
    Name = "${var.project_name}-github-oidc"
  }
}

# ===========================================
# GitHub Actions用IAMロール
# ===========================================
resource "aws_iam_role" "github_actions" {
  name = "${var.project_name}-github-actions-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Federated = aws_iam_openid_connect_provider.github.arn
        }
        Action = "sts:AssumeRoleWithWebIdentity"
        Condition = {
          StringEquals = {
            "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
          }
          StringLike = {
            "token.actions.githubusercontent.com:sub" = "repo:YOUR_GITHUB_USERNAME/YOUR_REPO_NAME:ref:refs/heads/main"
          }
        }
      }
    ]
  })
}

# ===========================================
# GitHub Actions用IAMポリシー
# ===========================================
resource "aws_iam_role_policy" "github_actions" {
  name = "${var.project_name}-github-actions-policy"
  role = aws_iam_role.github_actions.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "S3Deploy"
        Effect = "Allow"
        Action = [
          "s3:PutObject",
          "s3:GetObject",
          "s3:DeleteObject",
          "s3:ListBucket"
        ]
        Resource = [
          aws_s3_bucket.content.arn,
          "${aws_s3_bucket.content.arn}/*"
        ]
      },
      {
        Sid    = "CloudFrontInvalidation"
        Effect = "Allow"
        Action = [
          "cloudfront:CreateInvalidation",
          "cloudfront:GetInvalidation"
        ]
        Resource = aws_cloudfront_distribution.main.arn
      }
    ]
  })
}

resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["ffffffffffffffffffffffffffffffffffffffff"]
}

assume_role_policy = jsonencode({
  # ...省略...
  Condition = {
    StringEquals = {
      "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
    }
    StringLike = {
      "token.actions.githubusercontent.com:sub" = "repo:YOUR_GITHUB_USERNAME/YOUR_REPO_NAME:ref:refs/heads/main"
    }
  }
})

policy = jsonencode({
  Statement = [
    {
      Sid    = "S3Deploy"
      Action = [
        "s3:PutObject",    # ファイルアップロード
        "s3:GetObject",    # sync時の比較に必要
        "s3:DeleteObject", # --deleteオプション用
        "s3:ListBucket"    # バケット内一覧取得
      ]
      Resource = [
        aws_s3_bucket.content.arn,      # バケット自体
        "${aws_s3_bucket.content.arn}/*" # バケット内オブジェクト
      ]
    },
    {
      Sid    = "CloudFrontInvalidation"
      Action = [
        "cloudfront:CreateInvalidation", # キャッシュ無効化
        "cloudfront:GetInvalidation"     # 無効化ステータス確認
      ]
      Resource = aws_cloudfront_distribution.main.arn
    }
  ]
})

output "github_actions_role_arn" {
  value = aws_iam_role.github_actions.arn
}

terraform plan
terraform apply

github_actions_role_arn = "arn:aws:iam::123456789012:role/hugo-s3-demo-github-actions-role"

hugo-s3-demo/
├── .github/
│   └── workflows/
│       └── deploy.yml  ← 新規作成
├── content/
├── themes/
└── hugo.toml

name: Deploy to AWS

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ap-northeast-1
  S3_BUCKET: hugo-s3-demo-content-xxxxxxxx        # terraform outputの値に置き換え
  CLOUDFRONT_DISTRIBUTION_ID: E2XXXXXXXXXX        # terraform outputの値に置き換え

jobs:
  deploy:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: true

      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: 'latest'
          extended: true

      - name: Build
        run: hugo --minify

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/hugo-s3-demo-github-actions-role  # terraform outputの値に置き換え
          aws-region: ${{ env.AWS_REGION }}

      - name: Deploy to S3
        run: aws s3 sync public/ s3://${{ env.S3_BUCKET }}/ --delete

      - name: Invalidate CloudFront Cache
        run: |
          aws cloudfront create-invalidation \
            --distribution-id ${{ env.CLOUDFRONT_DISTRIBUTION_ID }} \
            --paths "/*"

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

- name: Checkout
  uses: actions/checkout@v4
  with:
    submodules: true

- name: Setup Hugo
  uses: peaceiris/actions-hugo@v3
  with:
    hugo-version: 'latest'
    extended: true

- name: Build
  run: hugo --minify

- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/hugo-s3-demo-github-actions-role
    aws-region: ${{ env.AWS_REGION }}

- name: Deploy to S3
  run: aws s3 sync public/ s3://${{ env.S3_BUCKET }}/ --delete

- name: Invalidate CloudFront Cache
  run: |
    aws cloudfront create-invalidation \
      --distribution-id ${{ env.CLOUDFRONT_DISTRIBUTION_ID }} \
      --paths "/*"

cd hugo-s3-demo
git add .github/workflows/deploy.yml
git commit -m "Add GitHub Actions workflow for deployment"
git push origin main

# 記事を編集
vim content/posts/first-post.md

# コミット・プッシュ
git add .
git commit -m "Update first post"
git push origin main

"token.actions.githubusercontent.com:sub" = "repo:xxx/xxx:ref:refs/heads/main"