エンドツーエンド暗号化
完全ガイド

# ① ACM証明書の発行（CloudFront用 - us-east-1）
aws acm request-certificate \
    --domain-name "service.example.com" \
    --validation-method DNS \
    --region us-east-1

# ② ACM証明書の発行（ALB用 - ALBのリージョン）
aws acm request-certificate \
    --domain-name "service-alb.example.com" \
    --validation-method DNS \
    --region ap-northeast-1

# ALBのHTTPSリスナーを作成
aws elbv2 create-listener \
    --load-balancer-arn "arn:aws:elasticloadbalancing:..." \
    --protocol HTTPS \
    --port 443 \
    --ssl-policy "ELBSecurityPolicy-TLS13-1-2-2021-06" \
    --certificates "CertificateArn=arn:aws:acm:..." \
    --default-actions "Type=forward,TargetGroupArn=arn:..."

# ⚠️ HTTPリスナー（80）があれば削除
aws elbv2 delete-listener \
    --listener-arn "arn:aws:elasticloadbalancing:...:listener/..."

# ③ ターゲットグループをHTTPSに設定
aws elbv2 create-target-group \
    --name "e2e-https-tg" \
    --protocol HTTPS \
    --port 443 \
    --vpc-id "vpc-xxxxxxxx" \
    --health-check-protocol HTTPS

# ① ACM証明書（CloudFront用 - us-east-1）
resource "aws_acm_certificate" "cloudfront" {
  provider          = aws.us_east_1
  domain_name       = "service.example.com"
  validation_method = "DNS"
}

# ② ACM証明書（ALB用）
resource "aws_acm_certificate" "alb" {
  domain_name       = "service-alb.example.com"
  validation_method = "DNS"
}

# ALB HTTPSリスナー（HTTPリスナーは作成しない）
resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = aws_acm_certificate.alb.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.https.arn
  }
}

# ③ ターゲットグループ（HTTPS - EC2への暗号化）
resource "aws_lb_target_group" "https" {
  name     = "e2e-https-tg"
  port     = 443
  protocol = "HTTPS"
  vpc_id   = aws_vpc.main.id

  health_check {
    protocol = "HTTPS"
    path     = "/health"
  }
}

# CloudFrontディストリビューション
resource "aws_cloudfront_distribution" "main" {
  origin {
    domain_name = "service-alb.example.com"
    custom_origin_config {
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate.cloudfront.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

  default_cache_behavior {
    viewer_protocol_policy = "redirect-to-https"
  }
}