ECS + NLB で Linear / Canary デプロイを検証 — 10分遅延がステップ設計を左右する

# VPC
VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=ecs-nlb-deploy-test}]' \
  --query 'Vpc.VpcId' --output text --region ap-northeast-1)
 
# サブネット（2 AZ）
SUBNET_A=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.1.0/24 --availability-zone ap-northeast-1a \
  --query 'Subnet.SubnetId' --output text --region ap-northeast-1)
SUBNET_C=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.2.0/24 --availability-zone ap-northeast-1c \
  --query 'Subnet.SubnetId' --output text --region ap-northeast-1)
 
# インターネットゲートウェイ
IGW_ID=$(aws ec2 create-internet-gateway \
  --query 'InternetGateway.InternetGatewayId' --output text --region ap-northeast-1)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID --region ap-northeast-1
 
# ルートテーブル
RTB_ID=$(aws ec2 describe-route-tables --filters "Name=vpc-id,Values=$VPC_ID" "Name=association.main,Values=true" \
  --query 'RouteTables[0].RouteTableId' --output text --region ap-northeast-1)
aws ec2 create-route --route-table-id $RTB_ID --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID --region ap-northeast-1
 
# パブリック IP 自動割り当て
aws ec2 modify-subnet-attribute --subnet-id $SUBNET_A --map-public-ip-on-launch --region ap-northeast-1
aws ec2 modify-subnet-attribute --subnet-id $SUBNET_C --map-public-ip-on-launch --region ap-northeast-1
 
# セキュリティグループ
SG_ID=$(aws ec2 create-security-group --group-name ecs-nlb-test-sg \
  --description "ECS NLB deploy test" --vpc-id $VPC_ID \
  --query 'GroupId' --output text --region ap-northeast-1)
aws ec2 authorize-security-group-ingress --group-id $SG_ID --protocol tcp --port 80 --cidr 0.0.0.0/0 --region ap-northeast-1
aws ec2 authorize-security-group-ingress --group-id $SG_ID --protocol tcp --port 8080 --cidr 0.0.0.0/0 --region ap-northeast-1

# NLB
NLB_ARN=$(aws elbv2 create-load-balancer --name ecs-nlb-deploy-test \
  --type network --subnets $SUBNET_A $SUBNET_C \
  --query 'LoadBalancers[0].LoadBalancerArn' --output text --region ap-northeast-1)
 
# ターゲットグループ（blue / green）
BLUE_TG=$(aws elbv2 create-target-group --name ecs-nlb-blue-tg \
  --protocol TCP --port 80 --vpc-id $VPC_ID --target-type ip \
  --health-check-protocol TCP \
  --query 'TargetGroups[0].TargetGroupArn' --output text --region ap-northeast-1)
GREEN_TG=$(aws elbv2 create-target-group --name ecs-nlb-green-tg \
  --protocol TCP --port 80 --vpc-id $VPC_ID --target-type ip \
  --health-check-protocol TCP \
  --query 'TargetGroups[0].TargetGroupArn' --output text --region ap-northeast-1)
 
# リスナー（本番: 80、テスト: 8080）
PROD_LISTENER=$(aws elbv2 create-listener --load-balancer-arn $NLB_ARN \
  --protocol TCP --port 80 \
  --default-actions Type=forward,TargetGroupArn=$BLUE_TG \
  --query 'Listeners[0].ListenerArn' --output text --region ap-northeast-1)
TEST_LISTENER=$(aws elbv2 create-listener --load-balancer-arn $NLB_ARN \
  --protocol TCP --port 8080 \
  --default-actions Type=forward,TargetGroupArn=$GREEN_TG \
  --query 'Listeners[0].ListenerArn' --output text --region ap-northeast-1)

# タスク実行ロール
aws iam create-role --role-name ecsNlbTestTaskExecRole \
  --assume-role-policy-document '{
    "Version":"2012-10-17",
    "Statement":[{"Effect":"Allow","Principal":{"Service":"ecs-tasks.amazonaws.com"},"Action":"sts:AssumeRole"}]
  }'
aws iam attach-role-policy --role-name ecsNlbTestTaskExecRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
 
# ECS インフラストラクチャロール（NLB 管理用）
aws iam create-role --role-name ecsNlbTestInfraRole \
  --assume-role-policy-document '{
    "Version":"2012-10-17",
    "Statement":[{"Effect":"Allow","Principal":{"Service":"ecs.amazonaws.com"},"Action":"sts:AssumeRole"}]
  }'
aws iam attach-role-policy --role-name ecsNlbTestInfraRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonECSInfrastructureRolePolicyForLoadBalancers

# クラスター
aws ecs create-cluster --cluster-name nlb-deploy-test --region ap-northeast-1
 
# タスク定義（v1: nginx デフォルト）
aws ecs register-task-definition --family nlb-deploy-test \
  --network-mode awsvpc --requires-compatibilities FARGATE \
  --cpu 256 --memory 512 \
  --execution-role-arn arn:aws:iam::<ACCOUNT_ID>:role/ecsNlbTestTaskExecRole \
  --container-definitions '[{
    "name":"web","image":"public.ecr.aws/nginx/nginx:1.27-alpine",
    "essential":true,"portMappings":[{"containerPort":80,"protocol":"tcp"}]
  }]' --region ap-northeast-1
 
# サービス作成（Linear 戦略）
aws ecs create-service --cluster nlb-deploy-test \
  --service-name nlb-linear-test \
  --task-definition nlb-deploy-test:1 \
  --desired-count 1 --launch-type FARGATE \
  --network-configuration '{
    "awsvpcConfiguration":{"subnets":["'$SUBNET_A'","'$SUBNET_C'"],
    "securityGroups":["'$SG_ID'"],"assignPublicIp":"ENABLED"}
  }' \
  --load-balancers '[{
    "targetGroupArn":"'$BLUE_TG'","containerName":"web","containerPort":80,
    "advancedConfiguration":{
      "alternateTargetGroupArn":"'$GREEN_TG'",
      "productionListenerRule":"'$PROD_LISTENER'",
      "testListenerRule":"'$TEST_LISTENER'",
      "roleArn":"arn:aws:iam::<ACCOUNT_ID>:role/ecsNlbTestInfraRole"
    }
  }]' \
  --deployment-configuration '{
    "maximumPercent":200,"minimumHealthyPercent":100,
    "strategy":"LINEAR","bakeTimeInMinutes":1,
    "linearConfiguration":{"stepPercent":50,"stepBakeTimeInMinutes":1}
  }' --region ap-northeast-1
 
# 安定するまで待機
aws ecs wait services-stable --cluster nlb-deploy-test --services nlb-linear-test --region ap-northeast-1

aws ecs register-task-definition --family nlb-deploy-test \
  --network-mode awsvpc --requires-compatibilities FARGATE \
  --cpu 256 --memory 512 \
  --execution-role-arn arn:aws:iam::<ACCOUNT_ID>:role/ecsNlbTestTaskExecRole \
  --container-definitions '[{
    "name":"web","image":"public.ecr.aws/nginx/nginx:1.27-alpine",
    "essential":true,"portMappings":[{"containerPort":80,"protocol":"tcp"}],
    "environment":[{"name":"APP_VERSION","value":"v2"}]
  }]' --region ap-northeast-1

# デプロイ ARN を取得
DEPLOY_ARN=$(aws ecs describe-services \
  --cluster nlb-deploy-test --services nlb-linear-test \
  --region ap-northeast-1 \
  --query 'services[0].currentServiceDeployment' --output text)
 
# 30秒間隔でステージ遷移を監視
prev_stage=""
for i in $(seq 1 90); do
  result=$(aws ecs describe-service-deployments \
    --service-deployment-arns "$DEPLOY_ARN" \
    --region ap-northeast-1 \
    --query 'serviceDeployments[0].{status:status,stage:lifecycleStage,targetWeight:targetServiceRevision.requestedProductionTrafficWeight}' \
    --output json)
  stage=$(echo "$result" | jq -r '.stage // "null"')
  status=$(echo "$result" | jq -r '.status')
  weight=$(echo "$result" | jq -r '.targetWeight // "N/A"')
  if [ "$stage" != "$prev_stage" ]; then
    echo "$(date +%H:%M:%S) [STAGE CHANGE] $stage (target=$weight%)"
    prev_stage="$stage"
  fi
  [ "$status" = "SUCCESSFUL" ] || [ "$status" = "FAILED" ] && break
  sleep 30
done

aws ecs register-task-definition --family nlb-deploy-test \
  --network-mode awsvpc --requires-compatibilities FARGATE \
  --cpu 256 --memory 512 \
  --execution-role-arn arn:aws:iam::<ACCOUNT_ID>:role/ecsNlbTestTaskExecRole \
  --container-definitions '[{
    "name":"web","image":"public.ecr.aws/nginx/nginx:1.27-alpine",
    "essential":true,"portMappings":[{"containerPort":80,"protocol":"tcp"}],
    "environment":[{"name":"APP_VERSION","value":"v3"}]
  }]' --region ap-northeast-1

# ECS サービス削除
aws ecs update-service --cluster nlb-deploy-test --service nlb-linear-test --desired-count 0 --region ap-northeast-1
aws ecs delete-service --cluster nlb-deploy-test --service nlb-linear-test --force --region ap-northeast-1
 
# タスク定義の登録解除
for rev in 1 2 3; do
  aws ecs deregister-task-definition --task-definition nlb-deploy-test:$rev --region ap-northeast-1
done
 
# ECS クラスター削除
aws ecs delete-cluster --cluster nlb-deploy-test --region ap-northeast-1
 
# リスナー削除
aws elbv2 delete-listener --listener-arn $PROD_LISTENER --region ap-northeast-1
aws elbv2 delete-listener --listener-arn $TEST_LISTENER --region ap-northeast-1
 
# ターゲットグループ削除
aws elbv2 delete-target-group --target-group-arn $BLUE_TG --region ap-northeast-1
aws elbv2 delete-target-group --target-group-arn $GREEN_TG --region ap-northeast-1
 
# NLB 削除
aws elbv2 delete-load-balancer --load-balancer-arn $NLB_ARN --region ap-northeast-1
 
# IAM ロール削除
aws iam detach-role-policy --role-name ecsNlbTestTaskExecRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
aws iam delete-role --role-name ecsNlbTestTaskExecRole
aws iam detach-role-policy --role-name ecsNlbTestInfraRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonECSInfrastructureRolePolicyForLoadBalancers
aws iam delete-role --role-name ecsNlbTestInfraRole
 
# セキュリティグループ削除
aws ec2 delete-security-group --group-id $SG_ID --region ap-northeast-1
 
# IGW デタッチ・削除
aws ec2 detach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID --region ap-northeast-1
aws ec2 delete-internet-gateway --internet-gateway-id $IGW_ID --region ap-northeast-1
 
# サブネット削除
aws ec2 delete-subnet --subnet-id $SUBNET_A --region ap-northeast-1
aws ec2 delete-subnet --subnet-id $SUBNET_C --region ap-northeast-1
 
# VPC 削除
aws ec2 delete-vpc --vpc-id $VPC_ID --region ap-northeast-1