B システム設計/インフラ — Pub/Sub DLT（dead_letter_policy）× ack deadline 60s × push OIDC 認証 × Cloud Run v2 allUsers→最小権限 × min_instance_count=1 × DLT SA publish 権限 × 冪等性 message_id（MOps キャンペーンメール配信基盤 Bad→Good）

📋 コピー# ── 変数定義 ───────────────────────────────────────────
variable "project_id"  { type = string }
variable "region"      { type = string; default = "asia-northeast1" }
variable "app_version" { type = string; default = "1.4.2" }

data "google_project" "project" {
  project_id = var.project_id
}

# ── Cloud Run v2 サービス ────────────────────────────────
resource "google_cloud_run_v2_service" "email_worker" {
  name     = "campaign-email-worker"
  location = var.region
  project  = var.project_id

  # 修正④: 内部 LB のみ受け付け（allUsers からのアクセスをブロック）
  ingress = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"

  template {
    # 修正⑤: コールドスタートを防ぐ最低1インスタンス常駐
    scaling {
      min_instance_count = 1
      max_instance_count = 10
    }

    containers {
      image = "asia-northeast1-docker.pkg.dev/${var.project_id}/mops/email-worker:${var.app_version}"

      resources {
        limits   = { cpu = "1", memory = "512Mi" }
        # 修正⑤: 非同期スレッドが CPU を使い続けられるよう cpu_idle を false に
        cpu_idle = false
      }
    }

    service_account = google_service_account.email_worker.email

    labels = {
      "tags.datadoghq.com/service" = "campaign-email-worker"
      "tags.datadoghq.com/env"     = "production"
      "tags.datadoghq.com/version" = var.app_version
    }
  }
}

# 修正④: allUsers を削除し Pub/Sub 専用 invoker SA のみに絞る
resource "google_cloud_run_v2_service_iam_member" "pubsub_invoker" {
  project  = var.project_id
  location = var.region
  name     = google_cloud_run_v2_service.email_worker.name
  role     = "roles/run.invoker"
  member   = "serviceAccount:${google_service_account.pubsub_invoker.email}"
}

# ── Pub/Sub トピック（メイン + DLT）────────────────────────
resource "google_pubsub_topic" "campaign_email" {
  name    = "campaign-email"
  project = var.project_id
  message_storage_policy {
    allowed_persistence_regions = [var.region]
  }
}

# 修正①: DLT トピック
resource "google_pubsub_topic" "campaign_email_dlt" {
  name    = "campaign-email-dlt"
  project = var.project_id
  message_storage_policy {
    allowed_persistence_regions = [var.region]
  }
}

# ── Pub/Sub サブスクリプション（改善後）──────────────────────
resource "google_pubsub_subscription" "campaign_email_sub" {
  name    = "campaign-email-sub"
  topic   = google_pubsub_topic.campaign_email.id
  project = var.project_id

  # 修正②: 平均3秒・最大30秒の処理に対して余裕を持たせる
  ack_deadline_seconds = 60

  # 修正①: DLT 設定（5回失敗で DLT へ転送）
  dead_letter_policy {
    dead_letter_topic     = google_pubsub_topic.campaign_email_dlt.id
    max_delivery_attempts = 5
  }

  # 修正③: OIDC 認証付き push エンドポイント
  push_config {
    push_endpoint = google_cloud_run_v2_service.email_worker.uri
    oidc_token {
      service_account_email = google_service_account.pubsub_invoker.email
      audience              = google_cloud_run_v2_service.email_worker.uri
    }
  }

  message_retention_duration = "604800s"
  retain_acked_messages      = false

  # 指数バックオフで再配信（即時再配信を避ける）
  retry_policy {
    minimum_backoff = "10s"
    maximum_backoff = "300s"
  }
}

# DLT サブスクリプション（Alerting 用・手動調査）
resource "google_pubsub_subscription" "campaign_email_dlt_sub" {
  name                       = "campaign-email-dlt-sub"
  topic                      = google_pubsub_topic.campaign_email_dlt.id
  project                    = var.project_id
  ack_deadline_seconds       = 600  # 長め設定で手動調査の猶予
  message_retention_duration = "604800s"
}

# ── Service Account ────────────────────────────────────
resource "google_service_account" "email_worker" {
  account_id   = "campaign-email-worker"
  display_name = "Campaign Email Worker (Cloud Run)"
  project      = var.project_id
}

# 修正③: Pub/Sub push → Cloud Run 呼び出し専用 SA
resource "google_service_account" "pubsub_invoker" {
  account_id   = "pubsub-invoker"
  display_name = "Pub/Sub → Cloud Run Invoker"
  project      = var.project_id
}

# ── IAM 最小権限 ────────────────────────────────────────
# 修正⑥: roles/editor → roles/pubsub.publisher のみ
resource "google_pubsub_topic_iam_member" "worker_publish" {
  project = var.project_id
  topic   = google_pubsub_topic.campaign_email.id
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:${google_service_account.email_worker.email}"
}

# 修正⑥: 購読権限のみ付与（プロジェクトレベルの roles/editor を削除）
resource "google_pubsub_subscription_iam_member" "worker_subscribe" {
  project      = var.project_id
  subscription = google_pubsub_subscription.campaign_email_sub.id
  role         = "roles/pubsub.subscriber"
  member       = "serviceAccount:${google_service_account.email_worker.email}"
}

# 修正⑦: Pub/Sub 内部 SA が DLT トピックに publish できるよう権限付与
# （これがないと DLT への転送がサイレントに失敗する）
resource "google_pubsub_topic_iam_member" "pubsub_sa_dlt_publish" {
  project = var.project_id
  topic   = google_pubsub_topic.campaign_email_dlt.id
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
}

# Workload Identity Federation（email_worker SA）
resource "google_service_account_iam_member" "email_worker_wif" {
  service_account_id = google_service_account.email_worker.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principal://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${var.project_id}.svc.id.goog/subject/ns/mops/sa/campaign-email-worker"
}