2026/04/13

Amazon S3 Files を Lambda からマウントするTerraform で S3 Files を Lambda から使用してみました

岡本 渉 技術ブログ

data "aws_iam_policy_document" "s3files_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["elasticfilesystem.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = [
        "arn:aws:s3files:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:file-system/*"
      ]
    }
  }
}

data "aws_iam_policy_document" "s3files_sync" {
  statement {
    sid     = "S3BucketPermissions"
    actions = ["s3:ListBucket", "s3:ListBucketVersions"]
    resources = [aws_s3_bucket.demo.arn]
    condition {
      test     = "StringEquals"
      variable = "aws:ResourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
  }

  statement {
    sid = "S3ObjectPermissions"
    actions = [
      "s3:AbortMultipartUpload", "s3:DeleteObject*",
      "s3:GetObject*", "s3:List*", "s3:PutObject*",
    ]
    resources = ["${aws_s3_bucket.demo.arn}/*"]
    condition {
      test     = "StringEquals"
      variable = "aws:ResourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
  }

  statement {
    sid = "EventBridgeManage"
    actions = [
      "events:DeleteRule", "events:DisableRule", "events:EnableRule",
      "events:PutRule", "events:PutTargets", "events:RemoveTargets",
    ]
    resources = ["arn:aws:events:*:*:rule/DO-NOT-DELETE-S3-Files*"]
    condition {
      test     = "StringEquals"
      variable = "events:ManagedBy"
      values   = ["elasticfilesystem.amazonaws.com"]
    }
  }
}

Lambda の実行ロール

data "aws_iam_policy_document" "lambda_s3files" {
  statement {
    sid       = "S3FilesMount"
    actions   = ["s3files:ClientMount", "s3files:ClientWrite"]
    resources = ["*"]
  }
}

resource "aws_iam_role_policy_attachment" "lambda_vpc" {
  role       = aws_iam_role.lambda.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
}

resource "aws_lambda_function" "demo" {
  function_name = "${var.name_prefix}-writer"
  role          = aws_iam_role.lambda.arn
  handler       = "app.handler"
  runtime       = "nodejs24.x"
  timeout       = 30
  memory_size   = 512

  vpc_config {
    subnet_ids         = [for subnet in aws_subnet.lambda : subnet.id]
    security_group_ids = [aws_security_group.lambda.id]
  }

  file_system_config {
    arn              = aws_s3files_access_point.lambda.arn
    local_mount_path = "/mnt/s3files"
  }

  depends_on = [
    aws_s3files_mount_target.demo,
    aws_iam_role_policy.lambda_s3files,
    aws_iam_role_policy_attachment.lambda_vpc,
  ]
}

import { mkdir, readdir, writeFile } from "node:fs/promises";
import path from "node:path";

export const handler = async () => {
  const mountPath = process.env.DEMO_MOUNT_PATH ?? "/mnt/s3files";
  const targetDir = path.join(mountPath, "demo");

  await mkdir(targetDir, { recursive: true });

  const timestamp = new Date().toISOString()
    .replace(/[-:]/g, "")
    .replace(/\.\d{3}Z$/, "Z");
  const filename = `created-by-lambda-${timestamp}.txt`;

  await writeFile(
    path.join(targetDir, filename),
    `This file was created through an Amazon S3 Files mount.\ntimestamp=${timestamp}\n`,
    "utf8"
  );

  const files = (await readdir(targetDir, { withFileTypes: true }))
    .filter(e => e.isFile())
    .map(e => e.name);

  return {
    statusCode: 200,
    body: JSON.stringify({
      writtenFile: path.join(targetDir, filename),
      expectedS3Key: `${process.env.DEMO_PREFIX}/${filename}`,
      visibleFilesInMount: files,
      syncNote: "S3 への反映は最大 60 秒程度かかります",
    }),
  };
};