infra(terraform): Phase 1 Sprint 0 — (platform) network: VPC+Subnet+IGW+RT+NAT+S3 GW EP+SSM publish(S0Infra-4)

[win2cot]

Phase 1 Sprint 0 Infra-4: (platform) network — VPC + Subnets + IGW + RT + NAT + S3 GW EP + SSM publish

概要

dev 共有(platform)stack の network を構築。CIDR 10.0.0.0/16、2 AZ に Public / Private Subnet 各 1、IGW、Route Tables、NAT Gateway(single-AZ)+ S3 Gateway Endpoint(outbound は ADR-0003 で確定済み)。出力は SSM へ publish し、tasks stack が参照する(ADR-0004)。

詳細仕様: infra/docs/adr/0004-platform-project-infra-separation.md / infra/docs/adr/0003-private-subnet-outbound.md / docs/architecture/infrastructure-plan.md §3.1 / §3.5。

stack / 配置(ADR-0004)

• platform stack: root infra/shared/environments/dev/(key platform/dev/terraform.tfstate)、module infra/shared/modules/network/
• 命名 platform-dev-* / タグ Project=platform(tasks 非依存)

実装内容

A. Terraform module(infra/shared/modules/network/)

リソース	詳細
VPC	CIDR 10.0.0.0/16、enable_dns_support / enable_dns_hostnames = true
Public Subnet ×2	10.0.0.0/24 / 10.0.1.0/24
Private Subnet ×2	10.0.10.0/24 / 10.0.11.0/24
Internet Gateway	VPC attach
Route Table (Public)	0.0.0.0/0 → IGW
NAT Gateway	single-AZ(dev コスト最適、ADR-0003)+ EIP
Route Table (Private)	0.0.0.0/0 → NAT GW
S3 Gateway Endpoint	Private RT に関連付け(S3 は無料 GW EP 経由、ADR-0003)

B. shared/environments/dev で呼び出し + SSM publish

• infra/shared/environments/dev/main.tf から network module 呼び出し
• 出力を /platform/dev/network/* に publish(aws_ssm_parameter): vpc-id / public-subnet-ids(StringList) / private-subnet-ids(StringList)

受入条件

• terraform plan(platform)差分なし
• VPC + 4 Subnet + IGW + 2 RT + NAT GW(+EIP) + S3 GW EP 作成済み
• Public Subnet 経由でインターネット到達、Private Subnet から NAT 経由 outbound 確認
• /platform/dev/network/* に vpc-id / subnet-ids が publish 済み

関連

• 親 tracker Issue: [Phase 1 Infra] Setup 0-2 + Sprint 0-5 Infra ストリーム横断 tracker #206
• ADR: ADR-0004(platform/tasks 分離)/ ADR-0003(outbound)
• Milestone: Phase 1 / Iteration: Phase 1 Sprint 0
• 依存: S0Infra-1(infra(terraform): Phase 1 Sprint 0 — Terraform プロジェクト構造 ADR(S0Infra-1) #238)/ S0Infra-2(infra(terraform): Phase 1 Sprint 0 — (platform) 共有 state backend(S3 + use_lockfile、key=platform/dev/* と tasks/dev/* の2本)(S0Infra-2) #239)/ S0Infra-3(infra(ci-cd): Phase 1 Sprint 0 — (platform/tasks) OIDC + plan/apply×platform/tasks = 4 IAM Role(Environment 分離)(S0Infra-3) #246、platform-apply role)
• 後続(blocker 鎖): platform ALB(infra(terraform): Phase 1 Sprint 0 — (platform) alb: ALB+Listener+SG-ALB+base cert+SSM publish(S0Infra-6) #242)→ tasks(SG infra(terraform): Phase 1 Sprint 0 — (tasks) Security Groups: SG-ECS/SG-RDS(SG-ALBは#242へ)(S0Infra-5) #241 / PHZ infra(terraform): Phase 1 Sprint 0 — (tasks) Route53 PHZ tasks.internal + 共有VPC association(VPC IDはSSM)(S0Infra-8) #244 / listener rule)

備考

• task-type: task-type:impl / 優先度: priority/p0 / area: area/infra
• claude-automation: 適用

[win2cot]

ADR-0004 再スコープ: platform stack の network module へ移設。VPC/Subnet/IGW/RT に NAT GW+EIP+S3 GW EP(ADR-0003 実装)を内包し、/platform/dev/* に SSM publish。命名 platform-dev-* / Project=platform。