A+B 複合 — asynccontextmanager × asyncio.timeout × Pydantic v2 model_validator（Ch2/Ch4/Ch7/Ch10/Ch11）× GKE Workload Identity Federation × Cloud Run v2 最小権限 × Cloud Armor OWASP WAF（Terraform）

📋 コピーimport asyncio
import redis.asyncio as aioredis

async def main():
    r = aioredis.from_url("redis://localhost:6379")
    await r.set("stock:PROD-001-AB", 10)
    await r.set("stock:PROD-002-CD", 2)

    requests = [
        {"product_id": "PROD-001-AB", "qty": 3},   # 在庫 10 → 成功
        {"product_id": "PROD-002-CD", "qty": 5},   # 在庫 2 → 在庫不足
        {"product_id": "PROD-999-XX", "qty": -1},  # qty < 0 → バリデーションエラー（スキップ）
    ]

    results = await reserve_inventory(requests, r)
    for result in results:
        print(result.summary)
    # [成功] product_id=PROD-001-AB qty=3 remaining=7
    # [在庫不足] product_id=PROD-002-CD qty=5 remaining=2

    # frozen dataclass なので変更不可
    # results[0].reserved = False  → FrozenInstanceError

asyncio.run(main())

📋 コピー# terraform/modules/mops-iam/main.tf
# GKE Workload Identity Federation × Cloud Run v2 最小権限 × Cloud Armor OWASP WAF

locals {
  project_id = var.project_id
  namespace  = "mops"
  ksa_name   = "mops-batch-ksa"
}

# ── GKE バッチ用 GSA（Workload Identity で使用）────────────────────────────
resource "google_service_account" "mops_batch_gsa" {
  account_id   = "mops-batch-sa"
  display_name = "MOps Batch GKE Workload Identity SA"
  description  = "GKE Pod が SA キーなし（キーレス）で GCP API にアクセスするための GSA"
  project      = local.project_id
}

# BigQuery・Pub/Sub・GCS の最小権限を付与（admin は付与しない）
resource "google_project_iam_member" "mops_batch_bq_data_editor" {
  project = local.project_id
  role    = "roles/bigquery.dataEditor"  # テーブルの読み書き
  member  = "serviceAccount:${google_service_account.mops_batch_gsa.email}"
}

resource "google_project_iam_member" "mops_batch_bq_job_user" {
  project = local.project_id
  role    = "roles/bigquery.jobUser"  # クエリジョブの実行（dataEditor とセット）
  member  = "serviceAccount:${google_service_account.mops_batch_gsa.email}"
}

resource "google_project_iam_member" "mops_batch_pubsub" {
  project = local.project_id
  role    = "roles/pubsub.publisher"  # メッセージ発行のみ
  member  = "serviceAccount:${google_service_account.mops_batch_gsa.email}"
}

resource "google_project_iam_member" "mops_batch_gcs" {
  project = local.project_id
  role    = "roles/storage.objectCreator"  # GCS 書き込みのみ（削除不可）
  member  = "serviceAccount:${google_service_account.mops_batch_gsa.email}"
}

# ── Workload Identity バインディング（KSA → GSA の紐付け）────────────────
# GKE Pod の KSA が GSA を impersonate できるようバインド
resource "google_service_account_iam_member" "workload_identity_binding" {
  service_account_id = google_service_account.mops_batch_gsa.name
  role               = "roles/iam.workloadIdentityUser"
  # 形式: serviceAccount:{project_id}.svc.id.goog[{namespace}/{ksa_name}]
  member = "serviceAccount:${local.project_id}.svc.id.goog[${local.namespace}/${local.ksa_name}]"
}

# ── Kubernetes ServiceAccount（GKE 側）──────────────────────────────────────
resource "kubernetes_service_account" "mops_batch_ksa" {
  metadata {
    name      = local.ksa_name
    namespace = local.namespace
    annotations = {
      # この Annotation で KSA と GSA が紐付く（Workload Identity の核心）
      "iam.gke.io/gcp-service-account" = google_service_account.mops_batch_gsa.email
    }
  }
  depends_on = [google_service_account_iam_member.workload_identity_binding]
}

# ── Cloud Run v2 用 GSA（最小権限）───────────────────────────────────────────
resource "google_service_account" "delivery_api_gsa" {
  account_id   = "delivery-api-sa"
  display_name = "MOps Delivery API Cloud Run SA"
  description  = "Cloud Run v2 専用 SA（roles/bigquery.admin は使わない）"
  project      = local.project_id
}

# roles/bigquery.admin を削除 → dataEditor + jobUser に絞る（最小権限原則）
resource "google_project_iam_member" "delivery_api_bq_data_editor" {
  project = local.project_id
  role    = "roles/bigquery.dataEditor"
  member  = "serviceAccount:${google_service_account.delivery_api_gsa.email}"
}

resource "google_project_iam_member" "delivery_api_bq_job_user" {
  project = local.project_id
  role    = "roles/bigquery.jobUser"
  member  = "serviceAccount:${google_service_account.delivery_api_gsa.email}"
}

# ── Cloud Armor セキュリティポリシー（OWASP SQLi / XSS + レートリミット）──
resource "google_compute_security_policy" "mops_waf_policy" {
  name        = "mops-waf-policy"
  description = "MOps 配信 API 用 WAF（OWASP CRS SQLi / XSS + DDoS 緩和）"
  project     = local.project_id

  # デフォルトルール: 全トラフィックを許可
  rule {
    action   = "allow"
    priority = 2147483647
    match {
      versioned_expr = "SRC_IPS_V1"
      config { src_ip_ranges = ["*"] }
    }
    description = "デフォルト: 全許可"
  }

  # SQLインジェクション検知（OWASP CRS sqli-v33-stable）
  rule {
    action   = "deny(403)"
    priority = 1000
    match {
      expr {
        # -stable は本番向けに false positive が低いルールセット
        expression = "evaluatePreconfiguredExpr('sqli-v33-stable')"
      }
    }
    description = "OWASP SQLi: SQLインジェクションを 403 で拒否"
  }

  # XSS 検知
  rule {
    action   = "deny(403)"
    priority = 1001
    match {
      expr {
        expression = "evaluatePreconfiguredExpr('xss-v33-stable')"
      }
    }
    description = "OWASP XSS: クロスサイトスクリプティングを 403 で拒否"
  }

  # レートリミット（DDoS 緩和）: IP あたり 100 req/分 を超えたら 429
  rule {
    action   = "throttle"
    priority = 900
    match {
      versioned_expr = "SRC_IPS_V1"
      config { src_ip_ranges = ["*"] }
    }
    rate_limit_options {
      rate_limit_threshold {
        count        = 100
        interval_sec = 60
      }
      conform_action = "allow"
      exceed_action  = "deny(429)"
      enforce_on_key = "IP"
    }
    description = "DDoS 緩和: 100 req/min 超えで 429"
  }
}

# ── Cloud Run v2 デプロイ（最小権限 SA）─────────────────────────────────────
resource "google_cloud_run_v2_service" "delivery_api" {
  name     = "delivery-api"
  location = var.region
  project  = local.project_id

  template {
    service_account = google_service_account.delivery_api_gsa.email  # 最小権限 SA

    containers {
      image = "gcr.io/${local.project_id}/delivery-api:latest"
      resources {
        limits          = { cpu = "1", memory = "512Mi" }
        cpu_idle          = true   # アイドル時 CPU 解放（コスト削減）
        startup_cpu_boost = true   # コールドスタート高速化
      }
    }
  }

  ingress = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"
}

# ── Cloud Run v2 の Serverless NEG（Cloud Armor アタッチ用）────────────────
resource "google_compute_region_network_endpoint_group" "delivery_api_neg" {
  name                  = "delivery-api-neg"
  region                = var.region
  project               = local.project_id
  network_endpoint_type = "SERVERLESS"
  cloud_run {
    service = google_cloud_run_v2_service.delivery_api.name
  }
}

# ── Backend Service（Cloud Armor をここでアタッチ）──────────────────────────
resource "google_compute_backend_service" "delivery_api_backend" {
  name    = "delivery-api-backend"
  project = local.project_id

  security_policy = google_compute_security_policy.mops_waf_policy.id  # Cloud Armor アタッチ

  backend {
    group = google_compute_region_network_endpoint_group.delivery_api_neg.id
  }

  log_config {
    enable      = true
    sample_rate = 1.0  # 全リクエストをロギング（WAF チューニング用）
  }
}