@exabugs/dynamodb-client 1.5.2 → 1.6.0

package/terraform/media/main.tf

@@ -0,0 +1,791 @@
+# メディア（ファイルアップロード/処理/配信）機能モジュール
+#
+# 詳細設計: ../../docs/media-design.md
+# 決定事項・トレードオフ: ../../docs/adr/0002-media-design.md
+#
+# 本モジュールは upload-handler（presign/sign発行）のLambdaリソースを含まない。
+# 「誰にpresign/署名URLを発行するか」の認可判断はアプリごとに、かつ同一アプリ内でも
+# クライアント（モバイル/管理画面等）ごとに異なるため、Terraformでは画一的な
+# リソースとして定義できない。呼び出し側は次のいずれかの方法で自前にデプロイすること:
+#   (a) 既存のHTTP APIレイヤー（認証・権限チェック済み）から
+#       `../../src/server/media/presign.ts`・`sign.ts` を直接呼び出す
+#   (b) 対応する既存HTTPレイヤーが無いクライアント（例: 別の認証方式を使う管理画面）向けには
+#       `../../src/server/media/upload-handler.ts` の `createUploadHandler()` を使い、
+#       専用の小さなLambdaとして自前でバンドル・デプロイする
+
+locals {
+  name_prefix = "${var.project_name}-${var.environment}-media"
+}
+
+# ============================================================
+# S3バケット（raw/master/cache の3プレフィックス、完全非公開）
+# ============================================================
+
+resource "aws_s3_bucket" "media" {
+  bucket = local.name_prefix
+
+  tags = {
+    Name = local.name_prefix
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "media" {
+  bucket = aws_s3_bucket.media.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+# cache/* のみ自動削除。raw/*・master/*は恒久保存
+resource "aws_s3_bucket_lifecycle_configuration" "media" {
+  bucket = aws_s3_bucket.media.id
+
+  rule {
+    id     = "expire-cache"
+    status = "Enabled"
+
+    filter {
+      prefix = "cache/"
+    }
+
+    expiration {
+      days = var.image_cache_ttl_days
+    }
+  }
+}
+
+# ブラウザ（管理画面等）からpresigned POSTで直接S3へアップロードする場合に必要。
+# 無いとプリフライトリクエストが失敗しアップロードが全滅する
+# （モバイルアプリ（React Native）はCORSの対象外のため影響しない）。
+resource "aws_s3_bucket_cors_configuration" "media" {
+  count = length(var.allowed_upload_origins) > 0 ? 1 : 0
+
+  bucket = aws_s3_bucket.media.id
+
+  cors_rule {
+    allowed_methods = ["POST"]
+    allowed_origins = var.allowed_upload_origins
+    allowed_headers = ["*"]
+    max_age_seconds = 3000
+  }
+}
+
+# CloudFront OAC経由のアクセスのみ許可。Resourceはmaster/*に限定し、
+# raw/*・cache/*をバケットポリシー経由で公開しない（cache/*はmedia-handlerの実行ロール経由のみ）
+resource "aws_s3_bucket_policy" "media" {
+  bucket = aws_s3_bucket.media.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "AllowCloudFrontOACReadMasterOnly"
+        Effect    = "Allow"
+        Principal = { Service = "cloudfront.amazonaws.com" }
+        Action    = "s3:GetObject"
+        Resource  = "${aws_s3_bucket.media.arn}/master/*"
+        Condition = {
+          StringEquals = {
+            "AWS:SourceArn" = aws_cloudfront_distribution.media.arn
+          }
+        }
+      }
+    ]
+  })
+}
+
+# ============================================================
+# DLQ（process-handlerのon-failure宛先）
+# ============================================================
+
+resource "aws_sqs_queue" "process_handler_dlq" {
+  name                      = "${local.name_prefix}-process-dlq"
+  message_retention_seconds = 1209600 # 14日（SQS上限）
+
+  tags = {
+    Name = "${local.name_prefix}-process-dlq"
+  }
+}
+
+# ============================================================
+# sharp Lambda Layer（scripts/build-sharp-layer.shで事前ビルド）
+# ============================================================
+
+resource "aws_lambda_layer_version" "sharp" {
+  layer_name          = "${local.name_prefix}-sharp"
+  filename            = "${path.module}/../../dist/sharp-layer.zip"
+  source_code_hash    = filebase64sha256("${path.module}/../../dist/sharp-layer.zip")
+  compatible_runtimes = ["nodejs22.x"]
+  # sharp-layer.zipはlinux/arm64向けにビルドされる（build-sharp-layer.sh参照）
+  compatible_architectures = ["arm64"]
+}
+
+# ============================================================
+# process-handler Lambda（S3 ObjectCreatedトリガー）
+# ============================================================
+
+resource "aws_iam_role" "process_handler" {
+  name = "${local.name_prefix}-process-handler-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action    = "sts:AssumeRole"
+        Effect    = "Allow"
+        Principal = { Service = "lambda.amazonaws.com" }
+      }
+    ]
+  })
+
+  tags = {
+    Name = "${local.name_prefix}-process-handler-role"
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "process_handler_basic" {
+  role       = aws_iam_role.process_handler.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy" "process_handler_s3" {
+  name = "s3-access"
+  role = aws_iam_role.process_handler.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["s3:GetObject"]
+        Resource = "${aws_s3_bucket.media.arn}/raw/*"
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["s3:PutObject", "s3:GetObject"]
+        Resource = "${aws_s3_bucket.media.arn}/master/*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "process_handler_dynamodb" {
+  name = "dynamodb-access"
+  role = aws_iam_role.process_handler.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        # DeleteItem: updateMany（handleUpdateOneの内部実装）はTransactWriteの中で
+        # 更新前の古いShadow Recordを削除する処理を含むため、2回目以降の更新に必須
+        Action   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:BatchGetItem", "dynamodb:Query"]
+        Resource = [var.table_arn, "${var.table_arn}/index/*"]
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "process_handler_ssm" {
+  name = "ssm-access"
+  role = aws_iam_role.process_handler.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["ssm:GetParameter"]
+        Resource = "arn:aws:ssm:${var.region}:*:parameter${var.image_policy_param}"
+      }
+    ]
+  })
+}
+
+# Lambda非同期呼び出し失敗時のon-failure宛先として送信する権限
+resource "aws_iam_role_policy" "process_handler_dlq_send" {
+  name = "dlq-send"
+  role = aws_iam_role.process_handler.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["sqs:SendMessage"]
+        Resource = aws_sqs_queue.process_handler_dlq.arn
+      }
+    ]
+  })
+}
+
+resource "aws_cloudwatch_log_group" "process_handler" {
+  name              = "/aws/lambda/${local.name_prefix}-process-handler"
+  retention_in_days = var.log_retention_days
+
+  tags = {
+    Name = "${local.name_prefix}-process-handler-logs"
+  }
+}
+
+data "archive_file" "process_handler" {
+  type        = "zip"
+  source_file = "${path.module}/../../dist/server/media-process-handler.cjs"
+  output_path = "${path.module}/../../dist/server/media-process-handler.zip"
+}
+
+resource "aws_lambda_function" "process_handler" {
+  function_name = "${local.name_prefix}-process-handler"
+  description   = "メディア処理（EXIF除去・リサイズ・master配置）。S3 ObjectCreated（raw/*）トリガー"
+  role          = aws_iam_role.process_handler.arn
+
+  filename         = data.archive_file.process_handler.output_path
+  source_code_hash = data.archive_file.process_handler.output_base64sha256
+
+  runtime       = "nodejs22.x"
+  architectures = ["arm64"] # sharp-layer.zip（linux/arm64）に合わせる
+  handler       = "media-process-handler.handler"
+
+  timeout     = var.process_handler_timeout
+  memory_size = var.process_handler_memory_size
+
+  layers = [aws_lambda_layer_version.sharp.arn]
+
+  environment {
+    variables = {
+      REGION                  = var.region
+      TABLE_NAME              = var.table_name
+      IMAGE_POLICY_PARAM      = var.image_policy_param
+      SHADOW_CREATED_AT_FIELD = var.shadow_created_at_field
+      SHADOW_UPDATED_AT_FIELD = var.shadow_updated_at_field
+      SHADOW_STRING_MAX_BYTES = var.shadow_string_max_bytes
+      SHADOW_NUMBER_PADDING   = var.shadow_number_padding
+    }
+  }
+
+  depends_on = [
+    aws_cloudwatch_log_group.process_handler,
+    aws_iam_role_policy.process_handler_s3,
+    aws_iam_role_policy.process_handler_dynamodb,
+    aws_iam_role_policy.process_handler_ssm,
+  ]
+
+  tags = {
+    Name = "${local.name_prefix}-process-handler"
+  }
+}
+
+resource "aws_lambda_function_event_invoke_config" "process_handler" {
+  function_name          = aws_lambda_function.process_handler.function_name
+  maximum_retry_attempts = 2
+  # 既定の6時間だと、リトライが尽きてDLQ経由でfailedが書き込まれるまで
+  # 呼び出し側のポーリングが長時間ブロックされ得る。短く設定し、クライアントの
+  # タイムアウト判断（詳細: docs/media-design.md「ポーリングが区別すべき状態」）
+  # と整合させる。
+  maximum_event_age_in_seconds = 300
+
+  destination_config {
+    on_failure {
+      destination = aws_sqs_queue.process_handler_dlq.arn
+    }
+  }
+}
+
+resource "aws_lambda_permission" "s3_invoke_process_handler" {
+  statement_id  = "AllowS3Invoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.process_handler.function_name
+  principal     = "s3.amazonaws.com"
+  source_arn    = aws_s3_bucket.media.arn
+}
+
+resource "aws_s3_bucket_notification" "media" {
+  bucket = aws_s3_bucket.media.id
+
+  lambda_function {
+    lambda_function_arn = aws_lambda_function.process_handler.arn
+    events              = ["s3:ObjectCreated:*"]
+    filter_prefix       = "raw/"
+  }
+
+  depends_on = [aws_lambda_permission.s3_invoke_process_handler]
+}
+
+# ============================================================
+# process-handler-dlq Lambda（SQS DLQトリガー）
+# ============================================================
+
+resource "aws_iam_role" "process_handler_dlq" {
+  name = "${local.name_prefix}-process-handler-dlq-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action    = "sts:AssumeRole"
+        Effect    = "Allow"
+        Principal = { Service = "lambda.amazonaws.com" }
+      }
+    ]
+  })
+
+  tags = {
+    Name = "${local.name_prefix}-process-handler-dlq-role"
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "process_handler_dlq_basic" {
+  role       = aws_iam_role.process_handler_dlq.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy" "process_handler_dlq_sqs" {
+  name = "sqs-access"
+  role = aws_iam_role.process_handler_dlq.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"]
+        Resource = aws_sqs_queue.process_handler_dlq.arn
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "process_handler_dlq_s3" {
+  name = "s3-access"
+  role = aws_iam_role.process_handler_dlq.id
+
+  # failedレコードにownerId等のアプリ固有メタデータを含めるため、raw/{fileId}を
+  # HeadObjectで再取得する（process-handler-dlq.ts）。この権限が無いとHeadObjectが
+  # 常にAccessDeniedになり、fail-soft設計により静かに失敗し続ける
+  # （メタデータ無しのfailedレコードが書き込まれ、権限スコープ付きポーリングで
+  # 読めないままクライアントが無限ポーリングする問題が再発する）。
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["s3:GetObject"]
+        Resource = "${aws_s3_bucket.media.arn}/raw/*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "process_handler_dlq_dynamodb" {
+  name = "dynamodb-access"
+  role = aws_iam_role.process_handler_dlq.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:BatchGetItem"]
+        Resource = [var.table_arn, "${var.table_arn}/index/*"]
+      }
+    ]
+  })
+}
+
+resource "aws_cloudwatch_log_group" "process_handler_dlq" {
+  name              = "/aws/lambda/${local.name_prefix}-process-handler-dlq"
+  retention_in_days = var.log_retention_days
+
+  tags = {
+    Name = "${local.name_prefix}-process-handler-dlq-logs"
+  }
+}
+
+data "archive_file" "process_handler_dlq" {
+  type        = "zip"
+  source_file = "${path.module}/../../dist/server/media-process-handler-dlq.cjs"
+  output_path = "${path.module}/../../dist/server/media-process-handler-dlq.zip"
+}
+
+resource "aws_lambda_function" "process_handler_dlq" {
+  function_name = "${local.name_prefix}-process-handler-dlq"
+  description   = "process-handlerのリトライが尽きた場合にfailedレコードを書き込む（SQS DLQトリガー）"
+  role          = aws_iam_role.process_handler_dlq.arn
+
+  filename         = data.archive_file.process_handler_dlq.output_path
+  source_code_hash = data.archive_file.process_handler_dlq.output_base64sha256
+
+  runtime       = "nodejs22.x"
+  architectures = ["arm64"]
+  handler       = "media-process-handler-dlq.handler"
+
+  timeout     = 30
+  memory_size = 256
+
+  environment {
+    variables = {
+      REGION                  = var.region
+      TABLE_NAME              = var.table_name
+      SHADOW_CREATED_AT_FIELD = var.shadow_created_at_field
+      SHADOW_UPDATED_AT_FIELD = var.shadow_updated_at_field
+      SHADOW_STRING_MAX_BYTES = var.shadow_string_max_bytes
+      SHADOW_NUMBER_PADDING   = var.shadow_number_padding
+    }
+  }
+
+  depends_on = [
+    aws_cloudwatch_log_group.process_handler_dlq,
+    aws_iam_role_policy.process_handler_dlq_sqs,
+    aws_iam_role_policy.process_handler_dlq_dynamodb,
+    aws_iam_role_policy.process_handler_dlq_s3,
+  ]
+
+  tags = {
+    Name = "${local.name_prefix}-process-handler-dlq"
+  }
+}
+
+resource "aws_lambda_event_source_mapping" "process_handler_dlq" {
+  event_source_arn = aws_sqs_queue.process_handler_dlq.arn
+  function_name    = aws_lambda_function.process_handler_dlq.arn
+  batch_size       = 1
+}
+
+# ============================================================
+# media-handler Lambda（CloudFront /resize/* 専用オリジン）
+# ============================================================
+
+resource "aws_iam_role" "media_handler" {
+  name = "${local.name_prefix}-media-handler-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action    = "sts:AssumeRole"
+        Effect    = "Allow"
+        Principal = { Service = "lambda.amazonaws.com" }
+      }
+    ]
+  })
+
+  tags = {
+    Name = "${local.name_prefix}-media-handler-role"
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "media_handler_basic" {
+  role       = aws_iam_role.media_handler.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+# 署名鍵へのSSM権限・DynamoDB権限は付与しない（最小権限。media-handlerに不要なため）
+resource "aws_iam_role_policy" "media_handler_s3" {
+  name = "s3-access"
+  role = aws_iam_role.media_handler.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["s3:GetObject"]
+        Resource = "${aws_s3_bucket.media.arn}/master/*"
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["s3:GetObject", "s3:PutObject"]
+        Resource = "${aws_s3_bucket.media.arn}/cache/*"
+      },
+      {
+        # s3:ListBucket が無いロールでGetObjectが存在しないキーを指すと、S3は
+        # NoSuchKey（404相当）ではなく403 AccessDeniedを返す（存在確認防止のためのAWS仕様）。
+        # これを許可しないと tryGetFromS3() の NoSuchKey 判定に当たらず、
+        # cache未生成時の初回リクエストが常に500になる。
+        Effect   = "Allow"
+        Action   = ["s3:ListBucket"]
+        Resource = aws_s3_bucket.media.arn
+        Condition = {
+          StringLike = {
+            "s3:prefix" = ["master/*", "cache/*"]
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "media_handler_ssm" {
+  name = "ssm-access"
+  role = aws_iam_role.media_handler.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["ssm:GetParameter"]
+        Resource = "arn:aws:ssm:${var.region}:*:parameter${var.image_policy_param}"
+      }
+    ]
+  })
+}
+
+resource "aws_cloudwatch_log_group" "media_handler" {
+  name              = "/aws/lambda/${local.name_prefix}-handler"
+  retention_in_days = var.log_retention_days
+
+  tags = {
+    Name = "${local.name_prefix}-handler-logs"
+  }
+}
+
+data "archive_file" "media_handler" {
+  type        = "zip"
+  source_file = "${path.module}/../../dist/server/media-handler.cjs"
+  output_path = "${path.module}/../../dist/server/media-handler.zip"
+}
+
+resource "aws_lambda_function" "media_handler" {
+  function_name = "${local.name_prefix}-handler"
+  description   = "CloudFront /resize/* 専用オリジン。オンデマンドリサイズ"
+  role          = aws_iam_role.media_handler.arn
+
+  filename         = data.archive_file.media_handler.output_path
+  source_code_hash = data.archive_file.media_handler.output_base64sha256
+
+  runtime       = "nodejs22.x"
+  architectures = ["arm64"] # sharp-layer.zip（linux/arm64）に合わせる
+  handler       = "media-handler.handler"
+
+  timeout     = 30
+  memory_size = var.media_handler_memory_size
+
+  layers = [aws_lambda_layer_version.sharp.arn]
+
+  environment {
+    variables = {
+      REGION             = var.region
+      MEDIA_BUCKET       = aws_s3_bucket.media.bucket
+      IMAGE_POLICY_PARAM = var.image_policy_param
+    }
+  }
+
+  depends_on = [
+    aws_cloudwatch_log_group.media_handler,
+    aws_iam_role_policy.media_handler_s3,
+    aws_iam_role_policy.media_handler_ssm,
+  ]
+
+  tags = {
+    Name = "${local.name_prefix}-handler"
+  }
+}
+
+# CloudFrontからのみ呼び出し可能にする（AWS_IAM認証、CloudFront OAC経由）
+resource "aws_lambda_function_url" "media_handler" {
+  function_name      = aws_lambda_function.media_handler.function_name
+  authorization_type = "AWS_IAM"
+}
+
+resource "aws_lambda_permission" "cloudfront_invoke_media_handler" {
+  statement_id           = "AllowCloudFrontInvokeFunctionUrl"
+  action                 = "lambda:InvokeFunctionUrl"
+  function_name          = aws_lambda_function.media_handler.function_name
+  principal              = "cloudfront.amazonaws.com"
+  source_arn             = aws_cloudfront_distribution.media.arn
+  function_url_auth_type = "AWS_IAM"
+}
+
+# AWSはFunction URL + OAC経由の呼び出しに対してDual Auth（lambda:InvokeFunctionUrl
+# とlambda:InvokeFunctionの両方の許可）を正式に要求する（移行猶予期間は2026-11-01
+# まで）。lambda:InvokeFunctionUrlだけの許可では、猶予期間終了後に/resize/*が
+# 全件403になる（詳細: docs/adr/0002-media-design.md）。
+# invoked_via_function_url=true により、この許可をFunction URL経由の呼び出しに
+# 限定する（AWS推奨の条件キー）。
+resource "aws_lambda_permission" "cloudfront_invoke_media_handler_function" {
+  statement_id             = "AllowCloudFrontInvokeFunction"
+  action                   = "lambda:InvokeFunction"
+  function_name            = aws_lambda_function.media_handler.function_name
+  principal                = "cloudfront.amazonaws.com"
+  source_arn               = aws_cloudfront_distribution.media.arn
+  invoked_via_function_url = true
+}
+
+# ============================================================
+# CloudFront配信（署名付きURL必須、/master/*・/resize/*の2ビヘイビア）
+# ============================================================
+
+resource "aws_cloudfront_origin_access_control" "media_s3" {
+  name                              = "${local.name_prefix}-s3-oac"
+  origin_access_control_origin_type = "s3"
+  signing_behavior                  = "always"
+  signing_protocol                  = "sigv4"
+}
+
+resource "aws_cloudfront_origin_access_control" "media_handler" {
+  name                              = "${local.name_prefix}-lambda-oac"
+  origin_access_control_origin_type = "lambda"
+  signing_behavior                  = "always"
+  signing_protocol                  = "sigv4"
+}
+
+data "aws_ssm_parameter" "signing_public_key" {
+  name = var.signing_public_key_param
+}
+
+resource "aws_cloudfront_public_key" "media" {
+  name        = "${local.name_prefix}-signing-key"
+  encoded_key = data.aws_ssm_parameter.signing_public_key.value
+  comment     = "Media delivery signing key (2048bit RSA)"
+}
+
+resource "aws_cloudfront_key_group" "media" {
+  name  = "${local.name_prefix}-key-group"
+  items = [aws_cloudfront_public_key.media.id]
+}
+
+# width クエリパラメータのみキャッシュキーに含め、署名パラメータは除外する
+resource "aws_cloudfront_cache_policy" "resize" {
+  name    = "${local.name_prefix}-resize-cache-policy"
+  comment = "width のみキャッシュキーに含める。署名付きURLのExpires/Signature/Key-Pair-Idは除外"
+
+  default_ttl = 86400
+  max_ttl     = 31536000
+  min_ttl     = 0
+
+  parameters_in_cache_key_and_forwarded_to_origin {
+    cookies_config {
+      cookie_behavior = "none"
+    }
+    headers_config {
+      header_behavior = "none"
+    }
+    query_strings_config {
+      query_string_behavior = "whitelist"
+      query_strings {
+        items = ["width"]
+      }
+    }
+    enable_accept_encoding_brotli = true
+    enable_accept_encoding_gzip   = true
+  }
+}
+
+locals {
+  # AWSマネージドポリシー（キャッシュポリシー/オリジンリクエストポリシー）のID
+  # CachingOptimized: S3静的ファイル配信向けの標準キャッシュポリシー
+  managed_caching_optimized_policy_id = "658327ea-f89d-4fab-a63d-7e88639e58f6"
+  # AllViewerExceptHostHeader: Hostヘッダーのみ転送しない（Function URLがHostヘッダー転送時に403を返すため）
+  managed_all_viewer_except_host_header_policy_id = "b689b0a8-53d0-40ab-baf2-68738e2966ac"
+
+  media_handler_function_url_domain = replace(
+    replace(aws_lambda_function_url.media_handler.function_url, "https://", ""),
+    "/",
+    ""
+  )
+
+  has_custom_domain = var.domain_name != null && var.acm_certificate_arn != null
+}
+
+resource "aws_cloudfront_distribution" "media" {
+  enabled     = true
+  comment     = "${local.name_prefix} delivery"
+  price_class = "PriceClass_200"
+
+  aliases = local.has_custom_domain ? [var.domain_name] : []
+
+  origin {
+    domain_name              = aws_s3_bucket.media.bucket_regional_domain_name
+    origin_id                = "s3-media"
+    origin_access_control_id = aws_cloudfront_origin_access_control.media_s3.id
+  }
+
+  origin {
+    domain_name              = local.media_handler_function_url_domain
+    origin_id                = "lambda-media-handler"
+    origin_access_control_id = aws_cloudfront_origin_access_control.media_handler.id
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      origin_protocol_policy = "https-only"
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+  }
+
+  # デフォルトビヘイビア（想定外のパス）。masterと同じ扱いにしておく
+  default_cache_behavior {
+    target_origin_id       = "s3-media"
+    viewer_protocol_policy = "redirect-to-https"
+    allowed_methods        = ["GET", "HEAD"]
+    cached_methods         = ["GET", "HEAD"]
+    cache_policy_id        = local.managed_caching_optimized_policy_id
+    trusted_key_groups     = [aws_cloudfront_key_group.media.id]
+  }
+
+  ordered_cache_behavior {
+    path_pattern           = "/master/*"
+    target_origin_id       = "s3-media"
+    viewer_protocol_policy = "redirect-to-https"
+    allowed_methods        = ["GET", "HEAD"]
+    cached_methods         = ["GET", "HEAD"]
+    cache_policy_id        = local.managed_caching_optimized_policy_id
+    trusted_key_groups     = [aws_cloudfront_key_group.media.id]
+  }
+
+  ordered_cache_behavior {
+    path_pattern             = "/resize/*"
+    target_origin_id         = "lambda-media-handler"
+    viewer_protocol_policy   = "redirect-to-https"
+    allowed_methods          = ["GET", "HEAD"]
+    cached_methods           = ["GET", "HEAD"]
+    cache_policy_id          = aws_cloudfront_cache_policy.resize.id
+    origin_request_policy_id = local.managed_all_viewer_except_host_header_policy_id
+    trusted_key_groups       = [aws_cloudfront_key_group.media.id]
+  }
+
+  # 404/403応答がネガティブキャッシュ（既定約10秒）で長引かないようにする
+  custom_error_response {
+    error_code            = 403
+    error_caching_min_ttl = 0
+  }
+  custom_error_response {
+    error_code            = 404
+    error_caching_min_ttl = 0
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = local.has_custom_domain ? null : true
+    acm_certificate_arn            = local.has_custom_domain ? var.acm_certificate_arn : null
+    ssl_support_method             = local.has_custom_domain ? "sni-only" : null
+    minimum_protocol_version       = local.has_custom_domain ? "TLSv1.2_2021" : null
+  }
+
+  tags = {
+    Name = local.name_prefix
+  }
+}
+
+resource "aws_route53_record" "media" {
+  count = local.has_custom_domain && var.route53_zone_id != null ? 1 : 0
+
+  zone_id = var.route53_zone_id
+  name    = var.domain_name
+  type    = "A"
+
+  alias {
+    name                   = aws_cloudfront_distribution.media.domain_name
+    zone_id                = aws_cloudfront_distribution.media.hosted_zone_id
+    evaluate_target_health = false
+  }
+}