ロードバランシング — トラフィックを分散する

# /etc/nginx/nginx.conf
 
http {
  # バックエンドサーバー群の定義
  upstream echotask_backend {
    least_conn;  # 最少コネクション方式
 
    server app1.internal:3000 weight=3;
    server app2.internal:3000 weight=3;
    server app3.internal:3000 weight=1;  # スペックが低いサーバー
 
    keepalive 32;  # バックエンドへの持続接続数
    keepalive_requests 100;
    keepalive_timeout 60s;
  }
 
  server {
    listen 80;
    server_name echotask.example.com;
 
    location / {
      proxy_pass http://echotask_backend;
      proxy_http_version 1.1;
 
      # keepaliveを使うために必須
      proxy_set_header Connection "";
 
      # 実クライアントIPをバックエンドに伝える
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $host;
 
      proxy_connect_timeout 5s;
      proxy_read_timeout 60s;
    }
 
    # ヘルスチェック用エンドポイント（Nginxが直接返す）
    location /nginx-health {
      access_log off;
      return 200 "healthy\n";
      add_header Content-Type text/plain;
    }
  }
}

// cmd/server/main.go
package main
 
import (
	"context"
	"database/sql"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"os"
	"time"
 
	_ "github.com/lib/pq"
	"github.com/redis/go-redis/v9"
)
 
type HealthResponse struct {
	Status    string            `json:"status"`
	Checks    map[string]string `json:"checks"`
	Timestamp time.Time         `json:"timestamp"`
}
 
var (
	db  *sql.DB
	rdb *redis.Client
)
 
func healthHandler(w http.ResponseWriter, r *http.Request) {
	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
	defer cancel()
 
	checks := make(map[string]string)
	status := "ok"
 
	// データベース疎通確認
	if err := db.PingContext(ctx); err != nil {
		checks["database"] = fmt.Sprintf("error: %s", err.Error())
		status = "degraded"
	} else {
		checks["database"] = "ok"
	}
 
	// Redis疎通確認
	if _, err := rdb.Ping(ctx).Result(); err != nil {
		checks["redis"] = fmt.Sprintf("error: %s", err.Error())
		status = "degraded"
	} else {
		checks["redis"] = "ok"
	}
 
	resp := HealthResponse{Status: status, Checks: checks, Timestamp: time.Now().UTC()}
	w.Header().Set("Content-Type", "application/json")
	if status != "ok" {
		w.WriteHeader(http.StatusServiceUnavailable)
	}
	json.NewEncoder(w).Encode(resp)
}
 
func main() {
	var err error
	db, err = sql.Open("postgres", os.Getenv("DATABASE_URL"))
	if err != nil {
		log.Fatal(err)
	}
	db.SetMaxOpenConns(25)
	db.SetMaxIdleConns(5)
 
	rdb = redis.NewClient(&redis.Options{Addr: os.Getenv("REDIS_URL")})
 
	mux := http.NewServeMux()
	mux.HandleFunc("/health", healthHandler)
	log.Fatal(http.ListenAndServe(":8080", mux))
}

# CloudFormation — パスベースルーティング設定（抜粋）
Listener:
  Type: AWS::ElasticLoadBalancingV2::Listener
  Properties:
    LoadBalancerArn: !Ref LoadBalancer
    Port: 443
    Protocol: HTTPS
    Certificates:
      - CertificateArn: !Ref ACMCertificate
    DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref WebTargetGroup
 
# /api/* → APIサービス
ApiListenerRule:
  Type: AWS::ElasticLoadBalancingV2::ListenerRule
  Properties:
    ListenerArn: !Ref Listener
    Priority: 10
    Conditions:
      - Field: path-pattern
        Values: ["/api/*"]
    Actions:
      - Type: forward
        TargetGroupArn: !Ref ApiTargetGroup
 
# /admin/* → 社内IPのみ許可
AdminListenerRule:
  Type: AWS::ElasticLoadBalancingV2::ListenerRule
  Properties:
    ListenerArn: !Ref Listener
    Priority: 20
    Conditions:
      - Field: path-pattern
        Values: ["/admin/*"]
      - Field: source-ip
        SourceIpConfig:
          Values: ["203.0.113.0/24"]
    Actions:
      - Type: forward
        TargetGroupArn: !Ref AdminTargetGroup
 
WebTargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    Name: echo-task-web
    Port: 3000
    Protocol: HTTP
    VpcId: !Ref VPC
    TargetType: ip
    HealthCheckPath: /health
    HealthCheckIntervalSeconds: 30
    HealthyThresholdCount: 2
    UnhealthyThresholdCount: 3

# S3バケットを作成し、ALBのアクセスログを有効化
aws s3 mb s3://echo-task-alb-access-logs --region ap-northeast-1
 
# ALBのアクセスログをS3バケットに出力する設定
aws elbv2 modify-load-balancer-attributes \
  --load-balancer-arn arn:aws:elasticloadbalancing:ap-northeast-1:123456789012:loadbalancer/app/echo-task-alb/xxxx \
  --attributes \
    Key=access_logs.s3.enabled,Value=true \
    Key=access_logs.s3.bucket,Value=echo-task-alb-access-logs \
    Key=access_logs.s3.prefix,Value=echo-task
 
# S3バケットポリシー（ALBがPutObjectできるよう許可）
aws s3api put-bucket-policy \
  --bucket echo-task-alb-access-logs \
  --policy '{
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "delivery.logs.amazonaws.com"},
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::echo-task-alb-access-logs/*"
    }]
  }'

-- 直近1時間でレスポンスタイムが1秒超のリクエストを調べる
SELECT
  time,
  client_ip,
  request,
  target_processing_time,
  elb_status_code
FROM alb_access_logs
WHERE
  target_processing_time > 1.0
  AND time >= date_format(date_add('hour', -1, now()), '%Y-%m-%dT%H:%i')
ORDER BY target_processing_time DESC
LIMIT 50;
 
-- 5xxエラーの発生状況を1分ごとに集計
SELECT
  date_trunc('minute', from_iso8601_timestamp(time)) AS minute,
  COUNT(*) AS error_count
FROM alb_access_logs
WHERE elb_status_code >= 500
GROUP BY 1
ORDER BY 1;
 
-- IPアドレス別リクエスト数（DDoS兆候の検出）
SELECT
  client_ip,
  COUNT(*) AS request_count
FROM alb_access_logs
WHERE time >= date_format(date_add('minute', -10, now()), '%Y-%m-%dT%H:%i')
GROUP BY client_ip
HAVING COUNT(*) > 1000
ORDER BY request_count DESC;

# CloudFormation — Blue/Green用のTargetGroupを2つ定義
BlueTargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    Name: echo-task-blue
    Port: 3000
    Protocol: HTTP
    VpcId: !Ref VPC
    TargetType: ip
    HealthCheckPath: /health
    HealthCheckIntervalSeconds: 15
    HealthyThresholdCount: 2
 
GreenTargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    Name: echo-task-green
    Port: 3000
    Protocol: HTTP
    VpcId: !Ref VPC
    TargetType: ip
    HealthCheckPath: /health
    HealthCheckIntervalSeconds: 15
    HealthyThresholdCount: 2

# Green環境のECSサービスを新バージョンで更新
aws ecs update-service \
  --cluster echo-task \
  --service echo-task-green \
  --task-definition echo-task:42
 
# ヘルスチェックが通るまで待機
aws ecs wait services-stable \
  --cluster echo-task \
  --services echo-task-green
 
# ALBのListenerをGreenに切り替え
aws elbv2 modify-listener \
  --listener-arn arn:aws:elasticloadbalancing:ap-northeast-1:123456789012:listener/app/echo-task-alb/xxxx/yyyy \
  --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:ap-northeast-1:123456789012:targetgroup/echo-task-green/zzzz
 
echo "Green環境への切り替え完了"
 
# 問題発生時はBlueに即座に戻す
# aws elbv2 modify-listener ... TargetGroupArn=<BlueのARN>

# Gemfile
gem 'jwt'
 
# app/services/token_service.rb
class TokenService
  SECRET_KEY = Rails.application.credentials.jwt_secret_key
  EXPIRY = 24.hours
 
  def self.encode(payload)
    payload[:exp] = EXPIRY.from_now.to_i
    JWT.encode(payload, SECRET_KEY, 'HS256')
  end
 
  def self.decode(token)
    decoded = JWT.decode(token, SECRET_KEY, true, algorithm: 'HS256')
    decoded[0].with_indifferent_access
  rescue JWT::ExpiredSignature
    raise AuthenticationError, 'Token expired'
  rescue JWT::DecodeError
    raise AuthenticationError, 'Invalid token'
  end
end
 
# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  def create
    user = User.find_by(email: params[:email])
    unless user&.authenticate(params[:password])
      return render json: { error: 'Invalid credentials' }, status: :unauthorized
    end
 
    token = TokenService.encode({ user_id: user.id, email: user.email })
    render json: { token: token, expires_in: TokenService::EXPIRY.to_i }
  end
end
 
# app/controllers/concerns/authenticatable.rb
module Authenticatable
  extend ActiveSupport::Concern
 
  included do
    before_action :authenticate_user!
  end
 
  def authenticate_user!
    header = request.headers['Authorization']
    token = header&.split(' ')&.last
    raise AuthenticationError, 'No token provided' unless token
 
    @current_user_payload = TokenService.decode(token)
  rescue AuthenticationError => e
    render json: { error: e.message }, status: :unauthorized
  end
end

# app/services/token_blacklist_service.rb
class TokenBlacklistService
  def self.revoke(token, expiry)
    jti = TokenService.decode(token)[:jti]
    Redis.current.setex("blacklist:#{jti}", expiry.to_i, '1')
  end
 
  def self.revoked?(token)
    jti = TokenService.decode(token)[:jti]
    Redis.current.exists?("blacklist:#{jti}")
  end
end
 
# app/controllers/sessions_controller.rb（ログアウト）
def destroy
  token = request.headers['Authorization']&.split(' ')&.last
  if token
    payload = TokenService.decode(token)
    remaining = payload[:exp] - Time.current.to_i
    TokenBlacklistService.revoke(token, remaining)
  end
  head :no_content
end

# NLB + gRPC用 TargetGroup
NotificationNLB:
  Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  Properties:
    Name: echo-task-nlb
    Type: network
    Scheme: internal
    Subnets: [!Ref PrivateSubnet1, !Ref PrivateSubnet2]
 
NLBListener:
  Type: AWS::ElasticLoadBalancingV2::Listener
  Properties:
    LoadBalancerArn: !Ref NotificationNLB
    Port: 50051
    Protocol: TCP
    DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref GRPCTargetGroup
 
GRPCTargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    Name: echo-task-grpc
    Port: 50051
    Protocol: TCP
    VpcId: !Ref VPC
    TargetType: ip
    HealthCheckProtocol: TCP
    HealthCheckIntervalSeconds: 10

# Route53 ヘルスチェック + フェイルオーバー
HealthCheckTokyo:
  Type: AWS::Route53::HealthCheck
  Properties:
    HealthCheckConfig:
      Type: HTTPS
      FullyQualifiedDomainName: echo-task-alb-tokyo.ap-northeast-1.elb.amazonaws.com
      Port: 443
      ResourcePath: /health
      RequestInterval: 30
      FailureThreshold: 3  # 3回連続失敗でフェイルオーバー発動
 
DNSPrimary:
  Type: AWS::Route53::RecordSet
  Properties:
    HostedZoneId: !Ref HostedZone
    Name: echotask.example.com
    Type: A
    SetIdentifier: primary-tokyo
    Failover: PRIMARY
    HealthCheckId: !Ref HealthCheckTokyo
    AliasTarget:
      DNSName: !GetAtt TokyoLoadBalancer.DNSName
      EvaluateTargetHealth: true
      HostedZoneId: !GetAtt TokyoLoadBalancer.CanonicalHostedZoneID
 
DNSSecondary:
  Type: AWS::Route53::RecordSet
  Properties:
    HostedZoneId: !Ref HostedZone
    Name: echotask.example.com
    Type: A
    SetIdentifier: secondary-osaka
    Failover: SECONDARY
    AliasTarget:
      DNSName: !GetAtt OsakaLoadBalancer.DNSName
      EvaluateTargetHealth: true
      HostedZoneId: !GetAtt OsakaLoadBalancer.CanonicalHostedZoneID