CDN と静的配信 — エッジで加速する

# cloudformation/cdn-stack.yml（抜粋）
Resources:
  AssetsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: echo-task-assets-prod
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
 
  OriginAccessControl:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: echo-task-oac
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4
 
  # 静的アセット用キャッシュポリシー（1年 / フィンガープリント前提）
  StaticAssetsCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: echo-task-static-assets
        DefaultTTL: 31536000
        MaxTTL: 31536000
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true
          HeadersConfig: { HeaderBehavior: none }
          CookiesConfig: { CookieBehavior: none }
          QueryStringsConfig: { QueryStringBehavior: none }
 
  # 動的API用キャッシュポリシー（60秒）
  ApiCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: echo-task-api-cache
        DefaultTTL: 60
        MaxTTL: 300
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers: [Authorization, Accept-Language]
          CookiesConfig: { CookieBehavior: none }
          QueryStringsConfig:
            QueryStringBehavior: allExcept
            QueryStrings: [utm_source, utm_medium]
 
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        HttpVersion: http2and3
        Aliases: [assets.echotask.example.com]
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.2_2021
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt AssetsBucket.RegionalDomainName
            OriginAccessControlId: !Ref OriginAccessControl
            S3OriginConfig: { OriginAccessIdentity: '' }
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: !Ref StaticAssetsCachePolicy
          Compress: true
          AllowedMethods: [GET, HEAD, OPTIONS]
        CacheBehaviors:
          - PathPattern: /api/*
            TargetOriginId: S3Origin
            ViewerProtocolPolicy: https-only
            CachePolicyId: !Ref ApiCachePolicy
            AllowedMethods: [GET, HEAD]
        PriceClass: PriceClass_200
        WebACLId: !Ref WAFWebACL

# config/environments/production.rb
Rails.application.configure do
  config.action_controller.asset_host = ENV.fetch('CDN_HOST')
  config.public_file_server.enabled   = false  # CloudFrontから配信するため不要
  config.assets.compile = false
  config.assets.digest  = true  # フィンガープリント有効
end
 
# config/initializers/cdn.rb
# Active StorageのURLもCDN経由に
Rails.application.config.after_initialize do
  ActiveStorage::Current.url_options = {
    host: ENV.fetch('CDN_HOST', 'assets.echotask.example.com'),
    protocol: 'https'
  }
end

#!/bin/bash
# scripts/deploy_assets.sh
set -euo pipefail
BUCKET="echo-task-assets-prod"
DIST_ID="${CLOUDFRONT_DISTRIBUTION_ID}"
 
# Step 1: プリコンパイル
bundle exec rails assets:precompile RAILS_ENV=production
 
# Step 2: S3へ同期（フィンガープリント済みファイルは1年キャッシュ）
aws s3 sync public/assets s3://$BUCKET/assets \
  --exclude "*" --include "*.css" --include "*.js" \
  --include "*.png" --include "*.jpg" --include "*.woff2" \
  --cache-control "public, max-age=31536000, immutable" --delete
 
# manifest は毎回更新（キャッシュなし）
aws s3 cp public/assets/.sprockets-manifest-*.json s3://$BUCKET/assets/ \
  --cache-control "no-cache, no-store"
 
# Step 3: manifest のみ Invalidation（フィンガープリント済みは不要）
aws cloudfront create-invalidation \
  --distribution-id $DIST_ID --paths "/assets/.sprockets-manifest-*"

# コンパイル後（ファイル内容のSHA256ハッシュ付き）
application-a1b2c3d4.css   # 内容が変われば別ハッシュ → 別URL
application-9z8y7x6w.js
logo-c3d4e5f6.png

# Railsが自動でCDN URLを生成（app/views/layouts/application.html.erb）
<%= stylesheet_link_tag 'application' %>
# → <link href="https://assets.echotask.example.com/assets/application-a1b2c3d4.css">
 
<%= javascript_include_tag 'application', defer: true %>
# → <script src="https://assets.echotask.example.com/assets/application-9z8y7x6w.js" defer>

# config/environments/production.rb
config.public_file_server.headers = {
  'Cache-Control' => 'public, max-age=31536000, immutable'
}

# app/controllers/api/v1/tasks_controller.rb
class Api::V1::TasksController < ApplicationController
  def show
    @task = Task.find(params[:id])
    # ETagで条件付きリクエスト → 変更なしなら 304 Not Modified
    render json: @task if stale?(@task, public: false)
  end
 
  def index
    # s-maxage でCDNが60秒キャッシュ、期限後も30秒は古いキャッシュを返しつつ裏で更新
    response.headers['Cache-Control'] = 'public, s-maxage=60, stale-while-revalidate=30'
    render json: current_user.tasks.recent
  end
end

// lambda/security-headers/index.js（Viewer Response トリガー）
exports.handler = async (event) => {
  const response = event.Records[0].cf.response;
  const h = response.headers;
 
  // セキュリティヘッダーをエッジで付与（オリジン側の変更不要）
  h['strict-transport-security'] = [{ key: 'Strict-Transport-Security',
    value: 'max-age=63072000; includeSubDomains; preload' }];
  h['x-content-type-options'] = [{ key: 'X-Content-Type-Options', value: 'nosniff' }];
  h['x-frame-options']        = [{ key: 'X-Frame-Options', value: 'DENY' }];
  h['content-security-policy'] = [{ key: 'Content-Security-Policy',
    value: "default-src 'self'; img-src 'self' data: https://assets.echotask.example.com; " +
           "script-src 'self' https://assets.echotask.example.com" }];
 
  return response;
};

// lambda/ab-test/index.js（Viewer Request トリガー）
exports.handler = async (event) => {
  const request = event.Records[0].cf.request;
  const cookies = parseCookies(request.headers['cookie']);
 
  // 50:50でグループ振り分け（Cookie優先）
  const group = cookies['ab-group'] ?? (Math.random() < 0.5 ? 'control' : 'treatment');
 
  // treatment グループは /landing → /landing-v2 に書き換え
  if (group === 'treatment' && request.uri.startsWith('/landing')) {
    request.uri = request.uri.replace('/landing', '/landing-v2');
  }
 
  // オリジンがグループを識別できるようヘッダー付与
  request.headers['x-ab-group'] = [{ key: 'X-AB-Group', value: group }];
  return request;
};
 
function parseCookies(headers) {
  if (!headers?.length) return {};
  return Object.fromEntries(
    headers[0].value.split(';').map(c => c.trim().split('='))
  );
}

// cloudfront-functions/image-optimizer.js（Viewer Request トリガー）
function handler(event) {
  var request = event.request;
  var uri = request.uri;
  var accept = request.headers['accept'] ? request.headers['accept'].value : '';
 
  // 画像ファイルかつブラウザがWebP対応なら .webp に書き換え
  if (/\.(jpe?g|png|gif)$/i.test(uri) && accept.includes('image/webp')) {
    request.uri = uri.replace(/\.(jpe?g|png|gif)$/i, '.webp');
  }
  return request;
}

# app/jobs/webp_conversion_job.rb
# アップロード後にS3へWebPを保存するバックグラウンドジョブ
class WebpConversionJob < ApplicationJob
  queue_as :default
 
  def perform(blob_id)
    blob = ActiveStorage::Blob.find(blob_id)
    return unless blob.image?
 
    blob.open do |file|
      webp_path = "#{file.path}.webp"
      system("convert #{file.path} -quality 80 #{webp_path}")
 
      Aws::S3::Client.new.put_object(
        bucket: ENV['UPLOADS_BUCKET'],
        key: "uploads/#{blob.key}.webp",
        body: File.open(webp_path),
        content_type: 'image/webp',
        cache_control: 'public, max-age=31536000, immutable'
      )
    end
  end
end

# config/storage.yml
amazon:
  service: S3
  access_key_id: <%= Rails.application.credentials.dig(:aws, :access_key_id) %>
  secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %>
  region: ap-northeast-1
  bucket: echo-task-uploads-prod

# app/models/concerns/cdn_attachable.rb
module CdnAttachable
  extend ActiveSupport::Concern
  CDN_HOST   = ENV.fetch('CDN_HOST', 'assets.echotask.example.com')
  S3_HOST_RE = /\Ahttps?:\/\/[^\/]*\.s3[^\/]*\.amazonaws\.com/
 
  # Active StorageのS3 URLをCDN URLに変換して返す
  def cdn_url(attachment)
    return nil unless attachment.attached?
    rails_blob_url(attachment, only_path: false)
      .sub(S3_HOST_RE, "https://#{CDN_HOST}")
  end
end
 
class User < ApplicationRecord
  include CdnAttachable
  has_one_attached :avatar
  def avatar_cdn_url = cdn_url(avatar)
end

# cloudformation/route53-geo.yml（抜粋）
Resources:
  # アジアユーザー → 東京CloudFront
  AsiaRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: api.echotask.example.com
      Type: A
      SetIdentifier: asia
      GeoLocation:
        ContinentCode: AS
      AliasTarget:
        DNSName: !GetAtt TokyoCloudFront.DomainName
        HostedZoneId: Z2FDTNDATAQYW2   # CloudFront固定値
 
  # 北米ユーザー → バージニアCloudFront
  NorthAmericaRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: api.echotask.example.com
      Type: A
      SetIdentifier: north-america
      GeoLocation:
        ContinentCode: NA
      AliasTarget:
        DNSName: !GetAtt VirginiaCloudFront.DomainName
        HostedZoneId: Z2FDTNDATAQYW2
 
  # その他 → 東京（デフォルト）
  DefaultRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: api.echotask.example.com
      Type: A
      SetIdentifier: default
      GeoLocation: { CountryCode: '*' }
      AliasTarget:
        DNSName: !GetAtt TokyoCloudFront.DomainName
        HostedZoneId: Z2FDTNDATAQYW2
 
  TokyoHealthCheck:
    Type: AWS::Route53::HealthCheck
    Properties:
      HealthCheckConfig:
        Type: HTTPS
        FullyQualifiedDomainName: api-tokyo.echotask.example.com
        ResourcePath: /health
        RequestInterval: 30
        FailureThreshold: 3  # 3回失敗でフェイルオーバー

# cloudformation/waf-stack.yml
# ※ CloudFront用WAF Web ACLは us-east-1 リージョンで作成必須
WAFWebACL:
  Type: AWS::WAFv2::WebACL
  Properties:
    Name: echo-task-waf
    Scope: CLOUDFRONT
    DefaultAction:
      Allow: {}
    Rules:
      # AWSマネージドルール（SQLi / XSSなど一般的な脅威対策）
      - Name: AWSManagedRulesCommonRuleSet
        Priority: 1
        OverrideAction: { None: {} }
        Statement:
          ManagedRuleGroupStatement:
            VendorName: AWS
            Name: AWSManagedRulesCommonRuleSet
        VisibilityConfig:
          SampledRequestsEnabled: true
          CloudWatchMetricsEnabled: true
          MetricName: CommonRuleSet
      # レートリミット（IP単位で5分間1,000リクエストまで）
      - Name: RateLimitRule
        Priority: 2
        Action: { Block: {} }
        Statement:
          RateBasedStatement:
            Limit: 1000
            AggregateKeyType: IP
        VisibilityConfig:
          SampledRequestsEnabled: true
          CloudWatchMetricsEnabled: true
          MetricName: RateLimit

# WAFのブロックログをRailsから参照
# app/services/waf_log_analyzer.rb
class WafLogAnalyzer
  def self.blocked_last_hour
    Aws::CloudWatchLogs::Client.new(region: 'us-east-1')
      .filter_log_events(
        log_group_name: '/aws/waf/echo-task',
        start_time: 1.hour.ago.to_i * 1000,
        filter_pattern: '{ $.action = "BLOCK" }'
      ).events.map { |e| JSON.parse(e.message) }
  end
end

# 緊急時は全体を、通常は特定パスのみ
aws cloudfront create-invalidation \
  --distribution-id E1ABCDEFGHIJKL \
  --paths "/assets/*" "/uploads/*" "/api/v1/tasks"

# app/services/cdn_invalidation_service.rb
class CdnInvalidationService
  include Singleton
 
  def initialize
    @client = Aws::CloudFront::Client.new(region: 'us-east-1')
    @dist_id = ENV.fetch('CLOUDFRONT_DISTRIBUTION_ID')
  end
 
  def invalidate(paths)
    @client.create_invalidation(
      distribution_id: @dist_id,
      invalidation_batch: {
        paths: { quantity: paths.length, items: paths },
        caller_reference: "#{Time.current.to_i}-#{SecureRandom.hex(4)}"
      }
    )
  end
end
 
# app/models/task.rb
class Task < ApplicationRecord
  after_commit on: [:update, :destroy] do
    CdnInvalidationService.instance.invalidate(
      ["/api/v1/tasks", "/api/v1/tasks/#{id}"]
    )
  end
end

# OACはCloudFormation/CDNスタック内で定義済み（前掲のcdn-stack.yml参照）
# S3バケットポリシー — CloudFrontサービスプリンシパルのみ許可
BucketPolicy:
  Type: AWS::S3::BucketPolicy
  Properties:
    Bucket: !Ref AssetsBucket
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal: { Service: cloudfront.amazonaws.com }
          Action: s3:GetObject
          Resource: !Sub "${AssetsBucket.Arn}/*"
          Condition:
            StringEquals:
              AWS:SourceArn: !Sub
                "arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"

# spec/services/cdn_security_spec.rb
RSpec.describe 'CDN Security' do
  it 'S3直接アクセスが403を返す' do
    url = "https://echo-task-assets-prod.s3.ap-northeast-1.amazonaws.com/assets/application.css"
    expect(Net::HTTP.get_response(URI(url)).code).to eq('403')
  end
 
  it 'CloudFront経由では200でx-cacheヘッダーが付く' do
    res = Net::HTTP.get_response(URI("https://assets.echotask.example.com/assets/application.css"))
    expect(res.code).to eq('200')
    expect(res['x-cache']).to match(/cloudfront/i)
  end
end