Category
インフラ・IaC・CI/CD（AWS / Terraform）の設計ガイド
インフラは「壊れない・安い・安全」を、宣言的なコードと最小権限で実現する領域です。ECS/EKSの選定、FinOpsによるコスト最適化、Terraformの責務分離とステート運用・ドリフト検知、OIDCによる鍵レスCI/CD、WAFの多層防御——スタートアップが運用に耐えるIaCの作り方を扱います。ECS on Fargateそのものの本番運用（タスク設計・ネットワーキング・デプロイ・オートスケール・コスト・トラブルシュート）は『ECS on Fargate 本番運用』クラスタにまとめています。脅威検知（GuardDuty）の本番運用は『Amazon GuardDuty 本番運用』クラスタにまとめています。
5 articles in total
Foundational guide
Foundational guide (start here)
AWS ECS on Fargate vs EKS: 7 Evaluation Axes a Startup Should Decide in 3 Months, and an Implementation-Cost Comparison
The decision-making process for choosing container orchestration, practiced in developing a Minister of Economy, Trade and Industry Award-winning product. For startup CTOs torn over ECS/EKS, I share 7 evaluation axes, concrete cost estimates, and Terraform code examples.
Related practical articles
- CI/CDセキュリティAWSGCPDevOps
Making GitHub Actions Keyless with OIDC: Throwing Away Long-Lived Keys with AWS IAM Roles and GCP Workload Identity Federation
An implementation guide for abolishing long-lived cloud credentials from GitHub Actions CI/CD. Explained with real settings and Terraform: issuing short-lived tokens with OIDC federation, configuring AWS (IAM OIDC provider + role trust policy) and GCP (Workload Identity Federation), and narrowing the trust scope with sub/aud/repo/branch to achieve least privilege.
22 min read - TerraformIaCアーキテクチャ設計GCPAWS
Terraform Module Design and State Operations: Building 'IaC That Doesn't Break' with Separation of Concerns, stg/prod State Splitting, and Drift Detection
An implementation guide to designing maintainable IaC with Terraform. From the criteria for extracting modules and the standard structure, composition-first, per-environment state isolation plus remote state + locking, drift prevention via separation of concerns, to CI gates of plan-with-tfsec / apply-with-a-permission-boundary-role / periodic drift detection—all explained with real configuration. Cost optimization (FinOps) is split into a separate article; this one focuses on structure and state operations.
23 min read - セキュリティAWSGCPWAFアーキテクチャ設計
Designing Defense-in-Depth with a WAF: Rolling Out AWS WAF / Cloud Armor's OWASP Countermeasures, Rate Limiting, and DDoS Mitigation to Production Without False Positives
An implementation guide for building defense-in-depth in production with AWS WAF and Google Cloud Armor. Explained with real settings: Web ACLs / security policies, OWASP managed rules, rate limiting, DDoS / adaptive protection, and the operation of safely rolling out with count/staging without false positives. A WAF is 'one layer' of defense-in-depth, not a silver bullet — designed from that premise.
23 min read - AWSTerraformインフラコスト最適化FinOps
You Can Halve Your Server Bill with 'Design': A Terraform × FinOps Practical Guide to Cutting a Startup's AWS Monthly Bill by 30–50%
"The AWS bill is up again this month, too." Infrastructure costs ballooning faster than MRR growth is a design problem, not a technical one. For startup CEOs/COOs, we explain — with analogies even non-engineers understand and numeric simulations — a Terraform implementation that combines autoscaling, Fargate Spot, S3 tiering, auto-stopping non-production, and budget alerts to build a foundation that cuts the monthly bill by 30–50% while withstanding business growth.
16 min read